Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
2
votes
0answers
70 views

What's on Applied Cryptography? [closed]

Just wondering what is the story behind the front cover image of Schneier's Applied Cryptography book https://www.schneier.com/books/applied_cryptography/ Who is the author? Is it some famous picture ...
0
votes
1answer
671 views

What are the steps of hashing and steps of verifying password using salt and key? [duplicate]

What are the steps of hashing password during registration and login to an application using salt and key? Are the following steps considered correct if applied to an application?: 1- During ...
2
votes
1answer
377 views

How to store a user's password in a database in 2019? [duplicate]

This question, but focused on .NET's given PBKDF2 implementation, has been asked here now. Situation I am currently updating a password storage mechanism for a website. My plan for storing a ...
0
votes
2answers
213 views

Can anyone give feedback on this encryption program? [closed]

I am 14 years old and I have just created an encryption program with a friend. I wanted to know if anyone here could give me back any feedback on it. Here is how the program works, Imagine you want ...
1
vote
0answers
87 views

Outcome of Needham-Schroeder protocol

I am studying Needham-Schroeder protocol in my course subject and I understood it well, but there is a homework problem which is asking, "what is the outcome of Needham-Schroeder protocol?" ...
3
votes
3answers
425 views

Do integrity and authentication always come together?

I cannot come up with a case where there is only one of them. When there is integrity, a random person cannot modify the message without being noticed. That is, an unauthenticated user cannot modify ...
1
vote
0answers
59 views

TDE - Does Key Rotation involve full tablespace Decryption and Re-Encryption?

In Oracle DB 12c, which uses TDE-Tablespace level. If i want to implement key rotation policy, what is the impact? 1. Is it the Tablespace key that will be rotated or the Masterkey? 2. Does key ...
0
votes
0answers
47 views

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
1
vote
1answer
430 views

WEP cracking - Why does many IVs allow to actually get the cipher key [duplicate]

I've been reading a lot about WEP cracking on online resources very recently, however there is one question that no website gives answer to I believe. I would like to first understand the theory very ...
0
votes
0answers
68 views

Password authentication using a master key and KDF without storing password

I want to make a service stateless(has no data to store or mantain). But the service shoule be able to authenticate user. What I'm considering is using key derivation function with a shared master ...
0
votes
1answer
185 views

Authentication without sending password over network

I was reading this question about ssh authentication and there's a good discussion about authentication schemes. First, there's the answer that yes, ssh sends the full password to the server (but ...
4
votes
1answer
146 views

PBKDF2 doesn't seem to have a standardised implementation?

I recently read about the bug in Django with regards to PBKDF2 causing Denial of Service with large passwords: https://www.djangoproject.com/weblog/2013/sep/15/security/ This is because PBKDF2 "...
1
vote
5answers
409 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
1
vote
1answer
182 views

What does this Bruce Schneier fact mean?

I came across a website called Bruce Schneier Facts, a parody along the lines of Chuck Norris facts, and saw the following fact: Schneier knows if Reiser did it. What does it mean?
0
votes
3answers
245 views

Encrypt Different Users with unique keys

I have a database that I want to implement an encryption per x amount of users. Say I have 1000 Users in the database and I wanted every 1000 encrypted differently then I would generate a new key and ...
2
votes
3answers
437 views

Use RSA key to encrypt/decrypt personal document

Suppose I have generated a public/private RSA4096 keypair using GPG. Is it secure to use this keypair to encrypt/decrypt documents solely for personal use, i.e., have an encrypted backup of some very ...
0
votes
3answers
124 views

Can the username be used in HMAC during client-side hashing?

I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong. My goal is to have the client side hash passwords before sending them to server side ...
0
votes
1answer
561 views

Why rijndael.key value is different with rijndael.iv?

someone can tell me how rijndael works? for now i need to handle key and iv generated from C# (using rijndael + rfc2898derivebytes) to match with CryptoJS code snippet of C#: byte[] saltArray = ...
0
votes
0answers
39 views

I found this easter egg, any ideas what kind of encryption it is? [duplicate]

I am looking to have the cryptography identified of this encrypted message aHR0cHM6Ly9nb28uZ2wvZXY5SDN1 Any ideas what crypto was used here? Thank you
0
votes
2answers
119 views

Can JavaScript from different origins communicate securely

I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way. The use case is to have a JS Agent from the users' home origin use the ...
0
votes
1answer
105 views

How to encrypt user data in app using Google Sign-In

I am currently writing an application which needs to store user data encrypted in the database. One of the requirements is that some of the data stored in the database needs to be encrypted in a way ...
2
votes
1answer
153 views

SSH Public Key / Host Key - Can Client Request Key Length?

In SSH, does the client have any power in determining the key size of the host key, or is it completely dependent on what the servers host key is? For instance, say the client and server agree on ...
8
votes
2answers
3k views

How to encrypt using a private key file generated by OpenSSL?

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
3
votes
2answers
3k views

Convert ECDSA keys (PEM, OpenSSH)

To work with ECDSA keys I am using the python-ecdsa library. Unfortunately this library can not process keyfiles properly if they are provided in the OpenSSH format. Instead I generate them in the PEM ...
2
votes
1answer
143 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
2
votes
1answer
364 views

RSA key size in TLS ciphersuite with RSA key exchange

I'm using the TLS cipher suite TLS_RSA_WITH_AES_256_CBC_SHA56. The Public Key of the Server's Certificate is RSA (2048 Bits) I understand that the RSA algorithm is used here for for key exchange, as ...
2
votes
1answer
180 views

How were Cryptographic nonces used in the Yahoo! data breach?

How does an attacker use Cryptographic nonces to generate access cookies through a script on a server? As what happened to Yahoo! servers.
-1
votes
2answers
97 views

technical difference between TLS and a certificate [duplicate]

I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
2
votes
2answers
1k views

ECDHE_RSA_WITH_AES_128_GCM_SHA256 - How to determine ECDHE Key Length?

Server: SSL Certificate, 2048-bit RSA Public Key, Signature Algorithm is sha256RSA What am I missing here? ! I've scoured the RFC's, and I have yet to find anything on how to determine the ECDHE key ...
0
votes
1answer
81 views

Updating Sender-Keys and Key-Management

This question is related to an earlier question I had: Encryption on Mobile Devices - Multiparty Encryption - Key Management My situation: I have many mobile devices that want to send sensitive ...
1
vote
1answer
103 views

Digital Footprint Law

Can anyone help me with the name of the digital footprint law? All I know is that it is named after its discoverer much like Moore's Law is. This is a computer science law that states for the purposes ...
2
votes
1answer
83 views

Is getting 1-2 outputs from a CSPRNG to seed another CSPRNG less entropy than getting say 5000 outputs from a CSPRNG and using that to seed?

This question builds off of this question. I want to create more entropy from a viable entropy source to seed another CSPRNG. If I use window.crypto.getRandomValues(newUint8Array(1)) To seed a ...
-1
votes
1answer
180 views

Openssl CLI AES-XTS and AES-CCM support

Is there anyone out there who have tested AES-CCM and AES-XTS using openssl CLI. ? Whether openssl supports AES-XTS? I was having a backup plan of creating custom API if CLI does not supports XTS and ...
2
votes
1answer
128 views

Encryption on Mobile Devices - Multiparty Encryption - Key Management

I have the following setting: Let A, A', A'' be different mobile devices. They want to sent a secret message M to all (or some of) the C,C', C''. The message is passed on to B that stores it for some ...
0
votes
1answer
139 views

How to obtain body from RSA signed document without verifying signature?

According to my understanding of computational cryptology, the body of a signed document can be retrieved disregarding whether or not the signature is authentic. However, I cannot apply this ...
10
votes
2answers
2k views

How are Mozilla Firefox passwords encrypted?

As far as I know, current versions of Mozilla Firefox store the saved passwords (encrypted with 3DES) to the logins.json file meanwhile the keys are stored in key4.db (or key3.db in older versions). ...
1
vote
2answers
158 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
1
vote
3answers
493 views

What is the advantage of using a digital signature over simple asymmetric encryption?

If you're sending me a message, you can: a) Encrypt the message using your private key, and I can decrypt is using your public key. b) You can create a digital signature of your message, and then ...
1
vote
1answer
103 views

Exchange sensitive information through public chat

Is there a way to exchange phone numbers/email addresses through public chats with a person without giving them or other communication information away to all the other people in the public chat? ...
0
votes
0answers
34 views

Help me to identify what type of string it is? [duplicate]

70373f65f945e5184dcb42793cbe2cddb34248ef172b7ddb5e27467fd8d76314ea8bdeb19226687ac0ca01e646dbe8fdb4dfb2d6816f54b9b500639ac6c3bf056fbd4c45a246bbe66e6fd0ce3730801716b12fff942207933e1bb6386806d476ade6f5b1 ...
1
vote
1answer
95 views

Would Hashing a Decryption Key Significantly Lower Security? [duplicate]

I'm using the Haskell Codec.Crypto.SimpleAES package to create a crude password manager. The password manager seems secure but it's unable to warn the user when the decryption key is invalid. If a ...
2
votes
3answers
470 views

In PGP how can I be sure about the public key?

I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
2
votes
2answers
203 views

How to protect data integrity in IoT network? [closed]

The security of IoT devices is very important to protect the data uploaded by IoT devices. Because if an attacker force an IoT device to upload misleading/false data, the analytics and insights ...
0
votes
0answers
172 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
0
votes
1answer
198 views

Find seed used in Math.random LCG given a list of outputs [duplicate]

Given one or two sequential Math.random outputs generated with Internet Explorer's linear congruential generator, is it possible to find the seed used in the LCG and find subsequent outputs? Here is ...
0
votes
2answers
226 views

How do you use a public key to encrypt a string

I am oversimplifying but I understand that a public key is the product of two large prime numbers. In essence as long as the private key is kept private, the owner knows something that the outside ...
0
votes
1answer
134 views

How to identify the right hash from a list of salts and pre-given password during authentication?

I apologize for being naive, but I only recently started learning about cryptography and how to go about the security online. From what I've gathered, the safest-without-sacrificing-efficiency way ...
0
votes
3answers
125 views

Is it possible to build a partial search mechanism on hashed values? [closed]

I am hashing some sensitive values to support search mechanism as decrypting the values at run-time would be time consuming. I'm using SHA-512 with salt. For now, things look good. I have the hashes ...
2
votes
3answers
276 views

Should I upgrade old volumes to new cryptsetup encryption mode?

The old cryptsetup default is aes-cbc-essiv:sha256. The new one is aes-xts-plain64:sha256. I don't know that much about cryptography but I assume the standard was changed for a reason. Also there can ...
-2
votes
1answer
186 views

What is ECC / HECC, how does it differ from asymmetric encryption?

I'm relatively new to cryptography, and I would like to know what Elliptic Curve Cryptography and Hyper Ellipic Curve Cryptography (HECC) are, and where they are intended to be used. I have read ...

1 2 3
4
5
45