We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
3
votes
1answer
80 views

How much less secure is a password with a repetitive pattern of characters?

I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient. So my idea is to just use a short password and repeat it a few times like this: ...
2
votes
1answer
278 views

One GPG key with multiple user identities for my career?

I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs. My understanding is that there are two ways this could be done: Have one main/master GPG ...
2
votes
2answers
185 views

Use combination of digital certificates and symmetric key cryptography

Assuming that: - A have CertA and secret key KsA - B have CertB and secret key KsB A need to transfer data M to B with the requirement of confidentiality and authenticity, BUT Data encryption must ...
1
vote
1answer
381 views

What is a collision attack in simple terms? [closed]

I'm not a security expert but I've got interested in Cryptography and I'm reading about it. I was trying to find out which is the best between SHA256, Bcrypt and MD5 when it comes to hashing ...
4
votes
4answers
511 views

Can I use a user's password hash as the AES key to make a one time token?

I want to make a one time token that users use to reset their password. The token should be invalidated once it is used, is it safe to use their currently hashed password as the aes key to encrypt the ...
2
votes
1answer
78 views

Which high speed / high security ECC curves are preferred on mobile devices?

I'm looking for the most common denominator of ECC curves in consumer devices. This article describes how a particular ECC curve is ideal for Intel based motherboards. Since I'll be targeting mobile ...
0
votes
2answers
139 views

Deploy verifiable webapp source code

Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
1
vote
1answer
129 views

Authenticate that I am the poster of a certain anonymous message

I'm a programmer, and I've made a nifty script that scours a certain internal forum site. Messages posted on the forum are all anonymous, so I'm wondering how exactly I can get my script to realize ...
1
vote
0answers
52 views

Identifying and understanding a cryptographic voting protocol

I am reading about a voting protocol using public key encryption. According to the notes, if A votes va, then A broadcasts Ra(Rb(Rc(Ea(Eb(Ec(va)))))). Here, Ra is a random encoding function which ...
8
votes
4answers
234 views

How much security expertise does a general application programmer need to develop software ethically? [closed]

I am curious about this. I saw this thread: Why shouldn't we roll our own? and this answer: https://security.stackexchange.com/a/18198/144241 which had on it this comment, which had the second ...
2
votes
4answers
230 views

Are multiple encrypted containers with the same passphase containing the same files a cryptographic risk?

Situation as follows: Let's assume two (or more) containers, encrypted using the same passphrase. They will contain the same files. So their content is identical. However, the containers themselves ...
6
votes
4answers
372 views

Are there any practical attacks on random number generators?

I'm creating an internal security course for developers. To make it more interesting, I'm trying to reinforce each chapter with some real-world attacks but stumbled upon insecure random usage section. ...
1
vote
2answers
2k views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
24
votes
4answers
6k views

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as ...
2
votes
1answer
67 views

How to use login details to make a key for AES encryption and decryption

I have recently starting looking into AES encryption for a side project. I am researching this till now so if there is something wrong about my concept please correct it. According to me If i want to ...
0
votes
1answer
475 views

Decrypt AES 128 CTR with the IVs (counter) but not the key

I have the encrypted files, the random IV for each encrypted files and the counter increment function but I miss the key. Is there anyway for me to decrypt the files?
2
votes
1answer
75 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
0
votes
1answer
69 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
1
vote
2answers
656 views

Brute-force attack to exe file [closed]

I have an encrypted file and the program.exe through which it was encrypted. When I want decrypt file, I need to know the password with which the file was encrypted. Can you help me some tool for ...
3
votes
1answer
317 views

Difference in between salt and random padding in cryptography

I would like to know what is difference in between using salt and using "random padding" in cryptography. I am familiar with term salt when we use it with hashing. How does "random padding" differ ...
0
votes
1answer
90 views

Recognise tool by which file was encrypted [duplicate]

I have file with extension *.encrypted. Can you give me some advice how to recognise by witch tool was this file encrypted? It´s not encrypted by some ransomware but by some encrypt tool. When I open ...
2
votes
1answer
102 views

How does algorithms ensure public/private keys uniqueness? - RSA

I'm new to security and crpyto, I know that Public/Private keys are generated in a different way depending on the used algorithm, But let's take RSA as an instance (Using prime numbers), Does the ...
25
votes
6answers
9k views

What would be the key size for a picture used as a key?

I'm working on a cryptosystem that uses colour pictures as keys for encryption. I'm trying to guess what is the key size of my cryptosystem in order to find the feasibility of a brute force attack. My ...
4
votes
2answers
169 views

How are ciphers related to cryptographic algorithms like DES or AES?

It looks like I am having a terminology issue here. In cryptography, we have stream ciphers and block ciphers. I understand their difference. We also have cryptographic algorithms like AES (Rijndael). ...
2
votes
0answers
395 views

Testing a padding oracle vulnerability with PadBuster

I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability + OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
1
vote
0answers
301 views

Automatic fetch Luks keyfile over ssh and decrypt partition [closed]

I run a small computer with an encrypted data partition. So that I have as little effort as possible to decrypt the hard disk after a reboot (no extra ssh login, password input etc.), I thought about ...
1
vote
2answers
262 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
3
votes
3answers
165 views

Is it possible to use “cryptographic hash function” for “digital signature”?

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input. However, is it possible to use a cryptographic hash function for ...
0
votes
1answer
2k views

OpenSSL: what's the difference between -kfile and -pass?

It seems both -kfile and -pass can be used to encrypt files with a 2048 bit keyfile? I don't understand the difference between the two methods: $ openssl enc -salt -aes-256-cbc -in inputfile.txt -...
0
votes
1answer
91 views

Secure Routing without relying on Cryptography? [closed]

Is anyone aware of a routing protocols for Ad Hoc Networks (such as OLSR, AODV, ZRP) which are secure without relying on pre-established key management? What I mean by secure is, preventing data ...
-5
votes
3answers
305 views

Why don't we encrypt punctuation?

I am reading about encryption, and I'm curious why in all of the examples and texts, we do not encrypt the punctuation marks. Plain text: hello world! my name is alice and i'm writing a super secret ...
1
vote
2answers
119 views

How to overcome slow process of creating and verifying digital signature?

From what I understood is the digital signature is a long process and have following steps: Hashing the Message Plain Text using a well-known (public) hashing algorithm. Encrypting it with sender's (...
4
votes
1answer
140 views

What fundamental problems are solved by using a Key Encrypting Key (KEK)?

I've read several questions regarding KEKs but have not quite found one that comprehensively addresses why we would choose to use a KEK. This excellent answer by Mike Ounsworth explains how KEKs allow ...
5
votes
2answers
4k views

Why is SHA-256 not good for passwords? [duplicate]

I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
5
votes
0answers
367 views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
2
votes
2answers
370 views

When you XOR a random number with non-random number, does that give you a new random number?

XOR has the following truth table: 0, 0 : 0 0, 1 : 1 1, 0 : 1 1, 1 : 0 So per bit in an XOR operation, there is a 50% chance of that result being 1 and 50% chance of it being 0. If you XOR a random ...
0
votes
3answers
431 views

Encryption of TCP communication?

I am using an exe application which is communicating with a Raspberry Pi device with manually configured TCP ports. The application will send data from port 1234 to the Raspberry Pi which is listening ...
2
votes
2answers
93 views

Should you use SecureRandom.getInstance() with or without a provider?

So, I am new to cryptography and I was learning about SecureRandom and all of the ways it calls implementations with or without providers. When I looked up some sites for information, it says not to ...
1
vote
2answers
271 views

AES-256 decryption after key destruction. Possible or not?

Can AES-256 be decrypted if after the encryption process you destroy the key that must be used to decrypt the data, is it possible?
0
votes
2answers
40 views

What is the correct terminology for enforcing access control by means of cryptography, or on a privileged list?

I have a server that enforces access control by means of cryptography, by not giving up data, or by a combination thereof. By the former (cryptography), I mean: If a user requests some data, the ...
0
votes
2answers
540 views

/dev/random generate session key

if a server uses /dev/random to generate the random session key with a client. How you can launch a Denial-Of-Service (DOS) attack on such a server?
1
vote
0answers
310 views

How long until quantum computers are able to decrypt RSA using Shor's algorithm? [closed]

Based on this question: How many qubits are needed to factor 2048-bit RSA keys on a quantum computer? It's going to take 20-30 years for quantum computers to reach that state but some people are ...
0
votes
1answer
38 views

Problem identifying this encoding schematic into plain text [duplicate]

Im really new to all of this i'd like some insight. the encoding scheme looks like this e0b7 e51f a24f 2ee8 f950 ecc4 d46b 6b3b 11bd 1930 ccb0 3c9f ecf5 368d f570 c72d a37e 47a6 bf03 2cf4 947c e913 ...
3
votes
1answer
43 views

ISAAC pseudorandom stream - why is this considered strong crypto?

I was looking for a good pseudorandom stream generator to supplement or replace RC4-drop-lots, in a noncrypto application. Since I'm mixing it with output from /dev/random, I decided not to use ChaCha ...
0
votes
2answers
247 views

Does HTTPS protect against active attackers?

I know that HTTPS protects against passive attackers, due to encryption. Which of course provides confidentiality. So does it protect data(passwords, emails, etc) during traffic, against active ...
2
votes
0answers
418 views

How do I disable TLS Session Tickets in Chrome?

According to ssllabs SSL Session tickets are enabled by default. These are the weakest link in TLS, how do I disable them? I'm using the latest stable.
0
votes
2answers
56 views

Strength of key pair

I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks. I appreciate that a user-...
1
vote
2answers
66 views

Confusion about the software and also the digital signature getting modified

I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
7
votes
2answers
1k views

What could an attacker do if they gained access to PBKDF2 hashes?

This is regarding a web application where a user has to login with their personal email as the ID, and a password they have chosen personally. If an attacker somehow gained access to a credential ...
8
votes
3answers
2k views

Plausibility of DNA sequence for encryption

To start with: This is in consideration of in-body implants. The answer should (initially) assume there is no record of your DNA sequence mapped by a third party yet. The question boils down to ...