Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
6
votes
2answers
796 views

How can I authenticate a client connection in a secure way?

Let's say I have a server listening on port 1234. I have some client software that needs to be able to connect to this port. But I want to prevent malicious users from bypassing the client software ...
13
votes
1answer
566 views

What are the problems with encrypted but unsigned data?

In another question's answer, D.W. wrote: Make sure there is authenticity protection for the encrypted data (e.g., encrypt and then sign/MAC): you will need both confidentiality and authenticity ...
8
votes
2answers
3k views

3DES vs DES for VPN connections

I'm trying to get Android 2.1 phones to connect to our corporate VPN, but it would appear they only support DES rather than 3DES for encryption. Is it safe to use DES, am I going to get hacked if I ...
8
votes
3answers
10k views

What common products use Public-key cryptography?

I want know what common use products are there that use public key/private key cryptography?
22
votes
5answers
5k views

PCI Encryption Key Management

(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously). I currently ...
8
votes
4answers
3k views

Copyright issues with encryption algorithms

I'm developing application for Android/Java. Application is a kind of password manager, so I'm storing encrypted passwords under the hood of master password. There are number of encryption algorithms ...
9
votes
4answers
1k views

What good, standard digital signature / timestamp verification clients are widely or easily deployed?

I'm looking for a good way to publish data along with a digital signature (and ideally a timestamp) which is as easy as possible to verify via software run locally on public data. For example, ...
6
votes
7answers
1k views

What are the weaknesses of this password-generation-method? How can it be improved?

I recently came up with the problem, that I have much more accounts, than I'm able to remember passwords. I don't want to use a password-safe, because I cannot access it on another computer, I lose ...
7
votes
3answers
2k views

What are the pros and cons of outsourcing an organization's PKI?

I am looking for the pros and cons of outsourcing an organization's Public Key Infrastructure (PKI). I understand that the answer to whether or not to actually outsource is going to depend on the ...
8
votes
1answer
2k views

What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0?

I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009. The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is ...
36
votes
6answers
29k views

Where to get an SSL certificate for personal website?

I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
15
votes
5answers
832 views

What is the potential impact of the alleged OpenBSD IPSEC attack?

Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have. For instance, does ...
18
votes
2answers
4k views

GnuPG/OpenPGP Key Practices

I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to ...
10
votes
5answers
2k views

When brute-forcing DES, does knowing something about the plaintext help?

Data Encryption Standard (Wikipedia) I know that with brute force there are 2^56 possible keys to check (56 bits, each either a 1 or 0). But let's say I know the message itself is only made up of ...
30
votes
3answers
16k views

Forced into using a static IV (AES)

We've had to extend our website to communicate user credentials to a suppliers website (in the query string) using AES with a 256-bit key, however they are using a static IV when decrypting the ...
12
votes
4answers
2k views

MS-SQL Password Storage

What would be your recommendation for replacement of an MD5 hash approach to password storage within an MS-SQL database be?
91
votes
6answers
30k views

Are GUIDs safe for one-time tokens?

I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification. Presumably they are appealing because they are easy to generate, unique, non-...
21
votes
2answers
4k views

How secure is Keychain on OS X?

Keychain is a built-in app on OS X that stores all of the user credentials, and allows for one to keep encrypted notes in an easily accessible way. Does anyone know how secure Keychain is? I know ...
10
votes
6answers
496 views

Should we configure all devices to never request SSL 2.0, and reject it if offered?

In an effort to reduce man in the middle attacks, when will it be (or was it) an industry accepted practice to reject SSL 2.0 connections on the client and server side? Is configuring this on a proxy ...
28
votes
2answers
53k views

What are the differences between the versions of TLS?

Please correct me if I'm wrong, but my understanding is that SSLv3 and TLSv1 is just a rename of the earlier protocol... but TLSv1 adds the ability to have secured and unsecured traffic on the same ...
0
votes
1answer
2k views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
6
votes
2answers
946 views

How effective is the Mac Open Firmware password protection?

I have used Mac's Open Firmware password protection before and I've always wondered how effective it actually is at protecting my stuff. [assuming a good password] Would does the firmware password ...
16
votes
5answers
5k views

The AES Crypt implementation hashes a password 8192 times to generate the key. Is this necessary?

I'm considering encrypting some small files (hundreds of kb apiece) using the AES Crypt reference implementation. Looking at the source, it seems that the encryption key is derived from the IV and the ...
205
votes
9answers
117k views

How should I distribute my public key?

I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
156
votes
3answers
77k views

What are rainbow tables and how are they used?

Where can I find one? Is there a pot of gold at the end? How do I protect against them? From the Area51 proposal This question was IT Security Question of the Week. Read the Sep 09, 2011 blog ...
69
votes
5answers
120k views

Advantages and disadvantages of Stream versus Block Ciphers

Encryption algorithms such as Blowfish,AES,RC4,DES and Seal are implemented in one of two categories of ciphers. What are the advantages/disadvantages to the type of ciphers?
24
votes
4answers
4k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
20
votes
4answers
10k views

What is the benefit with using encrypted RAM?

I sometimes hear that encryption is used for the RAM, but I don't really understand why this is needed. Why is RAM needed to be encrypted? And is this done by the hardware, the operating system or ...
11
votes
3answers
2k views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the key/password/...
883
votes
13answers
273k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
12
votes
4answers
3k views

What kinds of SSL certificates are usable for encryption?

I know that Verizon SSL certificates cost close to $600. There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
29
votes
8answers
18k views

Do secure phone lines exist?

I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure . I know that Skype and other VOIP service providers have to ...
51
votes
9answers
53k views

Feeding /dev/random entropy pool?

Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
25
votes
9answers
18k views

What cryptographic algorithms are not considered secure? [closed]

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
635
votes
5answers
284k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
22
votes
6answers
6k views

Does prepending a salt to the password instead of inserting it in the middle decrease security?

I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...

1
41 42 43 44
45