Collaborate Disseminate
An encrypted message in a series of letters and numbers of 98 characters long, the encryption key is 23 characters long of letters, numbers and symbol (.)
In case we want to decrypt the message but the encryption algorithm is unknown, can … Continue reading Can you tell encryption algorithm from key? [migrated]
Microsoft published the Guidance for Azure Active Directory (AD) keyCredential property Information Disclosure in Application and Service Principal APIs which describes how to check if an Azure AD is possibly affected by the private key di… Continue reading How dangerous is a leaked private key from outside the infrastructure in context of: "Azure Active Directory keyCredential property Disclosure?"
Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to measure temperature, or measure time in na… Continue reading Acquiring true randomness for generating a key
I use python pycryptodome rto generate my private and public key. This is one example of a public key that I am generating:
(n=0xf56efd1888065abb3ef6e6b1e6e0039ff1fa0b09e1f1ab9869ad933e1f48527c182957f9a767110524c362ac4c460f752d2011ef827ed9… Continue reading Is my RSA key correctly generated [migrated]
I need to gather some sensitive information on a public channel where people don’t trust each other, and my plan is to use asymmetric encryption: I generate a key pair, post the public key to the channel, other members encrypt their inform… Continue reading Offline alternatives for "PGP Encryption Freeware"?
In cryptography, generally we have two ways of handling sensitive information.
We can use one-way encryption such as hashing. This is useful when we never need to retrieve it again. In this case, we can know if we found the right password,… Continue reading Encryption Algorithm With Separate One-Way (Hashing) And Two-Way (Decryption) Keys
I’m trying to create application-layer encryption for user data in my database, using password derivation function. But there is a problem, that there must be an admin user, who can access all user’s encryption keys, for password reset functionality and some other things. I don’t like the fact that all encryption system security can be broken with just one admin password. I’ve asked for an advice here How can I improve the application administrator’s encryption keys security inside database
I was advised to compile an admin encryption key not from a password but from another source (admin computer system information, for example), so it can’t be brute-forced, and then pass it to the database server.
It is a good approach, however, this complicates admin mobility and system recovery in an event of key loss, and these requirements are mandatory to accomplish.
So, I come up with this idea:
At first glance, I don’t see any great flaws with this approach, but I couldn’t find that someone has done anything similar before, so I want to ask you to help me to validate my vision.
I am doing a CTF challenge and I am at the last step. I used a login to get "your encrypted key is" blahblahblah. What do I do with this encrypted key to get the flag?
The password in VeraCrypt is used to en-/decrypt a header, that contains a master key, that is used to en-/decrypt the data.
I know, that I can change the password, which will not change the master key and thus be quite fast. But if I have… Continue reading VeraCrypt: Is it possible to change the master key?
I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients.
The scripts will be run on the endpoints several times a day via a cronjob.
The risk of… Continue reading Security requirements for public API keys