We have written a Ruby on Rails application that allows a visitor to fill out a form with personal information (name, address & other confidential details), which is stored in a database until the information can be collected by a batch process running inside institution's firewall. To prevent attackers from getting this confidential in...
In the code below, from the Crypto++ wiki, is 128 the number I really should be using? CryptoPP::AutoSeededRandomPool arngA; CryptoPP::RandomNumberGenerator& rngA = *dynamic_cast<CryptoPP::RandomNumberGenerator *>(&arngA); CryptoPP::DH dhA(rngA, 128); CryptoPP::Integer iPrime = dhA.GetGroupParameters().GetModulus(); CryptoPP::Integer i...
Asp.net stores the session in a cookie, thus not having to worry about sessions on the server side (traditionally sessions are stored in a database, and lookups are done via a session ID, which is usually a Guid like string). In my previous question, I was asking about how a spring application stores/creates sessions etc: http://stackov...
Hello, I am developing an application that uses Java's Crytographic Extension, more specifically MSCAPI, to sign a file using a user's private key all from a web browser. I have been able to do this succesfully locally, but when i embed the class in a web page and try to access users keystore i get the following error: "no such provider...
Edit/clarification: I mean password generation as in "deterministically generate passwords for your own use (e.g. to sign up for web services), based on some secret and on some site-specific data" I take the MD5 digest of the concatenation of my master password and a (non-secret) site-specific string. Then I take the first 16 digits of ...
I have a database that will be hosted by a third party. I need to encrypt strings in certain columns, but I do not want to loose the ability to query over the encrypted columns. I have limited control over the SQL instance (I have control over the database I own, but not to any administrative functions.) I realize that I can use a .ne...
Erlang has a crypto function which generates public private keys (documentation copied below). However the documentation seems vague and I can't find any example code that describes how to generate the shared prime number or the generator. Can someone post an example that generates a public/private key pair? Thanks in advance for any ...
I am writing a game server plugin, and writing a web interface to control it. I am considering detouring the GetPacket() function in the game server, and sending custom packets from my web panel and using GetPacket() to interpret them. My only concern is security as obviously I don't want to just send open data out. What can I read up on...
I'm looking for a cryptographic algorithm that satisfies the following rules: E(key1, E(key2, Message)) = E(key2, E(key1, Message)) And obviously the same for decryption as well. This is probably a long shot as I doubt such an algorithm exists but thought it's worth asking. Thanks ...
Is there any way to programmatically edit the purposes enabled for a give x.509 certificate? This functionality is available via the certificates mmc snap-in (hyperlink below) but I need to perform the action through code. preferably C#. modify the properties of a certificate ...
During an SSL/TLS handshake, the client sends up a list of supported cipher suites and the server selects which one to use for the conversation. Windows has a prioritized list of cipher suites (configurable via the registry) and will select the first suite in that list that is supported by the client. Once a list of acceptable ciphers ...
I know other questions have been asked on this but none so far have provided a solution or are exactly the issue I have. The class below handles the encryption and decryption of strings, the key and vector passed in are ALWAYS the same. The strings being encrypted and decrypted are always numbers, most work but the occasional one fails...
I was wondering if I could reasons or links to resources explaining why SHA512 is a superior hashing algorithm to MD5. ...
Specifically what i'm trying to do is Generate a PassStub field for a Remote Assistance ticket. The problem is that my results look like binary data but somehow Microsoft generates printable characters. In [MS-RAI]: Remote Assistance Initiation Protocol Specification <16> Section 6: Microsoft says that the "PassStub" field "is encrypted...
everything i have tried has given me wrong output values. i even copied C codes and changed them so that they would work in python and i still get wrong outputs. what is wrong? import os, math def makehex(value,size=8): value = hex(value)[2:] if value[-1] == 'L': value = value[0:-1] while len(value)<size: va...
assuming that everything else (functions, constants, etc) are correct, is this a correct main loop of ripemd160? for j in range(80): T = (a+ ROL( (F(b, c, d, j) + X[r[j]] + k[j/16])%2**32,s[j])+e)%2**32 a = e; e = d; d = ROL(c, 10); c = b; a = T # parallel round T = (aa+ ROL( (F(bb,cc,dd,79-j) + X[rr[j]] + kk[j/16] )%2**32...
I'm looking for a key exchange solution between a .NET app and an embedded device. The two endpoints have a shared secret key, making the Elliptic Curve Diffie-Hellman (ECDH) algorithm excellent for securely exchanging a master secret for the session. There is a good C++ library, crypto++, which implements ECDH and is suitable for the e...
Hello, I'm working on a project in GWT, however, I need to store the uploaded files on my personal web server. The user will upload the files using GWT, my back end will store the files information in AppEngine's database and send the file to the server. I'm thinking of creating a PHP script on the web server that will handle the file...
When using AES (or probably most any cipher), it is bad practice to reuse an initialization vector (IV) for a given key. For example, suppose I encrypt a chunk of data with a given IV using cipher block chaining (CBC) mode. For the next chunk of data, the IV should be changed (e.g., the nonce might be incremented or something). I'm won...
Title is self explaining. ...