Questions tagged [cryptography]
Cryptography provides security mechanisms that are based on algorithmic methods and not on policy enforcement. For questions on cryptographic mechanisms and their application the Cryptography SE resp. the Information Security SE are most likely more appropriate. Don't use this tag if your question is about software that uses cryptographic mechanisms but not about cryptography itself.
81
questions
0
votes
0
answers
33
views
Ho to create an unsigned CSR in Linux command line?
I am trying to follow this procedure in Wikipedia on how to generate a Certificate Signing Request:
Before creating a CSR for an X.509 certificate, the applicant first generates a key pair, keeping ...
- 137
0
votes
1
answer
154
views
Openssl output to stdout
I want to extract signer from smime inside node app (child_process.spawn()), semantic :
myapp | openssl smime -verify -CAfile c_root.pem -inform DER -signer /proc/self/fd/1 | myapp
But i cant ...
- 865
0
votes
0
answers
45
views
Is it possible to improve the speed of calculating cryptographic commands like sha256 in U-Boot?
I tried counting sha256 from the same memory area in U-Boot and on Linux on the same development board (sama5d27-som-ek). The time taken to perform the same operation in U-Boot is almost double. I ...
- 1
1
vote
0
answers
94
views
Fast wideblock AES disk encryption in Linux?
I recently learned that Linux supports Adiantum as a disk encryption cipher (run cryptsetup benchmark -c xchacha20,aes-adiantum-plain64 to try it out on your system). While Adiantum is primarily meant ...
- 1,019
2
votes
1
answer
879
views
openssl encrypt by specifying AES 256 key instead of passphrase
I need to encrypt some data using aes-256-ecb since a backend code expects it as a configuration. I'm able to encrypt using a key which is derived from a passphrase using:
openssl enc -p -aes-256-ecb -...
- 123
3
votes
0
answers
862
views
Debian FIPS Certified
Is Debian OS FIPS certified? Does it support FIPS Validated Cryptographic Modules?
What I noticed is that FIPS mode can be enabled with the tool fips-mode-setup. This tool is developed and can be used ...
- 31
4
votes
1
answer
3k
views
Verifying a hashed salted password that uses yescrypt algorithm
In order to verify a password hash we can use openssl passwd as shown below and explained here
openssl passwd $HASHING-ALGORITHM -salt j9T$F31F/jItUvvjOv6IBFNea/ $CLEAR-TEXT-PASSWORD
However, this ...
- 165
1
vote
2
answers
8k
views
What is the fingerprint ssh is asking for?
$ ssh 192.168.29.126
The authenticity of host '192.168.29.126 (192.168.29.126)' can't be established.
ECDSA key fingerprint is SHA256:1RG/OFcYAVv57kcP784oaoeHcwjvHDAgtTFBckveoHE.
Are you sure you want ...
- 29
0
votes
1
answer
188
views
Won't the new nonblocking architecture for /dev/random make it less secure?
If entropy is not accounted for, and the pool doesn't block even if insufficient entropy has been supplied, isn't it potentially insecure?
- 111
21
votes
3
answers
4k
views
How can I force /dev/random to block?
For a class on cryptography, I am trying to drain the entropy pool in Linux (e.g. make /proc/sys/kernel/random/entropy_avail go to 0 and block a command reading from /dev/random) but I can't make it ...
- 213
2
votes
1
answer
373
views
Unable to connect to the my campus db through omega, the below error keeps popping up
Unable to negotiate with 129.107.56.23 port 22: no matching key exchange method found.
Their offer: Diffie-hellman-group-exchange-sha1,Diffie-hellman-group14-sha1,Diffie-hellman-group1-sha1
- 21
0
votes
0
answers
590
views
xdg-open gives error : FIPS violation detected at crypto/evp/digest.c:219, reason: SHA-1 hash algorithm is not allowed in FIPS mode
As seen from var/log/messages when i xdg open is triggered from the browser:
Aug 14 11:01:43 centos org.gnome.Shell.desktop[1833986]: FIPS violation detected at crypto/evp/digest.c:219, reason: SHA-1 ...
- 7,825
0
votes
1
answer
72
views
are crypto algorithms other than RSA valid for debian package signing?
Allmost all documentation I've found about debian package signing omit the topic of crypto algorithms entirely, and the few I've seen touching the topic mention only RSA, and in one case, DSA.
gpg ...
- 134
1
vote
1
answer
79
views
GnuPG support for ISA crypto extensions
For performing some results comparison, I was searching online for usages of 'gpg' command with hardware crypto extensions enabled/disabled (eg. AES-NI and ARM NEON), but found none. Instead I find a ...
- 11
1
vote
1
answer
813
views
Slow /dev/zero format using dd with nvme to prepare crypto, is there nvme specific tool?
I try to prepare an nvme for encryption, so i first follow this post on SO.
But the speed of dd is really really slow (less than 100 mb/s). I see there is new option to speed up dm-crypt on kernel 5.9 ...
- 163
3
votes
3
answers
5k
views
How to show the incorrect checksum when the computed checksum did not match
Suppose I try to verify the checksum of a file using:
echo '760382d5e8cdc5d0d079e8f754bce1136fbe1473be24bb885669b0e38fc56aa3 emacs-26.1.tar.gz' | \
sha256sum --check
If the file is corrupt and the ...
- 2,546
0
votes
1
answer
286
views
MACSEC frames not valid
I'm using wpa_supplicant to set up a MACSEC secure wired channel. On an Ubuntu x86 system, this works. But on an Arm64 Alpine system, the MKA appears to succeed and the interface is set up, but no ...
- 464
1
vote
0
answers
108
views
Error running outguess on Linux terminal in windows
So far I was able to get outguess installed on my Ubuntu distribution running under WSL by running
sudo apt-get update
and then
sudo apt-install -y outguess
Both commands worked fine. After, I tried ...
- 11
4
votes
4
answers
15k
views
How to do HmacSHA256 using openSSL from terminal?
I need to perform the following Java snippet using OpenSSL from the command line:
private byte[] hmacSha256(byte[] key, byte[] payload) throws GeneralSecurityException {
Mac mac = Mac....
- 171
0
votes
2
answers
113
views
How to verify a public(facebook's) key ? and then sign and trust them
Recently I enabled gpp emails option in facebook. Then they sent me a test mail to check whether I'm able to decrypt that or not.
So first I downloaded there public key from Here and imported in my ...
- 131
2
votes
1
answer
6k
views
Cannot decrypt files on a Mac using openssl
This is the command I used to encrypt the files on my Mac around 2017. I don't know if my Mac was running High Sierra at the time or not, because I am usually late to the party when it comes to ...
- 21
0
votes
2
answers
265
views
Implementing a token solution on a usb key
I would like to implement a token solution for USB devices.
So I need to encrypt a token with a private key and use the public key to decrypt it. So far so good. The problem comes from the fact that I ...
- 31
0
votes
1
answer
2k
views
OpenSSH: Cannot disable weak algorithms
I am on an RHEL 7.5 and I would like to disable weak crypto algorithms (i.e. CBC-based ciphers, weak MACs, etc.).
Hence, I modified /etc/ssh/sshd_config, especially the lines starting with ciphers and ...
- 135
0
votes
2
answers
1k
views
Unable to install cryptography
Lubuntu version: 20.04
I am trying to ssh to a cluster using fab but it returns an error.
I am adding a screenshot showing the traceback .
I am not able to install cryptography through terminal ...
1
vote
0
answers
44
views
Initialization Vector reuse in ext4 filename encryption
The fscrypt document says:
Because of the requirements to retain support for efficient directory lookups and filenames of up to 255 bytes, the same IV is used for every filename in a directory.
...
- 4,174
1
vote
2
answers
1k
views
How can I disallow certain ciphers for OpenSSH in Fedora, using crypto policies?
I would like to disallow certain ciphers for OpenSSH in Fedora.
I've read that Fedora overrides settings in sshd_config with its crypto policies.
I'd like to edit those.
My first idea would be to ...
- 327
0
votes
1
answer
21
views
Opening a FiST Cryptfs dir from 2002
I have a dir from 2002 encrypted with CryptFS which uses FiST.
In theory I can probably install a virtual machine running a GNU/Linux distribution from 2002, compile FiST and CryptFS - if I can find ...
- 33.7k
0
votes
0
answers
810
views
Is there any way to get algorithm of any Encrypted String?
File command shows that the file is of any type of ELF, Text, Ascii, source code. Is any there any command or tool to identify the possible encryption algorithm for a given String? or to find possible ...
- 151
1
vote
0
answers
1k
views
TLS certificate works on Ubuntu 18.04 but not on Centos 7.6
I have a set of keys that authenticate me to some external server. They all use a root CA that's not installed in common distributions.
I am validating if the external server responds, using a Docker ...
- 879
1
vote
1
answer
180
views
Linux Kernel Development Support for RSA Encryption [closed]
I am working on a prototype, and I'm new to Linux Kernel Development. I see that the Linux Kernel has a crypto module, but I am not sure if it supports Asymmetric Encryption such as RSA.
- 141
2
votes
1
answer
2k
views
How to build a specific kernel module?
I installed a kernel source from the official Linux kernel repository (http://www.kernel.org/pub/linux/kernel/v4.x/linux-4.15.tar.bz2) and I recompiled it with some needed options to support the ...
- 77
2
votes
1
answer
817
views
scrypt key calculator
scrypt is a password-based key derivation function that can be tuned to use a large amount of memory.
I want a command-line interface to calculate the key given my own values for parameters: password,...
- 376
0
votes
1
answer
5k
views
EVP_CIPHER_CTX in openssl 1.1.x
error: storage size of 'ctx' isn't known
EVP_CIPHER_CTX ctx;
I am getting this error with openssl -1.1.1.
Compared openssl-1.0.* and openssl-1.1.1 and this EVP_CIPHER_CTX struture has not been made ...
user298537
1
vote
0
answers
244
views
LUKS secure automated decryption
I have critical data, let's say machine learning code, GPG keys,... etc.
I would like to create a workstation that will work somewhere else- in someone else's premises.
I don't have concern that ...
- 1,369
2
votes
1
answer
280
views
How to select the right options in the Cryptographic API Kernel section?
How do I know, which Kernel modules in the Cryptographic API will be beneficial on my system?
How can I see, if I have software, which will use the Kernel API?
For example I use often RSA, but will ...
- 3,938
2
votes
2
answers
3k
views
SHA-512 password stored as non-hex string
I feel like this is so obvious that searching on the Internet doesn't show any results about my problem. I'm looking at the root password in /etc/shadow, which looks something like:
$6$Etg2ExUZ$...
- 31
0
votes
1
answer
843
views
How does Cryptoloop work and where can I use it? [closed]
I read about Cryptoloop and I wonder where can I use it?
I understand that:
Cryptoloop is a Linux kernel's disk encryption module that relies on the Crypto API, which is a cryptography framework ...
- 111
2
votes
0
answers
299
views
bash tab auto-complete for java keytool
Can anyone point me to a bash tab autocomplete for the java keytool command?
Learning & writing this seems not simple, and I presume that someone has felt this pain before.
- 133
1
vote
1
answer
4k
views
How do you use the AES key wrap cipher with the OpenSSL command line utility?
When you run the command openssl enc -ciphers a list of supported ciphers is printed. In more recent versions of the OpenSSL utility the ciphers -id-aes256-wrap, -id-aes256-wrap-pad, and -aes256-wrap ...
- 161
0
votes
1
answer
380
views
Linux screen lock security [closed]
How secure is relying on the default screen lock in linux? What stops an attacker for just plugging a device that bruteforces the passord check? How secure should be my linux account password?
- 111
0
votes
2
answers
1k
views
Maintaining /boot partition integrity
I am interested in setting up my computer with full disk encryption, and as I understand, the /boot partition is the only tricky part of the process. Namely, I can encrypt the /boot partition and ...
- 101
19
votes
2
answers
19k
views
What is the difference between /etc/ssh/ and ~/.ssh?
I’m having fun with OpenSSH, and I know the /etc/ssh directory is for the ssh daemon and the ~/.ssh directory is for a particular user.
Both directories contain private and public keys:
But what is ...
- 313
2
votes
1
answer
1k
views
FIPS 140-2 compliance for Apache and Haproxy on CentOS 7 [closed]
I have CentOS 7 and Apache and the Haproxy load balancer with SSL support.
How to make the server compliant to FIPS 140-2?
From CHAPTER 10. FEDERAL STANDARDS AND REGULATIONS | redhat.com
I got the ...
user11085
0
votes
1
answer
753
views
EFS replacement on Ubuntu
I'm considering switching from Windows Server to Ubuntu Server. One of feature that I can't figure out is - what should I use instead of NTFS Encryption (EFS). So, basically, what I need:
1) This ...
- 101
2
votes
0
answers
112
views
Are any distros implementing a more secure CSPRNG in KASLR than RDRAND in lib/kaslr.c as in the vanilla sources?
I started with kaslr.c and found that it uses kaslr_get_random_long() defined in kaslr.h and implemented in lib/kaslr.c where it possibly uses RDRAND (Intel's hardware PRNG), a timestamp, and at ...
- 153
1
vote
0
answers
68
views
In HP-UX, how do you write a C program using PKCS#11 api?
I am heavily confused by HP-UX's manual on its cryptographic module linked here.
It gives an example of a C code using PKCS#11 apis, but nowhere can I find information on where to find the shared ...
- 471
1
vote
1
answer
1k
views
Why does crypt(3) use DES? [closed]
man 3 crypt clearly states that it uses DES. I thought DES was deprecated, but I see no notice that crypt would be deprecated.
Why does it not use AES instead, and is crypt(3) deprecated?
Is it ...
- 4,106
0
votes
0
answers
342
views
Need to install new distro in LUKS disk
I have a disk encrypted with LUKS and running OpenSuse. I want to to install Fedora in the / partition. The /home is a different partition on the LUKS disk. How can I mount the / so the Fedora ...
- 875
1
vote
1
answer
4k
views
Creating elliptic curve keys and certs (ECC and ECDH) for openvpn server
I have a raspi at home with openvpn so I can safely browse the internet when I use my laptop or phone in a public place (coffee shop, bar, hotel...) that has open wifi.
I want make my openvpn server ...
- 11
2
votes
1
answer
844
views
Keychain Password Removal Command
Looking for a little guidance on removing all instances of a generic password keychain by either the service (svce) or label string. I can do it once at a time but I sometimes have machines that have ...
