Questions tagged [cryptography]

Cryptography provides security mechanisms that are based on algorithmic methods and not on policy enforcement. For questions on cryptographic mechanisms and their application the Cryptography SE resp. the Information Security SE are most likely more appropriate. Don't use this tag if your question is about software that uses cryptographic mechanisms but not about cryptography itself.

2
votes
1answer
46 views

scrypt key calculator

scrypt is a password-based key derivation function that can be tuned to use a large amount of memory. I want a command-line interface to calculate the key given my own values for parameters: password,...
0
votes
0answers
58 views

openssl - sign with private key not from file

I'm signing a file using SHA256withRSA: openssl dgst -sha256 -hmac "$privateKey where $privateKey is the stuff in between -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----. Am I doing it ...
0
votes
1answer
478 views

EVP_CIPHER_CTX in openssl 1.1.x

error: storage size of 'ctx' isn't known EVP_CIPHER_CTX ctx; I am getting this error with openssl -1.1.1. Compared openssl-1.0.* and openssl-1.1.1 and this EVP_CIPHER_CTX struture has not been made ...
1
vote
0answers
140 views

LUKS secure automated decryption

I have critical data, let's say machine learning code, GPG keys,... etc. I would like to create a workstation that will work somewhere else- in someone else's premises. I don't have concern that ...
2
votes
1answer
59 views

How to select the right options in the Cryptographic API Kernel section?

How do I know, which Kernel modules in the Cryptographic API will be beneficial on my system? How can I see, if I have software, which will use the Kernel API? For example I use often RSA, but will ...
-1
votes
2answers
418 views

SHA-512 password stored as non-hex string

I feel like this is so obvious that searching on the Internet doesn't show any results about my problem. I'm looking at the root password in /etc/shadow, which looks something like: $6$Etg2ExUZ$...
0
votes
1answer
211 views

How does Cryptoloop work and where can I use it? [closed]

I read about Cryptoloop and I wonder where can I use it? I understand that: Cryptoloop is a Linux kernel's disk encryption module that relies on the Crypto API, which is a cryptography framework ...
2
votes
0answers
99 views

bash tab auto-complete for java keytool

Can anyone point me to a bash tab autocomplete for the java keytool command? Learning & writing this seems not simple, and I presume that someone has felt this pain before.
0
votes
1answer
778 views

How do you use the AES key wrap cipher with the OpenSSL command line utility?

When you run the command openssl enc -ciphers a list of supported ciphers is printed. In more recent versions of the OpenSSL utility the ciphers -id-aes256-wrap, -id-aes256-wrap-pad, and -aes256-wrap ...
0
votes
1answer
92 views

Linux screen lock security [closed]

How secure is relying on the default screen lock in linux? What stops an attacker for just plugging a device that bruteforces the passord check? How secure should be my linux account password?
0
votes
2answers
277 views

Maintaining /boot partition integrity

I am interested in setting up my computer with full disk encryption, and as I understand, the /boot partition is the only tricky part of the process. Namely, I can encrypt the /boot partition and ...
1
vote
2answers
2k views

What is the difference between /etc/ssh/ and ~/.ssh?

I’m having fun with OpenSSH, and I know the /etc/ssh directory is for the ssh daemon and the ~/.ssh directory is for a particular user. Both directories contain private and public keys: But what is ...
1
vote
1answer
619 views

FIPS 140-2 compliance for Apache and Haproxy on CentOS 7 [closed]

I have CentOS 7 and Apache and the Haproxy load balancer with SSL support. How to make the server compliant to FIPS 140-2? From CHAPTER 10. FEDERAL STANDARDS AND REGULATIONS | redhat.com I got the ...
0
votes
1answer
280 views

EFS replacement on Ubuntu

I'm considering switching from Windows Server to Ubuntu Server. One of feature that I can't figure out is - what should I use instead of NTFS Encryption (EFS). So, basically, what I need: 1) This ...
2
votes
0answers
84 views

Are any distros implementing a more secure CSPRNG in KASLR than RDRAND in lib/kaslr.c as in the vanilla sources?

I started with kaslr.c and found that it uses kaslr_get_random_long() defined in kaslr.h and implemented in lib/kaslr.c where it possibly uses RDRAND (Intel's hardware PRNG), a timestamp, and at ...
1
vote
0answers
56 views

In HP-UX, how do you write a C program using PKCS#11 api?

I am heavily confused by HP-UX's manual on its cryptographic module linked here. It gives an example of a C code using PKCS#11 apis, but nowhere can I find information on where to find the shared ...
1
vote
1answer
308 views

Why does crypt(3) use DES? [closed]

man 3 crypt clearly states that it uses DES. I thought DES was deprecated, but I see no notice that crypt would be deprecated. Why does it not use AES instead, and is crypt(3) deprecated? Is it ...
0
votes
0answers
132 views

Need to install new distro in LUKS disk

I have a disk encrypted with LUKS and running OpenSuse. I want to to install Fedora in the / partition. The /home is a different partition on the LUKS disk. How can I mount the / so the Fedora ...
-1
votes
1answer
2k views

Creating elliptic curve keys and certs (ECC and ECDH) for openvpn server

I have a raspi at home with openvpn so I can safely browse the internet when I use my laptop or phone in a public place (coffee shop, bar, hotel...) that has open wifi. I want make my openvpn server ...
2
votes
1answer
319 views

Keychain Password Removal Command

Looking for a little guidance on removing all instances of a generic password keychain by either the service (svce) or label string. I can do it once at a time but I sometimes have machines that have ...
1
vote
2answers
102 views

zero knowledge encryption

I'm looking to deploy a solution where large files are generated on the server containing customer sensitive information. Customers' can then login and download these files. My question is "is there ...
1
vote
1answer
577 views

Why does the factor command produce nonsense on an RSA modulus?

Ok, so I think I may have found a flaw in... something. I honestly don't know. This is such a weird scenario. I was attempting to break very small asymmetric (RSA) encryption, just as a Proof of ...
1
vote
0answers
412 views

Dictionary attack GPG symmetric encrypted LUKS keyfile

I remember typing in a long phrase for the password. I wrote all the words I could have possibly used into a plain text file, combining the words I know were used in a certain order. I might have ...
0
votes
1answer
62 views

Is it safe to run GPG tools in x11?

Given the relative (anyone with my present user permissions can swipe scancodes) ease of keylogging in an x11 environment, should I run GPG tools only in the TTY?
1
vote
1answer
647 views

How can I solve “Your connection to 192.*.*.* is encrypted with obsolete cryptography”

I just set up my apache server with SSL installed on it, and everything is perfect except that when I open the page with https:// I get the following message when I click the padlock next to the ...
2
votes
1answer
1k views

add key to proc/keys

How do I add a key to a keyring in /proc/keys ? My openembedded Linux does not come with a keyctl command program. And all I can find on google is the programming interface, but I would like to do ...
0
votes
0answers
52 views

Gpu rig, possibilities

My plan is to buy old and cheap graphic cards on the internet and build a gpu rig for password cracking. I have been playing around for some while with OpenMPI and I love the fact that its possible ...
2
votes
4answers
733 views

File encryption utility without key integrity check (symmetric key)

When encrypting a file with symmetric key, most common utilities (such as gpg, mcrypt, etc) store information in the encrypted message which can be used to verify integrity of the key during ...
1
vote
1answer
79 views

Can OpenSSH 6.7 optionally not depend on OpenSSL?

It has been reported on Slashdot on 2014-04-30 that OpenSSH now has a compile-time option to not depend on OpenSSL. However, OpenSSH 6.7 release notes, released on 2014-10-06, do not make any mention ...
1
vote
0answers
47 views

How can I get console ssh to NOT ask for my private key password every time? [duplicate]

I have a program required by work installed on a Debian Wheezy box. Previously I was using Mac OS X (switch details irrelevant). I have an SSH keypair at ~/.ssh/id_rsa{.pub}. That keypair has a ...
3
votes
1answer
329 views

md5deep utility giving wrong/different output!

md5deep utility gives different result when calculating hashes. I have used several online tools to calculate hash and they give same result but md5sum or md5deep program on linux gives different ...
1
vote
2answers
613 views

Strategies for userland file encryption without FDE

There are cryptography experts that are concerned over using Full Disk Encryption (FDE) on *nix platforms due to attack surface exposed due to reverse engineering of encryption algorithm when looking ...
1
vote
1answer
188 views

How does the authentication process with the salted hash in shadow work

Does the supplied password during login get converted to a salted hash and then compared to the one in /etc/shadow? /what if the user is in LDAP but not in the shadow file? Would it use kerberos?
0
votes
1answer
1k views

Why does PyCrypto require a C compiler?

Is there a python crypto library that does not rely on anything besides python? Or pre-complied bundles of PyCrypto for Linux?
4
votes
2answers
5k views

How to encyrpt a message using someone's SSL smime.p7s file

I need to send a private key file to someone (a trusted sysadmin) securely. I suggested a couple options, but he replied as follows: Hi, I don't have neither LastPass nor GnuPGP but I'm using ssl ...
4
votes
1answer
2k views

Asynchronous and parallel algorithms in the Linux kernel

In the Linux kernel configuration, I see these options: config CRYPTO_PCRYPT tristate "Parallel crypto engine" depends on SMP select PADATA select CRYPTO_MANAGER ...
1
vote
2answers
5k views

DNSCrypt, Unbound and DNSSEC

I would like to have an encrypted DNS queries + a DNS Cache + Domain Name System Security Extensions (DNSSEC) . I used this bash script to install DNSCrypt and I choosed to use dnscrypt.eu servers : ...
5
votes
1answer
497 views

Using kernel cryptographic functions

Is it possible to use kernel cryptographic functions in the userspace? Let's say, I don't have md5sum binary installed on my system, but my kernel has md5sum support. Can I use the kernel function ...
4
votes
2answers
2k views

generate Token for OAuth (Twitter)

I am writing a simple bash script to download stream from Twitter: curl -H "Authorization: ${TOKEN}" "$URL" and I am looking for a way to generate the $TOKEN. I have all the input necessary (...
5
votes
1answer
298 views

What is the correct partition type for a geli-crypted partition on FreeBSD?

I am currently in the process of setting up an encrypted homeserver with zfs and geli. However I am not sure what the correct partition type for geli-crypted filesystems are. Do I just take 'freebsd-...
2
votes
1answer
1k views

generate SCRAM-SHA-1 hash of a password

I am looking for a simple way (perhaps using openssl) to generate SCRAM-SHA-1 hash of a password for use for Prosody Jabber Server. The passwords on the server are stored in the following form: ["...
2
votes
0answers
393 views

Linux cryptography with hidden hardware-stored key

I am running Linux on iMX233, an ARM CPU with hardware-accelerated AES engine. The AES key can be programmed permanently into the chip ROM (OTP). This key is not directly accessible by software. ...
10
votes
1answer
4k views

Cli verification of digitally signed email

I am Alice and I've received signed email from Bob. I use Web e-Mail client (e.g. GMail) and I see that one of attachements is smime.p7s. I've found option "show original message" and saved contents ...
6
votes
1answer
3k views

RIPEMD-160 file digest

How can I make a file digest under Linux with the RIPEMD-160 hash function, from the command line?
1
vote
2answers
437 views

PGP words of an RSA fingerprint

Is there a program that displays my SSH RSA key fingerprint 43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8 as PGP words? Added on 16th October 2012: I decided to write my own code. I found pgp ...
15
votes
2answers
865 views

Why aren't the Fedora GPG keys signed?

Fedora uses GPG-keys for signing RPM packages and ISO checksum files. They list the keys in use (including fingerprints) on a web page. The web page is delivered via https. For example the checksum ...
22
votes
4answers
23k views

How do I tell which GPG key an RPM package was signed with?

The cryptographic signature of an RPM can be verified with the rpm -K command. This returns a string containing gpg (or pgp) and ending in OK if the signature is in RPM's database and is valid. If ...
0
votes
1answer
420 views

nacl crypto installation on arch

I am trying to install nacl crypto on my system: % uname -a Linux (none) 2.6.39-ARCH #1 SMP PREEMPT Mon Jun 6 22:37:55 CEST 2011 x86_64 Intel(R) Core(TM) i5 CPU M 540 @ 2.53GHz GenuineIntel GNU/Linux ...
28
votes
5answers
24k views

How can I get a base64 encoded shaX on the cli?

sha1sum outputs a hex encoded format of the actual sha. I would like to see a base64 encoded variant. possibly some command that outputs the binary version that I can pipe, like so: echo -n "message" |...
3
votes
1answer
3k views

How to restore GnuPG key after reinstall?

I know that GnuPG is all about security, thus it's not giving many chance of retrieve private keys (otherwise anyone could do it) but I've got a private key, and my own rev.asc file. I had to ...