Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [cryptography]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
27 views

OpenSSL Ed25519 with sodium php is not working [migrated]

I a trying to encrypt a message with PHP 7.4 Sodium. This function: sodium_crypto_box_seal('Hello World', $pemPublicKey); Returns error: "Argument 2 must be CRYPTO_BOX_PUBLICKEYBYTES long." ...
Christoforos's user avatar
0 votes
1 answer
581 views

Host Key Exhange failing on AWS Transfer Family SFTP

I have a customer who is unable to connect to an SFTP Server (AWS Transfer Family SFTP). The error I am getting in my logs is: ERRORS KEX_FAILURE Message="no matching host key type found" ...
ck3mp's user avatar
  • 101
9 votes
2 answers
1k views

AWS Graviton Processors: which encryption specs are hardware accelerated?

In testing Graviton instances there seems to be significantly more CPU overhead from AES/SHA functions compared to the same on cheaper/smaller Intel/AMD instances. Do these procs supports hardware ...
Josh Hibschman's user avatar
0 votes
0 answers
199 views

Windows Server 2022 does not enable BrainpoolP256r1 ECC curve

I want to enable the ECC curve BrainpoolP256r1 on a Windows Server 2022. expected bahavior brainpool curve is added with enable command: PS C:\> Get-TlsEccCurve curve25519 NistP256 NistP384 PS C:\&...
fabsenet's user avatar
  • 101
0 votes
1 answer
934 views

PHP openssl encryption aes-256-cbc and decryption using NODEJS

I have a PHP script used to encrypt data with openssl_encrypt() and the aes-256-cbc algo. Encryption/Decryption works well using PHP, it's an old script. I've been trying to decrypt the datas using ...
Givre's user avatar
  • 69
0 votes
0 answers
34 views

How do TOR nodes select the CircID's when creating, or extending, a circuit?

I am coding my own version of TOR and I am trying to set up circuit management. I looked at the TOR spec and it says: To prevent CircID collisions, when one node sends a CREATE/CREATE2 cell to ...
saarmz's user avatar
  • 1
0 votes
0 answers
120 views

Why should I disable insecure SSH hostkeys if I never plan on using them?

A number of articles suggest removing insecure (broken) SSH key types in order to have a more secure server. In practice, if I only connect to the server with secure key types, why should I bother ...
angryserver's user avatar
0 votes
1 answer
3k views

Disabling reneg-sec on openvpn

I'm using a kylemanna/openvpn image (Openvpn 2.4) with default settings and I've noticed that each client disconnects for 1 minute every 1 hour. I believe it's connected to reneg-sec, which defaults ...
eeeeeeeeeeeeeeeeeeeeeeeeeeeeee's user avatar
0 votes
1 answer
2k views

How is setting the system-wide cryptographic policy for Java supposed to work?

When migrating a proprietary Java (and Jetty) based application from RHEL7 to RHEL8 I learned something new: At least with OpenJDK 11 the JVM still defaults to a 1024 bit Diffie-Hellman group unless ...
mss's user avatar
  • 445
0 votes
1 answer
441 views

Understanding SSH Public Key Auth Ciphers

I have a technical recommendation for SSH that states we should only use the following algorithms for Public Key authentication. Unfortunately the guide does not mention the exact names of ciphers as ...
John Nemo's user avatar
0 votes
1 answer
861 views

Docker container CMAKE gives crypto/fips/fips.c:153: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE - dracut-fips crypto.fips_enabled = 1

Getting crypto/fips/fips.c:153: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE when dracut-fips package is installed and sysctl -a shows crypto.fips_enabled = 1 Restriction: Can not disable ...
AKS's user avatar
  • 115
0 votes
1 answer
2k views

Create new SubCA certificate fails with NTE_PROV_TYPE_NOT_DEF

I am trying to manually create a key and CSR for a new Windows AD CS Enterprise Subordinate CA (Windows Server 2019). I'd like to store the key in the modern Microsoft Software Key Storage Provider. ...
Daniel's user avatar
  • 7,059
1 vote
1 answer
2k views

Windows Server 2012: how to prevent IIS from choosing SHA-1 for connections?

The problem: IIS on Windows 2012 picks SHA-1 algorithm when the client uses SHA-1 certificate. Even though the server-side certificate is SHA-256. So Chrome/Edge don't work. On analogous Windows 2016 ...
Mikhail Orlov's user avatar
1 vote
0 answers
298 views

Are there any Operating Systems or Browsers that still depend on having these Ciphers enabled?

Doing a litle Cryptography Research and hit a case of conflicting data so wanted to try here. I'm running a Web Service and currently support these 2 Ciphers: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0X9F)...
Adamski2505's user avatar
-5 votes
1 answer
66 views

Which mobile VPN type, of IPSec, SSL/TLS, and SSH, would be better for travelling workers? [closed]

Not too sure on the specifics of each that would make one better for travelling.
john's user avatar
  • 1
0 votes
1 answer
50 views

How to list all of the known root keys in docker (Docker Content Trust)

How can I list all of the Docker Content Trust root keys on my system? I am setting up a CI process that will use the debian:stable-latest docker image to build my application's releases in ephemeral ...
Michael Altfield's user avatar
1 vote
1 answer
590 views

What is the difference between the TVOCache and the URLCache in Microsoft CAPI2?

In the CAPI2 log, I'm seeing some CertVerifyRevocation events that have the location TvoCache and some that have the location UrlCache for the validation of the same certificate: <Event> <...
Rufus Buschart's user avatar
0 votes
1 answer
75 views

server host key usage problem

I have my server host key(private key) in Openssl format that i want to use for server authentication. I prefer to use the trust model that client local database should associates each host name with ...
user avatar
1 vote
1 answer
885 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
shiroyashaa's user avatar
2 votes
1 answer
1k views

smart card for UAC only

I'm in the process of configuring USB Yubikeys as a smart card for our company so that staff can elevate to an admin account (added to the computer's local administrators group) by simply inserting ...
captcha's user avatar
  • 588
0 votes
1 answer
87 views

Two salts, One password [closed]

If I have two different MD5 password hashes with two different salts (the salts are known), is there any way to cryptographically deduce if the two passwords match? Other than brute force password ...
Jonas Bjork's user avatar
3 votes
1 answer
480 views

MySQL - SSL with ECDSA Private Key

Under the list of supported TLS cipher suites here, MySQL contains support for a number of ECDSA suites. I tried to setup MySQL to use SSL with an ECDSA private key, but this does not appear to work: ...
Luke Joshua Park's user avatar
1 vote
1 answer
3k views

How to make sure TLS is using AES 256

I am trying to establish a secure TLS connection between my system and a third party API. Third party mandates that I have to use AES 256 for all communication, Now I have installed a X509 ...
None's user avatar
  • 113
1 vote
1 answer
215 views

Windows Server 2008 R2 - Cryptographic Operators group issue

I have a problem similar to this question: Windows 7 “Cryptographic Operators”. I am attempting to add a cryptographic rule. When I get to the step to set the cryptographic algorithms I get an "...
user4616559's user avatar
1 vote
3 answers
4k views

How is a self-signed certificate different from a certificate signing request?

From the wiki page for a Certificate signing request: In Public Key Infrastructure (PKI) systems, a Certificate Signing Request (also CSR or certification request) is a message sent from an ...
mbigras's user avatar
  • 317
0 votes
2 answers
451 views

Group Policy Preferences item-level targeting propagation

I'm using GPPs to deliver some registry values and grabbed these using the Registry Wizard tool. This has created a collection with folder structure underneath. I want to use Item-level targeting to ...
jshizzle's user avatar
  • 371
1 vote
1 answer
838 views

IIS RC4 vulnerability Windows Server 2012 R2

I need to disable insecure cypher suites on a server with Windows Server 2012 R2 to pass a PCI vulnerability scan. From the research I've done it seems this is to done in IIS with some registry ...
caesay's user avatar
  • 315
0 votes
0 answers
628 views

How to configure a Tomcat 7 TLS connector for maximum security

I'm trying to configure a Tomcat 7 TLS connector for best possible security. To test, I'm allowing the Qualsys test to run against my server. However I keep failing on the following points: ...
Aditya K's user avatar
  • 933
-1 votes
1 answer
86 views

Secure access to a site using SSL sertificate

I need to implement secure access to the corporate site using SSL certificates. After long time of searching I've came to conclusion that there are 2 ways to do that: creating own self-signed root CA ...
folibis's user avatar
  • 149
1 vote
1 answer
3k views

TLS-PSK vs TLS-PKI

I have read that once TLS-PSK encryption is about equally secure as TLS-PKI. The level of security by both depends on the data entered to configure the encryption. Could you please confirm this? ...
Bunkai.Satori's user avatar
-1 votes
1 answer
3k views

Create random file with openssl [closed]

So I read this questionUrandom Alternative, but I am unable to make a comment there (without 50 rep) - therefore I open a separate question: If I use this command instead of dd and urandom, how do I ...
user1252280's user avatar
2 votes
2 answers
2k views

Integrating Apache with PKCS#11 device via engine_pkcs11 and OpenSSL

I have problem with mod_ssl exactly with SSLCryptoDevice directive. When I run command "openssl engine" returns all available engines including pkcs11 (libengine-pkcs11-openssl), but When I set ...
t4nk566's user avatar
  • 23
12 votes
6 answers
9k views

Generate entropy for PGP key

I'm logged onto a VM remotely and trying to generate a 4096bit PGP key, it just hangs forever because there is no entropy and since I'm working through remote desktop it probably does not detect the ...
redic's user avatar
  • 121
1 vote
1 answer
57 views

Does my SSL cert have anything to do with or say about the symmetric session key?

The answer found on this server fault thread is my jumping off point for this general topic: https://serverfault.com/a/313558 ... and this question can be thought of as a follow-up to that answer. ...
87535's user avatar
  • 11
1 vote
3 answers
4k views

How to create a digital signature and verify it through a server

I am trying to find out a way to create a digital signature for the employees of my company and place it in a server from where they can retrieve them and attach it with any digital document (Office ...
sk1's user avatar
  • 111
0 votes
1 answer
71 views

After Updating to SHA2, private and public doesn't match

I've upgraded to SHA2 certificate, but after upgrading the new certificate key doesn't match my old private key. Public key has changed after updating and it doesn't match to previous private key. ...
Sumit Murari's user avatar
9 votes
3 answers
20k views

How are Windows MachineKey Container File Name's Derived?

In the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys directory there's an enumeration of Key Containers. The naming convention is <uniqueGUID>_<staticGUID> and I presume the <...
Colyn1337's user avatar
  • 2,427
3 votes
1 answer
727 views

Deprecation of RSA-SHA-1 in DKIM keys?

I recently noticed that opendkim on my mail server is objecting to DKIM signatures from a client, saying their key is insecure. It may be that that's due to lack of secure DNS (confirmation?) but I ...
mc0e's user avatar
  • 5,941
0 votes
0 answers
1k views

Check for SSL Weak Ciphers SSL3_RSA_RC4_128_MD5, SSL3_RSA_RC4_128_SHA, TLS1_RSA_RC4_128_MD5, TLS1_RSA_RC4_128_SHA

I am getting a serve ready for PCI compliance, and have one area with crypto from apache with the following report: Weak ciphers offered by this service: SSL3_RSA_RC4_128_MD5 SSL3_RSA_RC4_128_SHA ...
morleyc's user avatar
  • 1,130
0 votes
1 answer
433 views

Can't build crc32c(a nodejs package)

It's not really nodejs related. It's a C implementation. Firstly, while building, it exits with error: "warning: linux/if_alg.h: No such file or directory". Then I run yum install kernel-devel-{...
user avatar
-2 votes
2 answers
207 views

Is uploading your openssh public key to ~/.ssh/ for a given user safe?

I like to upload my public key (eg: ~/.ssh/id_rsa.pub) to various servers that I connect to on various networks for work. I use this same public key on github. If I am on a shared user account and I ...
Zombies's user avatar
  • 515
1 vote
1 answer
318 views

Cisco ASA crypto keys, SSH, and VPN

I'm new to the ASA and wanted to know if regenerating crypto keys on an existing ASA with established VPN tunnels could negatively affect the tunnels. The reason for wanting to regenerate crypto keys ...
user33975's user avatar
  • 123
2 votes
1 answer
274 views

Linux Kernel setup: is it good idea to enable everything in Cryptographic API?

There are several implementations for some algorithms, which use CPU instructions which may or may not be available on current system. Is it good idea to just enable (in kernel, not as modules) all of ...
Powerman's user avatar
  • 585
3 votes
2 answers
371 views

how is a website certificate file cryptographically readable by windows?

I have a .crt file signed by a CA. I cat the file to see that it is ascii text. Yet when I double click on the .crt file in windows, it opens it up and somehow displays all the information that's ...
Alexander Bird's user avatar
8 votes
1 answer
9k views

Logging SSL ciphersuite used in Windows Server 2008 R2

Is there a way to see /log which cipher suites are (actively) being used to establish SSL connections on Windows Server 2008 R2? Ideally on a per request basis, like an extra column in the IIS logs.
Frederik's user avatar
  • 183
-1 votes
2 answers
3k views

how to sign a binary in Linux? [closed]

I have a Linux device that needs to be able to perform a software update of some binaries that may be coming from an insecure source I'd like to find a way to sign these binaries using a public/...
stuck's user avatar
  • 697
5 votes
1 answer
3k views

Is there a way to see which groups/users have access to an RSA key container?

I used aspnet_regiis to create an RSA key container (machine container). I want to secure it and I know I can use the -pa and -pr commands to specify access. But is there a way to see which ...
kingdango's user avatar
  • 531
10 votes
2 answers
4k views

Https for embedded devices, local addresses

I am trying to add https to the embedded devices I am working on. These devices are generally assigned local ip addresses and so cannot get their own ssl certificates. So essentially my question is ...
Shiftee's user avatar
  • 203
3 votes
1 answer
2k views

Strong Cryptography in Solaris Zone

I'm trying to setup a Kerberos KDC on a Solaris zone but ran into a bit of a problem with the Cryptographic Framework on Solaris 10 even though the packages for strong encryption (SUNWcry & ...
Marcel G's user avatar
  • 2,369
1 vote
2 answers
874 views

virtual machines and cryptography

I suspect I'm a bit offtopic with the site mission, but it seems me more fitting for the question than stackoverflow i'm in preparing to create a vm with sensible data (personal use, it will be a web+...
Unknown's user avatar
  • 13