Questions tagged [cryptography]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
16 views

Combine two AES 256bit keys for 512bit LUKS master key (memory dump)

I am currently trying to decrypt a LUKS volume with a memory dump for testing purposes (how secure is LUKS in a VM). I successfully extracted two 256bit AES keys. But to decrypt the LUKS partition I ...
0
votes
0answers
24 views

CPU crypto extensions for server tenants

How can someone use the crypto extensions (hardware acceleration) provided by Intel / AMD processors in PHP? Perhaps the underlying C code uses them when available automatically? There's no info about ...
0
votes
1answer
14 views

server host key usage problem

I have my server host key(private key) in Openssl format that i want to use for server authentication. I prefer to use the trust model that client local database should associates each host name with ...
0
votes
1answer
155 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
2
votes
1answer
205 views

smart card for UAC only

I'm in the process of configuring USB Yubikeys as a smart card for our company so that staff can elevate to an admin account (added to the computer's local administrators group) by simply inserting ...
0
votes
1answer
49 views

Two salts, One password [closed]

If I have two different MD5 password hashes with two different salts (the salts are known), is there any way to cryptographically deduce if the two passwords match? Other than brute force password ...
2
votes
1answer
116 views

MySQL - SSL with ECDSA Private Key

Under the list of supported TLS cipher suites here, MySQL contains support for a number of ECDSA suites. I tried to setup MySQL to use SSL with an ECDSA private key, but this does not appear to work: ...
0
votes
1answer
751 views

How to make sure TLS is using AES 256

I am trying to establish a secure TLS connection between my system and a third party API. Third party mandates that I have to use AES 256 for all communication, Now I have installed a X509 ...
1
vote
1answer
116 views

Windows Server 2008 R2 - Cryptographic Operators group issue

I have a problem similar to this question: Windows 7 “Cryptographic Operators”. I am attempting to add a cryptographic rule. When I get to the step to set the cryptographic algorithms I get an "...
-1
votes
3answers
2k views

How is a self-signed certificate different from a certificate signing request?

From the wiki page for a Certificate signing request: In Public Key Infrastructure (PKI) systems, a Certificate Signing Request (also CSR or certification request) is a message sent from an ...
0
votes
2answers
146 views

Group Policy Preferences item-level targeting propagation

I'm using GPPs to deliver some registry values and grabbed these using the Registry Wizard tool. This has created a collection with folder structure underneath. I want to use Item-level targeting to ...
1
vote
1answer
419 views

IIS RC4 vulnerability Windows Server 2012 R2

I need to disable insecure cypher suites on a server with Windows Server 2012 R2 to pass a PCI vulnerability scan. From the research I've done it seems this is to done in IIS with some registry ...
0
votes
0answers
474 views

How to configure a Tomcat 7 TLS connector for maximum security

I'm trying to configure a Tomcat 7 TLS connector for best possible security. To test, I'm allowing the Qualsys test to run against my server. However I keep failing on the following points: ...
-1
votes
1answer
73 views

Secure access to a site using SSL sertificate

I need to implement secure access to the corporate site using SSL certificates. After long time of searching I've came to conclusion that there are 2 ways to do that: creating own self-signed root CA ...
0
votes
1answer
1k views

TLS-PSK vs TLS-PKI

I have read that once TLS-PSK encryption is about equally secure as TLS-PKI. The level of security by both depends on the data entered to configure the encryption. Could you please confirm this? ...
-2
votes
1answer
1k views

Create random file with openssl [closed]

So I read this questionUrandom Alternative, but I am unable to make a comment there (without 50 rep) - therefore I open a separate question: If I use this command instead of dd and urandom, how do I ...
1
vote
1answer
1k views

Integrating Apache with PKCS#11 device via engine_pkcs11 and OpenSSL

I have problem with mod_ssl exactly with SSLCryptoDevice directive. When I run command "openssl engine" returns all available engines including pkcs11 (libengine-pkcs11-openssl), but When I set ...
12
votes
5answers
7k views

Generate entropy for PGP key

I'm logged onto a VM remotely and trying to generate a 4096bit PGP key, it just hangs forever because there is no entropy and since I'm working through remote desktop it probably does not detect the ...
1
vote
1answer
48 views

Does my SSL cert have anything to do with or say about the symmetric session key?

The answer found on this server fault thread is my jumping off point for this general topic: https://serverfault.com/a/313558 ... and this question can be thought of as a follow-up to that answer. ...
1
vote
3answers
3k views

How to create a digital signature and verify it through a server

I am trying to find out a way to create a digital signature for the employees of my company and place it in a server from where they can retrieve them and attach it with any digital document (Office ...
0
votes
1answer
67 views

After Updating to SHA2, private and public doesn't match

I've upgraded to SHA2 certificate, but after upgrading the new certificate key doesn't match my old private key. Public key has changed after updating and it doesn't match to previous private key. ...
7
votes
3answers
13k views

How are Windows MachineKey Container File Name's Derived?

In the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys directory there's an enumeration of Key Containers. The naming convention is <uniqueGUID>_<staticGUID> and I presume the <...
2
votes
0answers
239 views

Deprecation of RSA-SHA-1 in DKIM keys?

I recently noticed that opendkim on my mail server is objecting to DKIM signatures from a client, saying their key is insecure. It may be that that's due to lack of secure DNS (confirmation?) but I ...
0
votes
0answers
1k views

Check for SSL Weak Ciphers SSL3_RSA_RC4_128_MD5, SSL3_RSA_RC4_128_SHA, TLS1_RSA_RC4_128_MD5, TLS1_RSA_RC4_128_SHA

I am getting a serve ready for PCI compliance, and have one area with crypto from apache with the following report: Weak ciphers offered by this service: SSL3_RSA_RC4_128_MD5 SSL3_RSA_RC4_128_SHA ...
0
votes
1answer
314 views

Can't build crc32c(a nodejs package)

It's not really nodejs related. It's a C implementation. Firstly, while building, it exits with error: "warning: linux/if_alg.h: No such file or directory". Then I run yum install kernel-devel-{...
-2
votes
2answers
108 views

Is uploading your openssh public key to ~/.ssh/ for a given user safe?

I like to upload my public key (eg: ~/.ssh/id_rsa.pub) to various servers that I connect to on various networks for work. I use this same public key on github. If I am on a shared user account and I ...
1
vote
1answer
208 views

Cisco ASA crypto keys, SSH, and VPN

I'm new to the ASA and wanted to know if regenerating crypto keys on an existing ASA with established VPN tunnels could negatively affect the tunnels. The reason for wanting to regenerate crypto keys ...
2
votes
1answer
199 views

Linux Kernel setup: is it good idea to enable everything in Cryptographic API?

There are several implementations for some algorithms, which use CPU instructions which may or may not be available on current system. Is it good idea to just enable (in kernel, not as modules) all of ...
3
votes
2answers
353 views

how is a website certificate file cryptographically readable by windows?

I have a .crt file signed by a CA. I cat the file to see that it is ascii text. Yet when I double click on the .crt file in windows, it opens it up and somehow displays all the information that's ...
8
votes
1answer
7k views

Logging SSL ciphersuite used in Windows Server 2008 R2

Is there a way to see /log which cipher suites are (actively) being used to establish SSL connections on Windows Server 2008 R2? Ideally on a per request basis, like an extra column in the IIS logs.
-2
votes
2answers
2k views

how to sign a binary in Linux? [closed]

I have a Linux device that needs to be able to perform a software update of some binaries that may be coming from an insecure source I'd like to find a way to sign these binaries using a public/...
5
votes
1answer
2k views

Is there a way to see which groups/users have access to an RSA key container?

I used aspnet_regiis to create an RSA key container (machine container). I want to secure it and I know I can use the -pa and -pr commands to specify access. But is there a way to see which ...
8
votes
2answers
2k views

Https for embedded devices, local addresses

I am trying to add https to the embedded devices I am working on. These devices are generally assigned local ip addresses and so cannot get their own ssl certificates. So essentially my question is ...
3
votes
1answer
2k views

Strong Cryptography in Solaris Zone

I'm trying to setup a Kerberos KDC on a Solaris zone but ran into a bit of a problem with the Cryptographic Framework on Solaris 10 even though the packages for strong encryption (SUNWcry & ...
1
vote
2answers
820 views

virtual machines and cryptography

I suspect I'm a bit offtopic with the site mission, but it seems me more fitting for the question than stackoverflow i'm in preparing to create a vm with sensible data (personal use, it will be a web+...
7
votes
1answer
3k views

md5sum returns a different hash value than online hash generators

On suse10 md5sum myname gives md5 hash as 49b0939cb2db9d21b038b7f7d453cd5d. The file myname contains string "ravi" while some of the online md5 hash generators for the same string seem to give a ...
12
votes
2answers
10k views

Entropy on virtual machines

As you might know that it's not as easy to generate entropy on a virtual machine as on a "normal" pc. Generating a gpg-key on a virtual machine can take a while, even with the correct tools. There ...
5
votes
3answers
311 views

PGP: on the web, what if everything was tampered?

I am trying to wrap my head around how Public Key Cryptography can really work in a secure manner. From what I can gather, you go to example.com and download their PGP/GPG Public Key and add it to ...
13
votes
4answers
7k views

Validating signature trust with gpg?

We would like to use gpg signatures to verify some aspects of our system configuration management tools. Additionally, we would like to use a "trust" model where individual sysadmin keys are signed ...
1
vote
1answer
1k views

apache2 SSL Diffie Hellman key sizes

How to make apache 2.2 in debian lenny use Diffie Hellman key exchange with keys larger than 1024bits? I found a patch that theoretically adds this ability at Apache bugzilla but can't find any ...
0
votes
1answer
1k views

Smartcard (USB Cryptostick) and Firefox

I am having a GPF-Cryptostick running on ubuntu 11.04 with firefox 5.0. Using a smartcard is such a great thing, but i did not found any good how-tos. Maybe it is just a lack of understanding. First: ...
8
votes
1answer
7k views

What kind of algorithm does .htpasswd uses?

I am trying to generate this kind of hashes programmatically: axF3s9cdEnsNP But I can't identify what kind of hash it is. The hash comes from a .htpasswd file. All the online htpasswd generators I ...
2
votes
2answers
122 views

ssl communication handshake question

During SSL communication, the server sends its certificate to the client for authentication. Optionally, the client could send its certificate too, for client authentication. My question is, does the ...
0
votes
1answer
610 views

What cryptographic accelerators are recommended for use with Linux in the enterprise?

I've been investigating hardware cryptographic accelerators, and have come up against a dizzying array of possibilities. There are boards that range from $20 to $10,000 - and CPUs that have ...
2
votes
3answers
2k views

How to make OpenVPN use VIA Padlock on OpenBSD?

I've bought a VIA based router for the only purpose to run OpenVPN on it. Unfortunately it seems that Padlock is not used. Here is the important part from dmesg: OpenBSD 4.8 (GENERIC) #136: Mon Aug ...
1
vote
2answers
472 views

Can I use the same password for TrueCrypt as what I used when creating my Public Key?

I created and published a Public Key using gpg. I am now creating a TrueCrypt volume and wish to use the same password. Does knowing my public key, in this instance, make my TrueCrypt volume become ...
2
votes
4answers
5k views

Creating a DSA Signature from the Linux command line

I'm looking for a Linux/Unix command-line tool to create a DSA signature from a given file/data and a private key. I know about the xmlsec1 tool. But I would like something simpler. It seems that ...
1
vote
1answer
79 views

What DNSSec implementations are available, and have they been checked for padding Cryptographic Oracle vulnerabilities?

A cryptographic Oracle is where one can deduce the private key when a error condition is created. Considering the recent ASP.NET padding Oracle exploit, can anyone tell me if the DNSSec ...
1
vote
0answers
484 views

WebLogic 8.1 and 4096-bit SSL?

We have a scenario in which we'd like to configure a WebLogic 8.1 server (running on Windows, JRockit 1.4.2) to connect to Active Directory over SSL for authentication. Our Active Directory is ...
8
votes
2answers
6k views

Two SSL certificates with same key

If I generate two SSL certificates using the same key, am I diluting the strength of the certificates? (does it open the door for cryptanalysis or a possibility of compromising data across that ...