# Tag Info

8

IVs and salts are public, so they are safe to pass with the ciphertext. They should be authenticated along with the ciphertext though.

5

If you implemented it well, and there is no MITM (i.e. use authenticated comm channel), then it is difficult to forge the RSA signatures (meaning you can use them safely). However, in your implementation there are 2 other major factors that you need to consider: One is the use of Javascript as a coding medium: there are many who consider Javascript to be ...

4

I don't know much about the library you're using but it looks like you're trying to encrypt/decrypt the cipher-text using RSA directly. Using RSA in this way isn't secure unless extreme care is taken. This isn't the correct way to use RSA. Typically, what you do is use RSA to encrypt a secret key. This secret key is then used with a conventional symmetric ...

4

The answer is: Why do the encrypted files always start with "Salted__" ("U2FsdGVkX1" in base64)? Isn't giving away information like this insecure? The encrypted files must always start with "Salted_" to interoperate with OpenSSL. OpenSSL expects this. The 8 bytes that spell "Salted_" are always immediately followed by another random 8 bytes of salt. ...

4

In common cryptographic protocols there is only a need to generate RSA asymmetric keys now and then, say once a year. The key pair generation does not have to take place in the same environment either; e.g. you could use openssl command line if that is available. Note that RSA key pair generation time depends on finding large primes; the runtime is not ...

4

Assuming the digits of $\pi$ are pseudorandom (which hasn't been proven), you could construct a cipher from it. However: Your numbers are way too small to be secure. You seem to be adding a decimal digit to the letter, which means the ciphertext leaks more than half the bits: you know 'j' was one of 'a'...'j' originally. You only handle lower case letters –...

4

all those concerns have been studied a lot and still are. I'll try to give some keywords for them. a web app that stores all data on the server in a way that the server can't decrypt the data even if it wanted to. Solution for this is User-side encryption. That's why, forget about the server chosing the encryption key himself. It's quite well spread ...

3

Your javascript library linked to has no restrictions on key size. Many libraries out there that implement RSA will have a restriction on the key size. This is to make sure developers are following best practices as if the key size is too small, the security of the cipher is completely blown. It looks like the Java library you are using won't let you use key ...

3

The documentation says it's OpenSSL, not PBKDF2: When you use a CipherParams object in a string context, it's automatically converted to a string according to a format strategy. The default is an OpenSSL-compatible format This can be verified in the source code. The implementation of the OpenSSL KDF is in evpkdf.js. The key derivation function is ...

3

How does Web Cryptography API (eg window.crypto.getRandomValues) produce secure PRNG? Like the specification says: Implementations should generate cryptographically random values using well-established cryptographic pseudo-random number generators seeded with high-quality entropy, such as from an operating-system entropy source (e.g., "/dev/urandom"). ...

3

First observe that the password is all that protects the user's data from the server. There is no security added by the public and private keys. Here's a simple solution that should work reasonably well. It may even be secure... Assumptions We rely on a secure symmetric cryptosystem $(E,D)$ that supports authenticated data, that is, $c = E(k, ad, m)$ and $... 2 Either an RSA key pair is provided by the customer (high security, less convenient) OR a key pair is generated by the server and sent to the client (customer has to trust that we won't store the private key, but more convenient) Any reason not to generate a key pair in the client app? Nowadays even browsers should have access to sufficient entropy for ... 2 If flawed can someone please crack the message within the quotes as proof. "Hlont, iutgrcuxnewmova xn topdoqj akmy nthscuwros." Hello, congratulations on solving this encryption. Took < 1 second in Ruby. Basically it is far too easy to brute-force due to your very small key space, as explained in otus' answer. All I did was translate your decrypt ... 2 ($\hspace{.02 in}$packet$\approx$chunk) They put a packet number into the plaintexts, and mac-then-encrypt the packets separately. 2 I would try to avoid doing any cryptography using javascript… but that's just my personal opinion. Anyway, if you really want to walk the Javascript path, you could skip the libraries and take a look at the window.crypto.getRandomValues() function, as long as you can live with the fact that it's an experimental API and not yet supported in all browsers… it ... 2 Okay, for key derivation in the browser you will be using third party libs. If you want to be the absolute top of the line then scrypt (potential lib to consider) is your best bet with a medium to high work factor based on what your users are going to be using. Bcrypt works but is not memory hard so take that into consideration. (Even 5MB of memory usage ... 2 Is Javascript RSA signing safe? …is safe or can people forge… Like the accepted answer already stated: If you implemented it well and if there is no MITM (which can be handled by using HTTPS), then it is rather difficult to forge the RSA signatures. Yet, at the time of writing this, I would be cautious when it comes to Javascript cryptography. It’s ... 2 You don't need to brute force it. Since the passcode is the product of all its character codes, you can just find all prime factors of the passcode. I used an online tool which yields$2^6\cdot 3\cdot 5\cdot 7^2\cdot 61^2\cdot 97$. It looks like an ASCII passcode of length 5. This doesn't get you anywhere since this is just a check for a web page to open. ... 2 As @Biv pointed out in a comment, the only way to determine if something is secure is if you define secure. And even then, the answer is probably no, unless your definition is specific (see this answer for examples of security definitions in cryptography). It depends on how important is the data for you, which attacks you want to prevent and how much are you ... 2 First lets acknowledge this is a horrible hack - you really should find a way to do what you want more directly or risk code maintenance issues and likely bugs in the future. Second, while the question isn't about your key strengthening step it seems like you should ask about the security. There are lots of good key derivation methods out there and I don't ... 1 in practice A friend of mine needed help with her website and asked how to send me her login information securely. I've never known how to do this The current best-practices way to let you access someone else's website is using SSH, the Secure Shell. Send your public key to that person (in the open, with unencrypted email or etc.). Then have that ... 1 Well, I've translated it to show all the things that go wrong using inline comments: // this sucks, don't use public class ChrisVenessAES { // that should not be a singleton lazybones, it may contain state private static final CharsetEncoder ASCII_ENCODER = StandardCharsets.UTF_8.newEncoder().onMalformedInput(CodingErrorAction.REPORT).... 1 If you put the text content of the webpage encrypted into HTML5 local storage, IndexedDB or embedded as a hex/base64 string in the web page, then you you could try something like TripleSec which would take your password, run a PBKDF and decrypt the content. Or you can use one of the many JavaScript libraries CryptoJS, SJCL etc and do it yourself manually. ... 1 To simulate$n$times iterated ECB encryption, you can set your input plaintext block as the IV, encrypt a "plaintext" consisting of$n$all-zero blocks using either CBC or CFB mode (which are identical for all-zero plaintext), and take the$n\$-th block of the resulting ciphertext (discarding the rest of the output). Note that, if your CBC mode ...

1

I assume you are invoking it like this: CryptoJS.AES.encrypt("Message", "Secret Passphrase"); As of 3.1.2 the default key derivation function is OpenSSLKdf as configured here and implemented here and here.

1

Because RSA with 512 bits is considered insecure for a fair amount of time yet, and 512 bit RSA primes are already breakable on an average new desktop computer in several weeks. For any kind of asymmetric encryption that is supposed to be secure, I would suggest a key size of at least 2048 bits, better 4096. Only for keys like session keys that time out ...

1

RSA on itself is never safe! You must use proper functions to handle padding and probabilistic signing correctly. Otherwise your protocol is vulnerable to a bunch of attacks. PKCS #1 defines secure and well established algorithms like RSAES-OAEP and RSASSA-PSS. RSA without a padding or signature scheme is like using a block cipher in ECB mode. JavaScript ...

1

You can't. The best you can do is something like PBKDF2 or scrypt or bcrypt. But they won't generate a strong cryptographic key. If you start with a weak password or weak passphrase, and derive a cryptographic key from it, the result will inevitably be not very strong. Functions like PBKDF2 or scrypt or bcrypt are not a silver bullet. They make things a ...

1

I would take a look at https://github.com/mdp/gibberish-aes/ From that you can see well implemented ECMAscript, (javascript) and AES can be used to generate random numbers. It might be slightly over-kill for your needs, but should not let you down in the medium-term.

1

You're pretty much on the right track, I've got a few comments/suggestions though: store the plain sha1 of the unencrypted image with the encrypted image I'm assuming the sha1 hash is to ensure the integrity of the data being encrypted? If that's the case, you should have a read through this answer. Assuming you're limited to non-authenticated modes (...

Only top voted, non community-wiki answers of a minimum length are eligible