Hot answers tagged

16

This does not talk about salt at all but about actual symmetric keys. Quoting the full paragraph: Most programming environments provide some sort of "secure random" mechanism (a CSPRNG). You can use this to acquire a byte array of the appropriate length (e.g. 32 bytes for AES256), which can be used as a key. Be sure to pass in the raw bytes, and ...


3

Can someone elaborate on why this is bad? Who said encoding salt before hashing was bad? When Tim McLean wrote: Be sure to pass in the raw bytes, and not, e.g., a hex-encoded string. he was specifically talking about generating a key for a symmetric cipher; he wasn't talking about generating an image to be hashed. When you generate a salt for a hash, ...


3

A Keystore is a concept how crytographic material like keys and certicates are stored. So everything that allows that can be considered to be one, e.g. a directory containing files (e.g. when using OpenSSL) or a database or a single file with a particular structure. There are standards for the latter, e.g PKCS#12 or standards defined by programming languages ...


2

A keystore is a computer subsystem that stores cryptographic keys. You can arrange for a key to be stored in it and use the key later in some way. That's the only characteristic you can always expect from something called a keystore. A keystore may or may not have stronger protections than the rest of the system, such as preventing direct access to its ...


2

The loops are disjoint. In other words, the first loop completes and then the second loop starts. A=B=i=j=0 are explicitly initialised to zero as in many languages failing to specify an initial value can lead to unspecified behaviour (e.g. setting the variables to random values lying in old memory). This initialisation and the initialisation of v occur ...


2

The challenging part is mostly about image processing, and not a lot about crypto. You want to extract from the image sufficient entropy in a reliable fashion. It has a lot to do with how you use the image and your adversary model. If your adversary knows nothing at all about the image, some simple coarse features could be sufficient, if your adversary knows ...


1

RSA doesn't take a password at all. The notation is simply incorrect. RSASSA-PSS takes a private key and a message and produces a signature. That signature can be verified by anyone with the signature, the message, and the public key. RSAES-OAEP takes a public key and a short message (almost always a symmetric key) and encrypts that message (symmetric key) ...


Only top voted, non community-wiki answers of a minimum length are eligible