• Breaking News

    Saturday, December 16, 2017

    Home Unlabelled Cryptography Complete design of a silicon quantum computer chip unveiled

    Cryptography Complete design of a silicon quantum computer chip unveiled

    December 16, 2017

    Cryptography Complete design of a silicon quantum computer chip unveiled

    Complete design of a silicon quantum computer chip unveiled

    Posted: 15 Dec 2017 02:30 PM PST

    cyber•Search: the blockchain browser

    Posted: 16 Dec 2017 01:09 AM PST

    Complexity and Cryptography

    Posted: 15 Dec 2017 10:54 PM PST

    Looking for a method to allow multiple players draw tile from a bag in a way that is mutually verifiable

    Posted: 15 Dec 2017 06:31 PM PST

    Basically I want to implement a version of a board game that involves secretly drawing tiles from a sack. The trick is I need a way for users to be unable to choose what they are going to get, and unable to deduce it ahead of their turn.

    a good example of what I want to do it like scrabble drawing letters but there's only unique letters.

    submitted by /u/OU_ohyeah
    [link] [comments]

    NullAuth: A proposal for decentralizing authentication

    Posted: 15 Dec 2017 08:41 AM PST

    NullAuth

    Authentication mechanisms today have multiple weaknesses and shortcomings. To name a few: 1. You have to trust a third-party with safe-keeping your password. 2. Google and FaceBook are gatekeepers (via Google/Facebook Login) to apps we use everyday. 3. You have to remember multiple passwords. 4. Humans are not good at remembering good passwords.

    NullAuth is an authentication scheme which uses Public Key Cryptography to alleviate some of these problems. In the first phase, NullAuth with target apps with technically proficient users, and eventually we hope tooling will make it accessible to non-technical users as well. NullAuth is designed to be simple to understand and implement from scratch, and is based on existing, proven methods. The approach outlined here has been previously discussed on the internet, and the main intent is to turn those conversations into a formal spec.

    The name NullAuth was chosen to highlight not needing to store credentials on the server.

    Pre-requisites for using NullAuth to authenticate users

    Creating an account for a user

    • User creates an RSA key pair (or uses an existing one) locally
    • Saving the key pair is the user's responsibility. Eventually, we'll have tools for this.
    • Create a form that takes the username, public key and other details needed for creating the account
    • Server creates an account with the specified username and stores the public key against it

    Login

    • The login challenge text takes this form: "Login as (username@website) at (utcmilliseconds)" eg: Login as jeswin@example.com at 1513348513265
    • The domain (or website) must hash the above challenge with SHA2 and encrypt the hash with the domain's private key.
    • The challenge now looks like "Login as (username@website) at (utcmilliseconds);(encrypted sha2 hash)"
    • User signs challenge with private key and sends it to the server.
    • Server verifies the username, and if the utcmilliseconds is recent enough returns a session token.
    • The session token is used for subsequent access.

    Updating a public key

    • Just provide a UI to logged in users for submitting a new public key.

    Access Delegation (like OAuth)

    This addresses usecases currently handled by OAuth. Eg: User has an account on docs.example.com (aka provider domain), and some data stored there. User wants to allow another app publisher.example.com (aka consumer domain) to access (read and modify) his or her data on docs.example.com.

    • An access delegation challenge text takes the form: "Grant (comma-separated-permissions) of (username@provider-domain) to (consumer-domain) at (utcmilliseconds)" eg: Grant read,write,friends_list of jeswin@docs.example.com to publisher.example.com at 1513348513265
    • publisher.example.com must now hash the above message with SHA2 and encrypt it with a private key
    • The challenge now looks like "Grant (comma-separated-permissions) of (username@provider-domain) to (consumer-domain) at (utcmilliseconds);(encrypted sha2 hash)"
    • publisher.example.com requests the user to sign the above challenge
    • User signs the above message, and sends it to publisher.example.com
    • publisher.example.com sends signed message to docs.example.com and receives a token.
    • The token can be used to access data until an expiry decided by the provider app.
    • The url to be invoked to receive a token is left to the provider app. NullAuth does not mandate a specific url.

    Tools for End Users

    • In phase 1, we'll create CLI tools to benefit technically proficient users.
    • In Phase 2, we'll create browser extensions for non-technical users to try NullAuth.
    • In Phase 3, let's hope Android, iOS and Browsers can integrate NullAuth well enough that tooling is redundant.

    Tools and extensions should refuse to sign if the challenge's signature cannot be verified by the requesting domain's public key. Consider the following challenge: - Grant (comma-separated-permissions) of (username@provider-domain) to (consumer-domain) at (utcmilliseconds);(encrypted sha2 hash) If the consumer-domain's public key cannot verify the above challege, the tool should refuse to sign it.

    Notes: [1] - With input from dchestnykh in comments

    submitted by /u/jeswin
    [link] [comments]

    Can anyone recognize this hashing algorithm?

    Posted: 15 Dec 2017 10:58 AM PST

    I managed to retrieve a hashing algorithm used to checksum save files from a decompiled executable of a game.

    The code was originally spaghettified, but I managed to clean it up pretty well and ended up with this: https://hastebin.com/aqogodasup.cpp

    It returns an 8 digit hex string. I thought it might have been CRC-32 but it's not. Anyone have any ideas?

    submitted by /u/vim2meta
    [link] [comments]
    Read more
    at

    No comments:

    Post a Comment