The Advanced Encryption Standard (AES) is a symmetric-key encryption standard adopted by the U.S. government. The standard comprises three block ciphers, AES-128, AES-192 and AES-256, adopted from a larger collection originally published as Rijndael.
6
votes
1answer
293 views
Android and AES side channel attacks
I am working on a project that will involve symmetric AES 128 bit encrypted communication between an Android application and a bluetooth device. Are there any public AES libraries available for ...
0
votes
1answer
141 views
Password protection of encryption and signature keys
I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code)
The basic ...
6
votes
1answer
586 views
WPA2 Enterprise AES encryption key size?
I have recently set up a RADIUS server with EAP for my wireless router, however, I have some questions about the key size and how WPA2 enterprise (AES) works in general.
I have read that in ...
1
vote
4answers
171 views
RSA and encrypted authentication
Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication ...
2
votes
1answer
109 views
Design of Initialisation Vector
I understand that an IV (initialisation vector) should be both unique and unpredictable, but I have found little guidance as to which is most important.
For an AES cipher I have a block size of 128 ...
7
votes
3answers
294 views
AES using derived keys / IVs. Does it introduce a weakness?
I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application.
Obviously in order to re-use this key, a unique ...
3
votes
2answers
187 views
User authentication + database encryption with same password
I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
1
vote
1answer
199 views
Can I encrypt a file incrementally?
Is there any way to encrypt a file incrementally?
The problem is that I receive a file a chunk at a time via Internet (it's a client-server application and I send byte arrays via a WCF service) and I ...
12
votes
6answers
3k views
Is AES encrypting a password with itself more secure than SHA1?
This isn't really a practical question, but more a question of curiosity. I heard a CS professor recommend stepping up from md5ing passwords not to SHA1, but to AES encrypting the password using ...
-6
votes
2answers
739 views
Is AES slower to encrypt than MD5?
Is this the right interperation of this diagram:
http://www.cryptopp.com/benchmarks.html
AES/CCM
MiB/Second:61
Cycles Per Byte:28.6
MD5
MiB/Second:255
Cycles Per Byte:6.8
And does that ...
5
votes
1answer
800 views
When using AES and CBC, is it necessary to keep the IV secret?
If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key?
...
9
votes
3answers
703 views
How can I encrypt a file with .NET and have the same file size of the original file?
I'm using .NET and I've written an awesome routine (xD) that encrypts and decrypts a file using AES256 CBC. It works perfectly, but now they told me that the encrypted file must be of the same size of ...
5
votes
3answers
322 views
I don't see how “-salt” in the openssl command line tool enhances security at all
I do this to encrypt a single file:
openssl aes-256-cbc -a -salt -in file.txt -out file.enc
and then type in some regular plaintext password.
I do not understand how -salt enhances the security of ...
2
votes
2answers
781 views
Decryption on AES when the same key and IV are used
Let's say that I have three messages being encrypted by AES-128 with the same key and IV every time. Is it possible to decrypt the key being used? And more importantly, is it possible to decrypt the ...
2
votes
2answers
383 views
Is Aescrypt a valid tool for encryption or not?
I'd like to know if Aescrypt is a valid tool, or if for a very secure protection, the only choice is to use a software like gpg, or similar.
More I've another curiosity, if one doesn't want to use ...
3
votes
1answer
985 views
Using PBKDF2 with AES and SHA2
I use the following inputs to encrypt using AES:
UserPassword (plain text)
SecretKey
RandomIV
I use the following inputs to encrypt using SHA512:
UserPassword (plain text)
RandomSalt
I'd ...
2
votes
3answers
597 views
User data encryption/decryption in a database (PHP)
I was wondering which is the best way to encrypt and decrypt user data in a database, to make it much more secure as it is possible?
I was reading about AES but I would like to know if is really the ...
5
votes
3answers
434 views
Does the endianness used with an encryption algorithm affect its security?
I'm implementing the AES block cipher, which reads/writes data in 16 byte blocks. The implementation I'm working with usually read data in the little endian format. But in my platform the endianness ...
2
votes
2answers
204 views
AES CBC over TCP - when is new IV needed
I am working on a project where two devices will be communicating with AES with CBC over TCP.
We already have a secure mechanism for sharing the encryption/decryption key.
I am not sure if we need to ...
2
votes
2answers
377 views
Should WPA2-AES be presumed insecure? (What is the “Hole196” vulnerability?)
I saw it mentioned in an answer here about firesheep, but I've never heard of it -- Should WPA2 be presumed insecure?
4
votes
1answer
417 views
AES Key Generation Strategy/Algorithm For Offline System
Let say I have several application that aren't connected to any network, and I have one requirement that says each application could produce a token from an input that other application could validate ...
9
votes
2answers
662 views
Does AES-192 provide better encryption than AES-256?
this wikipedia article describing AES says:
Related-key attacks can break AES-192 and AES-256 with complexities 2^176 and 2^99.5, respectively.
Does this mean that AES-256 is actually a weaker ...
6
votes
1answer
479 views
OpenSSL fails NIST AES-128-ECB test vectors?
I'm having trouble getting OpenSSL's ciphertext to match the NIST test vectors.
Example : in "ecb_e_m.txt" from http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip, the first test is (in hex) ...
3
votes
4answers
672 views
Asymmetric crypto: Decrypt own messages without having private key
I have built a messages system for my website. Users can send the admin messages which are stored in the DB after being AES-encrypted.
I think that using asymmetric crypto (RSA through openssl) ...
2
votes
1answer
947 views
Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]
Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
3
votes
3answers
1k views
TrueCrypt -vs- MacOS encrypted sparse image - equally secure? Other alternatives?
I'm currently trying to find my personal best solution for storing passwords and other sensible data. Recently I've used 1Password on iPhone and Mac but I'm not really satisfied with its predefined ...
1
vote
2answers
134 views
Protecting passphrases within an application
First off, I'm not very familiar with encryption best-practices.
My use-case is simple: I'm creating an application that will be reading encrypted documents and decrypting them dynamically to do some ...
2
votes
4answers
1k views
Is multiple encryption a good idea?
I know that many encryption algorithms, while secure, have vulnerabilities.
To reduce risks, would multiple encryption like this
Blowfish_CbC ( Rc2_OFB ( AES128_CBC (myfilecontent)))
be a good ...
1
vote
0answers
57 views
Using GPG or PGP for symmetric database encryption/decryption in c# [duplicate]
Possible Duplicate:
Using GPG or PGP for symmetric database encryption/decryption in c#
I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short ...
2
votes
1answer
413 views
Using GPG or PGP for symmetric database encryption/decryption in c#
I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short pieces of information, which need to be individually encrypted when a specific method is called.
I ...
2
votes
3answers
858 views
Securing AES 128 encrypted ZIPs against brute force attacks
How long would it take to brute force decrypt an AES 128 encrypted zip file if the password is 8 characters long in the range of A-Z, a-z, 1-9?
Does it make any difference if .NET's System.Random ...
0
votes
1answer
335 views
How secure is AES-128 for Zip files?
Say you have a cryptographically random 8 character long alphanumeric password (A-Z, a-z, 0-9) used to encrypt a ZIP file with AES-128.
Can this program:
...
4
votes
3answers
2k views
What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase?
I'm looking at two comprable pieces of software which need to encrypt data on disk using a passphrase. One uses PBKDF2 to generate the encryption key from a passphrase, while the other uses two rounds ...
1
vote
3answers
259 views
Is symmetric encryption vulnerable to known plaintext attack?
If Bob sends some plaintext to Alice for encryption before sending the ciphertext to Carol, can Bob deduce the key by comparing the plaintext and ciphertext assuming only Alice and Carol knows the key ...
6
votes
2answers
741 views
What are the variables of AES?
AES is a standard encryption routine that can be used consistently across multiple languages, assuming all the variables match up. My question is, what are the variables. I am aware of the following
...
1
vote
1answer
186 views
How to check for a key *and* store encrypted data?
I wish to create a system wherein I store encrypted data.
Users can access this data if they have the key. If they give a wrong key, they don't get access at all. If they give the right key, they get ...
5
votes
2answers
495 views
Authenticated Encryption vs. contained and encrypted checksum/hash?
So I read through http://en.wikipedia.org/wiki/Authenticated_encryption and http://www.cryptopp.com/wiki/Authenticated_Encryption and I don't seem to be following the concept.
From the simple ...
1
vote
1answer
229 views
Hybrid key management doing it wrong?
I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
5
votes
4answers
8k views
Encryption - should I be using RSA or AES?
My model is one where I have several clients which wish to speak with some (but not all) of the other clients.
All messages will be sent through a server.
Only the two clients communicating with ...
2
votes
1answer
541 views
static IV and random keys using aes-256-cbc
Are there any security risks in using a static IV if I generate a new random KEY for each set of data to encrypt?
If I understand correctly what the purpose of the IV is in Cipher-block chaining mode ...
1
vote
1answer
3k views
Is 4096 bit good enough to encrypt data?
I need to store encrypted information in a mysql table. I would like to use the AES algoritm but I don't know if 4096 is supported and if it is a good length to encrypt data like: credit card, email ...
4
votes
2answers
749 views
Incrementing Initialization vector by 1
Suppose that we do not generate initialization vectors randomly (using AES in CBC mode). Instead it is initially all zeroes and we increment it by 1 each time a message is encrypted. How can this ...
