The Advanced Encryption Standard (AES) is a symmetric-key encryption standard adopted by the U.S. government. The standard comprises three block ciphers, AES-128, AES-192 and AES-256, adopted from a larger collection originally published as Rijndael.

learn more… | top users | synonyms

2
votes
2answers
164 views

What can I do with private 128 bit AES Keys?

For my studies, I am required to do an investigation on a fictional criminal VMWare image. The image is suspected of participating in DDoS attacks and other illegal activities. On this PC TrueCrypt is ...
2
votes
2answers
96 views

How safe is Money Toolkit?

Money Toolkit is a smartphone app that can alert you to your balances and transactions across multiple accounts. I was reading their site and whether their practises are as secure as they claim to ...
2
votes
1answer
474 views

How safe is the new iOS Keychain that stores credit card numbers?

iOS7 includes iCloud Keychain which syncs your stored passwords across devices. Not only that but it also syncs credit card numbers. The only information I can find about encryption is that they are ...
2
votes
2answers
587 views

Login system using authenticated encryption without storing user password

I'm not a security expert, so I might be asking a silly question, but let me describe what I am thinking about. First, I know that a lot of web sites store hashed/encrypted passwords which could be ...
2
votes
1answer
2k views

Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]

Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
2
votes
0answers
67 views

HIPAA compliant blob storage architecture

There is a task to design a system to store sensitive data securely (should be HIPAA compliant in the future). It's just a draft - this will not be used in production in a foreseeable future. I have a ...
2
votes
0answers
62 views

Using GPG or PGP for symmetric database encryption/decryption in c# [duplicate]

Possible Duplicate: Using GPG or PGP for symmetric database encryption/decryption in c# I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short ...
1
vote
3answers
171 views

Is applying AES multiple times safer?

The KeePass security help page talks about preventing dictionary attacks To generate the final 256-bit key that is used for the block cipher, KeePass first hashes the user's password using ...
1
vote
2answers
972 views

How long would it take a single Processor with the AES-NI Instruction Set to bruteforce an AES Key?

I know that it seems like a stupid question - since it's note feasable to break AES without a quantum computer but I'm curious anyway. I read on wikipedia that the best known attack on AES-128 takes ...
1
vote
3answers
447 views

Is symmetric encryption vulnerable to known plaintext attack?

If Bob sends some plaintext to Alice for encryption before sending the ciphertext to Carol, can Bob deduce the key by comparing the plaintext and ciphertext assuming only Alice and Carol knows the key ...
1
vote
4answers
329 views

RSA and encrypted authentication

Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication ...
1
vote
2answers
165 views

Protecting passphrases within an application

First off, I'm not very familiar with encryption best-practices. My use-case is simple: I'm creating an application that will be reading encrypted documents and decrypting them dynamically to do some ...
1
vote
1answer
252 views

How to check for a key *and* store encrypted data?

I wish to create a system wherein I store encrypted data. Users can access this data if they have the key. If they give a wrong key, they don't get access at all. If they give the right key, they get ...
1
vote
2answers
108 views

Do I need to salt PBKDF2 when it's used for AES encryption

If I'm using PBKDF2 to stretch a password into a suitable key for use in encryption with AES, should I be using a random salt (for PBKDF2, not the AES IV)?
1
vote
1answer
164 views

Is there symmetric encryption like AES or Camelia with keys longer than 256 bits?

I am wondering if is there any (secure!) cipher like AES or Camelia with keys longer than 256 bits (and offering higher security than 256 bits). I have not found anything except ...
1
vote
2answers
1k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
1
vote
1answer
861 views

Can active attacks really decrypt a particular AES-256, CBC, PKCS#7 encrypted file?

I recently found out that active attacks are a threat against AES-256, CBC mode, padded with PKCS#7 (the CBC mode in particular. I should supposedly change to EAX to guard against these attacks). ...
1
vote
1answer
57 views

Why is GPG file encryption so much slower than other AES implementations?

Correct me if I'm wrong: When encrypting a file, GPG creates a one-off AES encryption key and encrypts that key using RSA. This is supposedly to take advantage of AES's superior performance when ...
1
vote
2answers
26 views

openssl aes 256 cbc strange bug

This is extremely strange but I have already tried this twice and am completely sure it is openSSL and not me doing the bug. I am encrypting the data 'Hygiene' with the password '*' (sorry can't tell ...
1
vote
2answers
61 views

Using SSL for a single request

I want to use distributed cluster configured like: xx.resource.server.com. xx - can be anything from aa to zz, most of the requests will be one time. I need the connection to be secure between client ...
1
vote
1answer
247 views

Questions towards my application that uses bouncy castle crypto

I am implementing an application using bouncy castle crypto API it uses AES-CBC to encrypt files and i have some questions regarding the development of my application. I dont want to use a static ...
1
vote
2answers
883 views

Questions to hybrid encryption. RSA with AES

I want to use a hybrid encryption in my application, so after reading a lot of lines I ended with this implemantation, please critizie it ;) (I want to stick to .Net) byte[] aesKey = ...
1
vote
1answer
520 views

How does Cipher Block Chaining relate to AES?

I was reading FIPS197 for a class (found here: http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf ) trying to find some sort of specific relation between CBC and AES. I guess my problem is ...
1
vote
3answers
209 views

Is Salt, IV and Key necessary when encrypting password in a database using AES? If so, how should they be used?

Imagine I have a website with user accounts. I want to authenticate users, so I need to know if the password they provide matches the one stored in my database. To protect the passwords from prying ...
1
vote
1answer
90 views

Sending Salts For Key Generation

I am working on a project that uses a combination of a web based framework (Django) and an installed app (Python) for the purpose of data entry/upload. I will have to send medical records over the web ...
1
vote
1answer
201 views

MySQL AES Encryption - Is it good idea to store 3rd Party Auth Tokens using AES Encryption?

I need some advice on MySQL AES Encryption. I'm developing an application which connects to various 3rd-Party APIs and retrieves the Access Tokens for the application users. These Access Tokens are ...
1
vote
2answers
68 views

Symmetric encryption involving load balancers - can't randomize key?

I'm working on encrypting a web application's cookie. Using symmetric AES/CBC, I encrypt the cookie data before writing it out, and then decrypt it when reading it back in - the standard stuff. The ...
1
vote
1answer
930 views

Weakness of AES OFB mode

I found these comments regarding AES OFB Mode "This mode is a slightly less common mode, quite similar to CFB above, but which should not be used as a stream cipher due to inherent weaknesses when the ...
1
vote
1answer
1k views

aes cfb 128 decryption /encryption problem between Erlang and PHP

Update 2 - it works Thanks to Tom Leek for his answer. The CFB mode of mycrypt for Rijndael uses a 8-bit feedback loop and not a feedback loop the length of the key/iv. You have to force it to use ...
1
vote
1answer
160 views

Need advice on Cryptography digital files project

I have to choose a topic for my end-of-year school project and I need some advice. I was thinking of implementing an online tutorial materials (digital files) project. I have been researching on ...
1
vote
1answer
192 views

Implementation review - Independent key, admin side and user side

The admin of the website needs to read user data. So, if the key is derived from the user pass, then the admin has to know the user pass, not exactly a good idea. The following encryption scheme was ...
1
vote
1answer
55 views

What is default mode for AES encryption [closed]

What will be the default mode for AES encryption if we don't use any specific mode like ECB, CBC, OFB, CTR, etc. and just carry out the encryption without specifying any AES encryption mode.
1
vote
0answers
106 views

An attacker got a few 128bit TrueCrypt keys from a RAM analysis. What can he do?

I'm trying to simulate a possible attack scenario for my studies. I've got a image, which has a encrypted disk, encrypted by TrueCrypt (confirmed). TrueCrypt is installed on the image itself too. ...
1
vote
0answers
43 views

P2P sharing of uniquely encrypted files

I need a way to share large, uniquely encrypted files (AES256) that are actually the same file when decrypted, through P2P, to optimize download speeds. For instance, a centralized server would ...
1
vote
1answer
64 views

File encryption for a storage API

I'm implementing a Dropbox-like API, and one of my requirements is to have the files stored encrypted on the server. It is not required that the files are made unreadable by the server, only that they ...
1
vote
2answers
101 views

How to treat/hash ECDH shared secret to use as keys for AES?

I'm doing some studies/development for a security system that would use ECDH with ephemeral keys. In my code I'm currently using a 256-bit EC, so when the two parts compute the shared secret, I get a ...
1
vote
1answer
244 views

Using Apple NSKeyedArchiver class without encryption to save score data locally

first of all I'm sorry for my bad English! I have a question about the security of NSKeyedArchiver, a subclass of NSCoder of Apple Foundation.framework ...
1
vote
1answer
41 views

Storing encryption keys on a server using Node.js and MySQL

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for ...
1
vote
1answer
50 views

Need help designing an encryption workflow

Background: I'm building a .NET application, a very small part of this application allows for users to communicate with a third party application. I am designing this aspect. The third party simply ...
0
votes
2answers
3k views

Why does OpenSSL not include AES-256-GCM? [closed]

I'm trying to implement AES-256-GCM in Ruby. Ruby's OpenSSL wrapper library and aead library both clearly seem to believe that OpenSSL itself supports this. However, neither 0.9.8r (which I had ...
0
votes
4answers
215 views

Is knowing 'a' encrypted with 'b' and 'b' encrypted with 'a' a possible threat?

Excuse me for question name, but I couldn't find any other suitable title. I want to validate client connecting to the server. My algorithm looks like that: Clients sends his login - plaintext ...
0
votes
2answers
339 views

Can AES-256 encrypted data be changed?

I have a file that supposedly contains AES-256 encrypted data. The file was created using a proprietary program that claims to use AES-256. I have tested decrypting the file with an open source ...
0
votes
1answer
143 views

Which is the Best Cipher Mode and Padding Mode for AES Encryption? [closed]

As per PCI-DSS 3.4 requirement: For storing Credit Card Data Strong Cryptography should be used. I decided to use AES Encryption which is a strong and mostly recommended crypto for encrypting ...
0
votes
2answers
112 views

Have I crossed my t's and dotted my lower-case j's? (or, implementing AES, please help get some eyes on my code)

So, I used the crypto module in node.js to implement a secure key generator and encrypt/decrypt functions. Knowing that security's best friend is a spotlight on the implementation, I want to throw it ...
0
votes
1answer
197 views

Password protection of encryption and signature keys

I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code) The basic ...
0
votes
1answer
82 views

I get the feeling that Microsoft and Mac use two different forms of AES

I have an AES string being produced with this class, the AesCryptoServiceProvider Class provided by Microsoft. And I need to decode this encryption with Ruby's SSL::Cipher class . The problem is ...
0
votes
1answer
27 views

Are there limits (or, what are the limits) to our understanding of AES's resistance to known plaintext attacks?

Let's assume the same message is encrypted many times, each time with a different IV but the same key. Do we reach a point where just knowing what that message is gives us a plausible attack by which ...
0
votes
2answers
202 views

Security of several files all using same password/key (7zip, AES256)

I'm working on a simple secure mirror for potentially untrusted services like Dropbox, Owncloud and so on. (Current code may be seen here: http://www.codeduce.com/extra/secure_mercurial) Currently ...
0
votes
2answers
107 views

How is the key obtained when I login via VPN?

So, I configure my VPN (let say which uses PPTP protocol), enter the server name, username and password. Then, I visit a website. Before that, my request is encrypted using AES with some key. That ...
0
votes
1answer
85 views

What would be a valid approach to store private keys?

I'm implementing a mobile app which uses AES encryption algorithm to encrypt some critical values being sent to a remote server (basically, the user password), and then decrypted on the server side ...