0
votes
1answer
33 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
0
votes
1answer
86 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
0
votes
1answer
51 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
0
votes
0answers
24 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
1
vote
2answers
131 views

Is cryptography possible without volatile memory?

AFAIK, our current disk encryption methods (dm-crypt) preserve the key (as well as decrypted data) in RAM while the computer is running with an implicit assumption that the memory is volatile and key ...
0
votes
3answers
77 views

Java AES encryption output length

I am trying to encrypt few database columns (string values) using Java AES algorithm. This is to protect certain sensitive data. For some users these data should decrypted. In Java AES encryption, if ...
2
votes
1answer
73 views

Stream/Block encryption using XOR and Hash function?

Could a hash function like sha1 or ripemd-160 be used for secure key generation in a stream/block cipher? Obviously a repeated key like "abc123abc123abc123" would be bad, and a one time key pad would ...
1
vote
1answer
173 views

Safety of TrueCrypt hidden volumes

According to the documentation a hidden volume stays hidden because it appears as free space. In TrueCrypt free space always has random data in it, however in the case of a hidden volume it's not ...
2
votes
1answer
95 views

How secure is Vigenere cipher for random data?

Traditional situation It is easy to crack a ciphertext encrypted by Vigenere cipher, if you know the plaintext is in a natural language like English. There are two methods to discover the key used to ...
1
vote
1answer
37 views

Knowing Input&Output, How to determine encode method and the passkey that was used in encoding?

I've looked on this site and on SE. but I couldn't get a handle on this. Is there a way to find what type of encoding (and/or encode key) is being used? For example, I am testing a web ...
3
votes
5answers
216 views

How does one know when a message is successfully decrypted? [duplicate]

How do people who decrypt encrypted messages know they have decrypted to the correct message? Do they just keep decrypting until the message is in English (or any other language), or is there a ...
1
vote
0answers
86 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
3answers
110 views

Decrypting Engima messages

Not really computer related, but I hope someone has the answer. How do people decode messages from an Enigma machine? I understand that if you knew the rotors, rotor positions, and plugboard the ...
4
votes
1answer
69 views

Recommended symmetric key usage period

Let's assume that there are two nodes A and B connected over a network. Both have a single pre-shared symmetric key (e.g., AES-128) and exchange messages. What is the recommended period, until the ...
1
vote
1answer
81 views

What is default mode for AES encryption [closed]

What will be the default mode for AES encryption if we don't use any specific mode like ECB, CBC, OFB, CTR, etc. and just carry out the encryption without specifying any AES encryption mode.
1
vote
2answers
109 views

How can I analyze password recovery tokens?

All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing ...
0
votes
1answer
103 views

Get PGP Private Key from RAM analysis RSAKeyFind

For an experiment, I'm trying to open a 2048-bit RSA encrypted mail on a image. Using this fresh image, I made a memory dump and analysed the dump for RSA keys. Now, several RSA keys have been ...
0
votes
2answers
78 views

What are some examples of a block cipher's versatility over a stream cipher?

I understand that a block cipher can be made to act like a stream cipher at the cost of "losing versatility" of the block cipher for the sake of performance. I don't understand what I'd be losing. ...
-1
votes
1answer
91 views

Current Encryption Algorithms? [closed]

What are some encryption algorithms that are currently in use by secure websites, by operating systems, or by Secure USB thumb drive manufacturers. I am trying to do research on differences in speed ...
1
vote
1answer
59 views

Need help designing an encryption workflow

Background: I'm building a .NET application, a very small part of this application allows for users to communicate with a third party application. I am designing this aspect. The third party simply ...
1
vote
0answers
43 views

Is it possible to produce incorrect Metadata?

There is an app on xposed installer called XPrivacy for android that let's you decide what information you want your device to give a specific app and for information you don't want to give it ...
2
votes
1answer
105 views

Is there a widely used protocol which builds on AES/GCM, and defines serialization formats of A, IV, C and T together?

note: Title edited to make the answer more useful to a wider audience I'm reading source code for encrypting files with AES GCM and see the following binary output. AdditionalAuthData IV ...
0
votes
2answers
94 views

If P=NP, what is still cryptographically secure? [duplicate]

I know, I know - "If P=NP" is a really large, high-impact assumption. But this is a hypothetical. I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
15
votes
3answers
463 views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
1
vote
3answers
219 views

How encryption/decryption works when one generate random key?

I am new to this and want to ask a basic question.Suppose I used my password (say "ABC123") to generate a key using PBKDF2 algorithm (or any such algorithm).For encrypting a file I'll input my ...
0
votes
1answer
74 views

Theoretical key encryption question

I have a question regarding encryption and message sending. There are 2 hosts, A and B with their own secret key kA and kB (assuming this is not PKI). It is known that when A wants to send a message ...
1
vote
1answer
63 views

Root certifcate from an CA company which can be encrpyted by SoftHSM

Does anybody know a CA company which allows me to put the bought CA certficate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)? Is it hard to work with the PKCS11 ...
0
votes
5answers
146 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
1answer
121 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
3
votes
1answer
58 views

Are there any fast Homomorphic Obfuscuation techniques available?

Assuming that cryptography falls into one of three areas: Awfully weak protocols and algorithms, that are trivial to break with a low amount of effort and resources Cryptographically strong ...
3
votes
1answer
44 views

Storing original length of encrypted message

Does storing the actual length of the message in metadata make an encrypted message more vulnerable to attack?
9
votes
1answer
183 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...
1
vote
1answer
1k views

How to Encrypt Credit Card number for storing it in sql server database according to PCI DSS Requirement?

According to PCI-DSS 3.4 Requirement: Render PAN unreadable anywhere it is stored by using the below methods: One-way hash Truncation Index tokens and pads Strong cryptography with associated ...
1
vote
1answer
154 views

Requiring 2 keys to access a content

I need to use an external service that can only be accessed by password. I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do. Considering this ...
-5
votes
1answer
130 views

What is the excellence of RSA vs my algorithm [closed]

I was wondering that what make RSA Asymmetric Cryptography Algorithm special. So I wrote a very simple algorithm that do the same work (Generate Public and Private Key) Now I want to ask you that What ...
-2
votes
2answers
167 views

Is AES feasible for secure hashing files? [closed]

There was already a similar topic "Why AES is not used for secure hashing, instead of SHA-x?", but it was not about files specifically, and I, personally, am not convinced by the answers in it. "AES ...
1
vote
3answers
115 views

How to guarantee privacy on files that I store

I want to create an Android app where users from an office (typical use) can upload scanned documents to the app backend service for later use. e.g. A lawyer want to upload a sentence ...
10
votes
2answers
450 views

Forward secrecy for kids

In the Scouts, it is popular to use secret codes to write messages (which are simple ciphers). I want to introduce Forward secrecy to the kids so they can use it with these ciphers. So, if the ...
0
votes
2answers
289 views

Google's usage of RC4

I was reading about Google's usage of RC4 and an answer on stackexchange website stated the following: I know Google uses RC4 for most of its services, and this is the reason one shouldn't keep ...
0
votes
4answers
122 views

How does an encryption key work? [closed]

I'm having trouble understanding how an encryption key works. for example: if the word was 'hello' its encrypted value could be 'GHSSDgsd2', what would happen to the encrypted value if the key was ...
0
votes
0answers
29 views

How does an encryption key work? [duplicate]

I'm having trouble understanding how an encryption key works. for example: if the word was 'hello' its encrypted value could be 'GHSSDgsd2', what would happen to the encrypted value if the key was ...
1
vote
1answer
86 views

How to generate Initalization Vectors correctly

I'm working on a project that splits large files into several encrypted fixed-size blocks (e.g. 4KiB). Those blocks shall be used to be stored persistently on a storage device. Blocks are encrypted ...
8
votes
3answers
836 views

Location to store an encryption key

I'm building a secure system which stores messages on a server in a Postgresql database. The messages are stored encrypted with PHP's openssl_encrypt() function with the AES-256-CBC method. At the ...
42
votes
3answers
2k views

What kinds of encryption are _not_ breakable via Quantum Computers?

There's the recent article NSA seeks to build quantum computer that could crack most types of encryption. Now I'm not surprised by the NSA trying anything1, but what slightly baffles me is the word ...
1
vote
2answers
180 views

How secure are the GPG/PGP keyservers?

Importing a GPG key with a KeyID or fingerprint seems to rely on keyservers. Doesn't this invite man-in-the-middle attacks, in which someone would alter the keys to allow them to decrypt the data? ...
0
votes
1answer
127 views

How can brute force scripts tell once they're found the correct key?

If you have a random block of data and you encrypt it with a key, how can a brute force script tell when it has found the correct key? Is it possible without some sort of reference to the original ...
1
vote
2answers
337 views

Is SSH secure and what are the recommended modes of operation?

Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH? It seems there has been very little discussion ...
0
votes
1answer
105 views

Any issues with this security design for cloud storage? Server doesn't even need to know password to log someone in

I've created an algorithm I think I'm going to use for a cloud storage service I'm developing- if there are no issues or vulnerabilities with it. It's this along with TLS and forward secrecy ...
1
vote
1answer
50 views

How to change TEA round count? [closed]

I cribbed the public domain TEA source from wikipedia ( http://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm ), looks like this - uint32_t v0=v[0], v1=v[1], sum=0, i; /* set up */ ...
0
votes
1answer
166 views

Encrypting content using same secret key as hash?

OK - I'm trying to design a system that can provide personalised/differentiated content at minimal expense to the server. One of the designs I'm currently exploring is where the request is somehow ...