Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
1
vote
1answer
17 views
Storing config securely in a semi trusted shared hosting environment
I'm looking for a pattern to store a config file containing sensitive information in a semi trusted hosting environment. Semi trusted in this case meaning I trust them in general, but not with this ...
1
vote
0answers
44 views
What parts of Bouncy Castle are affected by patents? [migrated]
Given that Bouncy Castle is an Open Source project, it's entirely possible that the contents contains implementations protected by various patents.
Since it's possible for the patent holder to sue ...
68
votes
20answers
16k views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
3
votes
1answer
116 views
Known plaintext; What cipher is being used here? [closed]
plaintext: CANDY VERY CRANBERRY
ciphertext: TXOtWjYhVk 8&O$4AmSA
plaintext: http
ciphertext: cZf.
plaintext: http
ciphertext: r5Hz
This is definitely somehow decodable from ...
0
votes
0answers
19 views
Why this k parameter is in unary in adversary PPT algorithm? [migrated]
While reading some text on cryptography, I found that algorithm A, that the adversary (called Eve by convention) runs to break the cipher message, needs two parameters, candidate message (y) and ...
3
votes
1answer
48 views
What is the difference between Key Escrow and a Recovery Agent?
From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later.
But in the context of PKI, a Recovery Agent can also recover private keys.
How ...
15
votes
2answers
321 views
Homomorphic encryption used for e-voting?
I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused:
"The homomorphic property of various cryptosystems can be used to
create secure voting systems, ..."
...
7
votes
2answers
1k views
Data Encryption and Key Management in C#
Which route to take, what are the pros and cons, which is more secure..
Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
15
votes
6answers
796 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
3
votes
0answers
102 views
MPPE-Send and Receive key derivation from MS-CHAPv2
I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
2
votes
1answer
134 views
Does SQL Server CE 4 decrypt data securely?
I am going to store data in an encrypted SQL Server CE 4 database, where the database is doing the encryption. (Note that SQL CE is the embedded version, not the fully installed server.)
When the ...
-1
votes
3answers
121 views
Salting in encryption (rather than hashing)
I am aware of the benefits of adding a salt to values that are hashed using a one-way function. Is adding a salt to a value that is being encrypted (using symmetric encryption) considered to be good ...
2
votes
2answers
841 views
How to set up a user-friendly NAS encryption?
We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
20
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
41
votes
1answer
5k views
What is the difference between https://google.com and https://encrypted.google.com?
Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)?
In terms of security what were the ...
2
votes
1answer
84 views
Making undeterminable containers inside existing file system
Suppose, I have 1 disk partition (previously filled with random data) and create some file system on it (NTFS, FAT, EXT2, etc). I am going to keep some files here (i.e. visible files).
Then i create ...
-2
votes
1answer
180 views
Cascading Encryption Algorithm using mcrypt or GnuGP
I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
1
vote
1answer
98 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
5
votes
2answers
349 views
Is this Data Encryption/Storage Method Secure?
Let me first say that I know it is a bad idea to store sensitive information in a mysql database, so please don't respond by saying "DON'T DO IT" or something to that effect. I am building a website ...
4
votes
1answer
118 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
3
votes
2answers
138 views
Sharing encrypted data
I have a web app that is storing information related to a organization that I would like to encrypt but share amongst organization members. I would only like the members of the organization to be able ...
5
votes
4answers
247 views
Do honeywords add any real security?
This paper proposes the concept of honeywords for detecting if a password database has been compromised.
As far as I understand it works like this:
You save n password hashes for each user, one that ...
0
votes
1answer
67 views
Do the Owncloud clients use encryption when transferring files to and from the server?
Do the Owncloud clients use encryption when transferring files to and from the server?
I understand that files are stored un-encrypted on the server, but I’m wondering if they are secured during ...
8
votes
2answers
307 views
Are phone calls on a GSM network encrypted?
When I make a call on my cellphone (on a GSM network), is it encrypted?
2
votes
2answers
100 views
Why would encrypting data result in a call to a Domain Controller
This KB article mentions an issue where signing or encrypting information may result in a network IO call to a Domain Controller.
Apparently the RSACryptoServiceProvider's SignData and VerifyData ...
3
votes
1answer
149 views
Confidentiality without Encryption - A way to circumvent Internet censorship
Nowadays we see that countries like China and Iran detect and block all encrypted connections as a way to prevent their citizens from communicating over the Internet freely. Although encryption ...
5
votes
1answer
93 views
Database encryption or filesystem encryption?
Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
4
votes
1answer
83 views
How to interpret specific NIST 800-57 cryptoperiod advice?
We are uncertain how to interpret a specific piece of NIST 800-57 - to wit, how long a symmetric key cryptoperiod should be when originator usage and recipient usage begin concurrently. The short ...
-1
votes
1answer
172 views
What is a man in the middle attack?
My university provided me with the following slide which is confusing me:
From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then ...
3
votes
1answer
138 views
Security of Javascript in mobile browsers
Is Javascript on a mobile browser more secure than Javascript on other types of systems? For instance, if I have a site that includes some client-side (Javascript) encryption code, with the intention ...
0
votes
1answer
113 views
Can anyone determine what kind of encryption this is? [closed]
Here are some examples of the encryption:
J01A062YLMP1
J01A06OEPMP1
J08A07GSVMP1
J08A0625YMP1
K01A06IE2MP1
K01A06GRKMP1
W08A06ZTYMP1
I know the first letter corresponds to a brand, the last 3 ...
17
votes
9answers
3k views
Do secure phone lines exist?
I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure .
I know that Skype and other VOIP service providers have to ...
3
votes
1answer
82 views
Windows Phone and Hardcoding Values
Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows ...
2
votes
1answer
66 views
How to Verify the Identity of the Caller of a Web Service
I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.
Now, my question is, how do I ...
2
votes
1answer
82 views
Is an encrypted connection to MS-SQL Server really safe?
Quick intro: Small company, VERY limited resources. I pretty much do everything including coffe. I am a programmer, not a security guy. That's why i ask you...
We have an MS-SQL 2008 Database ...
1
vote
1answer
70 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
1
vote
1answer
64 views
Symmetric Key Cryptography vs Public Key Cryptography [duplicate]
I understand what the two are so need to go into detail about that, however what I'm curious about is in what kind of situations would we use one over the other? It feels to me as if Public Key ...
0
votes
1answer
64 views
Determine the Identity of Caller
Let me explain my situation.
I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
-7
votes
1answer
62 views
Asymmetric encryption algorithms [closed]
What are the best asymmetric encryption algorithms out there? I am trying to use RSA in my project howoever I have read that it is not quite secure as other asymmetric encryption algorithms.
2
votes
1answer
40 views
Sending Digital Certificates
I used the makecert tool in order to create:
a self-signed certificate
a server certificate using the self-signed certificate
a client certificate using the self-signed certificate
I then ...
6
votes
2answers
203 views
Is ECDSA breakable by quantum computers?
Is ECDSA secure from quantum computers? Will quantum computers be able to calculate it's private keys from the knowledge of the public key once there are working quantum computers?
3
votes
1answer
51 views
Clarification on Digital Certificates
I used the makecert tool to create:
self-signed certificate
client certificate
These are the commands I used:
makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
2
votes
1answer
62 views
Security Certificates - Tools to Generate Security Certificates
I want to create a self-signed certificate that will be installed as a trusted certificate authority.
I then want to create another two certificates which are signed using the private key of the ...
0
votes
0answers
19 views
Is the GTK or MIC in the unencrypted portion of a WPA protected frame?
In order to decrypt traffic you must have all 4 portions of the WPA Handshake. In WPA protected data frames, is there an unencrypted portion of that frame that has some sort of identifiable value to ...
0
votes
1answer
54 views
PCI 3.6.6 cryptographic key procedures include split knowledge
My question is, if you run your own company and there are no employees and you still qualify under assessment D what do you do in a case like this where it is requiring 2 or more people? On a related ...
1
vote
1answer
92 views
The request was aborted: Could not create SSL/TLS secure channel Exception
Let me explain my situation.
I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC.
I then created two certificates using the self-signed ...
1
vote
3answers
694 views
Why different key exhange techniques for ssl key exchange?
During ssl key exchange, I have read that sending the symmetric key to the server encrypted with the server's public key is an old technique. Now for key echange Diffie hellman and other techniques ...
2
votes
1answer
54 views
Authenticating a ciphertext
what can be considered as a downside of authenticating a ciphertext?
For example, can we say drawback of authenticating a ciphertext is that we lose
repudiation, for example, we can't prove to the ...
7
votes
3answers
420 views
Secure PXE network OS installation
How can one make sure that when PXE is being used to boot a remote operating system, that the data being sent is encrypted (or at the very least that integrity is maintained)?
Would it be possible to ...
3
votes
2answers
122 views
Are there any serious problems with this method for generating single-use tokens?
I need your advice on the security of this design.
I have a scenario whereby a server application and a smart card application need to share a value e.g. 52, which has been encoded in a long decimal ...
