Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
22
votes
2answers
1k views
Why can a TOR exit node decrypt data, but not the entry node?
Me -> Node A -> Node B -> Node C -> destination
The documentation on TOR always states that only the exit node C can see plain text data. How is this possible without me talking to Node C ...
5
votes
2answers
114 views
Why standards organizations give so short protection times for 128 bit encryption?
According to this and this, seems even 128 bit encryption should remain secure for a much longer time than what security organizations say.
I saw the standards with this: ...
-7
votes
0answers
72 views
when do we need SSL/HTTPS? [duplicate]
I'm a newbie building an ecommerce site using Joomla. I know that it is advisable to have SSL for a payment page.
Do we also need to have SSL for log in, sign up and administration pages?
-3
votes
0answers
41 views
DB filesystem encryption [closed]
This is very common question everyone has but important. Is there any best tool which encrypts filesystem? Here my requirement is even if we log in to db we should see encrypted data only. It should ...
0
votes
0answers
29 views
How can I determine the encryption used by knowing input and result? [duplicate]
Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
-4
votes
1answer
92 views
the Informix password crack
I get some hash like:
username sowainformix
salt 7307821250330563328
hashed_password HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs
hash_type SHA-256
updated
flags ...
-1
votes
0answers
47 views
Is powerline encryption safe? [duplicate]
Most of the discussion about powerline ethernet security revolves around leakage of signal to neighbors, etc., and the recommendation is to enable encryption, which most of these devices have.
I'm ...
-3
votes
1answer
94 views
Which is more secure, AES or Rijndael? [closed]
Which algorithm is generally considered to be more secure, and is AES-192/AES-256 still considered to be secure?
After reading this it's lead me to belive that the Rijndael algorithm would be a more ...
-1
votes
0answers
35 views
third party security certification? [closed]
What is the correct way (best practices) to audit and certify an app's encryption? Are there companies that give out this type of certification? How does one go about doing this?
thanks,
-GK
3
votes
3answers
74 views
Storing config securely in a semi trusted shared hosting environment
I'm looking for a pattern to store a config file containing sensitive information in a semi trusted hosting environment. Semi trusted in this case meaning I trust them in general, but not with this ...
8
votes
3answers
259 views
Reason for writing Self-Decrypting Virus
What is the rationale behind writing a self-decrypting virus? By this I mean a virus that has it's payload encrypted, decrypts at runtime and runs it.
How does this protect the virus from antivirus ...
-9
votes
0answers
59 views
Close the virtual machine (vmware) customer [closed]
It is possible to close the virtual machine (vmware) on this machine where it is installed, and leave the remote access only certain IP ?
-1
votes
0answers
70 views
AES 256 decryption where passphrase is a file [closed]
I got an assignment to decrypt a binary file which is encrypted using aes. I have 32 byte binary file which is a key for decryption. I know how to decrypt if the key is a passphrase by using
...
2
votes
1answer
70 views
AES in CTR mode with same random IV to create same ciphertext
I am currently working on a little project.
I am trying to generate an AES key with that I would like to encrypt a private RSA key. I have to do it this way. However, I do not want to save the AES ...
-1
votes
0answers
36 views
how to open encrypted folder [migrated]
I have an encrypted directory using Windows XP Encryption. I didn't backup the certificate and I formatted my HDD to reloaded the OS as it was corrupt. I am now not able to access the encrypted ...
-5
votes
2answers
105 views
Is it possible to encrypt a virtual machine using virtualbox? [closed]
Is it possible to encrypt a virtual machine using virtualbox, and not leave accessible to the users of the machine where it hosted, and not allow any file to be extracted it with some program ?
The ...
2
votes
2answers
152 views
Decrypt from cipher text encrypted using RSA
I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is
Public Key:
...
1
vote
0answers
44 views
What parts of Bouncy Castle are affected by patents? [migrated]
Given that Bouncy Castle is an Open Source project, it's entirely possible that the contents contains implementations protected by various patents.
Since it's possible for the patent holder to sue ...
4
votes
1answer
142 views
Known plaintext; What cipher is being used here? [closed]
plaintext: CANDY VERY CRANBERRY
ciphertext: TXOtWjYhVk 8&O$4AmSA
plaintext: http
ciphertext: cZf.
plaintext: http
ciphertext: r5Hz
This is definitely somehow decodable from ...
0
votes
0answers
19 views
Why this k parameter is in unary in adversary PPT algorithm? [migrated]
While reading some text on cryptography, I found that algorithm A, that the adversary (called Eve by convention) runs to break the cipher message, needs two parameters, candidate message (y) and ...
3
votes
1answer
63 views
What is the difference between Key Escrow and a Recovery Agent?
From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later.
But in the context of PKI, a Recovery Agent can also recover private keys.
How ...
15
votes
2answers
397 views
Homomorphic encryption used for e-voting?
I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused:
"The homomorphic property of various cryptosystems can be used to
create secure voting systems, ..."
...
7
votes
2answers
1k views
Data Encryption and Key Management in C#
Which route to take, what are the pros and cons, which is more secure..
Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
16
votes
6answers
1k views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
3
votes
0answers
237 views
MPPE-Send and Receive key derivation from MS-CHAPv2
I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
2
votes
1answer
146 views
Does SQL Server CE 4 decrypt data securely?
I am going to store data in an encrypted SQL Server CE 4 database, where the database is doing the encryption. (Note that SQL CE is the embedded version, not the fully installed server.)
When the ...
-1
votes
3answers
133 views
Salting in encryption (rather than hashing)
I am aware of the benefits of adding a salt to values that are hashed using a one-way function. Is adding a salt to a value that is being encrypted (using symmetric encryption) considered to be good ...
2
votes
2answers
932 views
How to set up a user-friendly NAS encryption?
We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
21
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
41
votes
1answer
8k views
What is the difference between https://google.com and https://encrypted.google.com?
Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)?
In terms of security what were the ...
2
votes
1answer
102 views
Making undeterminable containers inside existing file system
Suppose, I have 1 disk partition (previously filled with random data) and create some file system on it (NTFS, FAT, EXT2, etc). I am going to keep some files here (i.e. visible files).
Then i create ...
-2
votes
1answer
200 views
Cascading Encryption Algorithm using mcrypt or GnuGP
I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
1
vote
1answer
100 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
5
votes
2answers
409 views
Is this Data Encryption/Storage Method Secure?
Let me first say that I know it is a bad idea to store sensitive information in a mysql database, so please don't respond by saying "DON'T DO IT" or something to that effect. I am building a website ...
4
votes
1answer
205 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
3
votes
2answers
143 views
Sharing encrypted data
I have a web app that is storing information related to a organization that I would like to encrypt but share amongst organization members. I would only like the members of the organization to be able ...
5
votes
4answers
263 views
Do honeywords add any real security?
This paper proposes the concept of honeywords for detecting if a password database has been compromised.
As far as I understand it works like this:
You save n password hashes for each user, one that ...
0
votes
1answer
177 views
Do the Owncloud clients use encryption when transferring files to and from the server?
Do the Owncloud clients use encryption when transferring files to and from the server?
I understand that files are stored un-encrypted on the server, but I’m wondering if they are secured during ...
9
votes
2answers
396 views
Are phone calls on a GSM network encrypted?
When I make a call on my cellphone (on a GSM network), is it encrypted?
2
votes
2answers
100 views
Why would encrypting data result in a call to a Domain Controller
This KB article mentions an issue where signing or encrypting information may result in a network IO call to a Domain Controller.
Apparently the RSACryptoServiceProvider's SignData and VerifyData ...
3
votes
1answer
153 views
Confidentiality without Encryption - A way to circumvent Internet censorship
Nowadays we see that countries like China and Iran detect and block all encrypted connections as a way to prevent their citizens from communicating over the Internet freely. Although encryption ...
5
votes
1answer
116 views
Database encryption or filesystem encryption?
Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
4
votes
1answer
100 views
How to interpret specific NIST 800-57 cryptoperiod advice?
We are uncertain how to interpret a specific piece of NIST 800-57 - to wit, how long a symmetric key cryptoperiod should be when originator usage and recipient usage begin concurrently. The short ...
-1
votes
1answer
183 views
What is a man in the middle attack?
My university provided me with the following slide which is confusing me:
From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then ...
3
votes
1answer
150 views
Security of Javascript in mobile browsers
Is Javascript on a mobile browser more secure than Javascript on other types of systems? For instance, if I have a site that includes some client-side (Javascript) encryption code, with the intention ...
0
votes
1answer
114 views
Can anyone determine what kind of encryption this is? [closed]
Here are some examples of the encryption:
J01A062YLMP1
J01A06OEPMP1
J08A07GSVMP1
J08A0625YMP1
K01A06IE2MP1
K01A06GRKMP1
W08A06ZTYMP1
I know the first letter corresponds to a brand, the last 3 ...
20
votes
9answers
3k views
Do secure phone lines exist?
I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure .
I know that Skype and other VOIP service providers have to ...
3
votes
1answer
88 views
Windows Phone and Hardcoding Values
Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows ...
2
votes
1answer
75 views
How to Verify the Identity of the Caller of a Web Service
I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.
Now, my question is, how do I ...
2
votes
1answer
97 views
Is an encrypted connection to MS-SQL Server really safe?
Quick intro: Small company, VERY limited resources. I pretty much do everything including coffe. I am a programmer, not a security guy. That's why i ask you...
We have an MS-SQL 2008 Database ...
