Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

2
votes
1answer
48 views

Encryption of settings/credentials in mobile apps - what threats does this protect against?

I have been decompiling Android apps recently. In a sample of 37 apps, 12 of these use some form of custom encryption/obfuscation to store settings and credentials on the device. By necessity, the ...
60
votes
7answers
17k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
1
vote
1answer
61 views

Secure Software Architecture

I am designing a software architecture and i need some suggestion and clarification on few issues. This will be a server side RESTfull API for accessing data and multiple mobile/desktop client to ...
-2
votes
2answers
172 views

Cryptowall encryption files

This is a question concerning the way the Cryptowall ransomware encrypts files on the victim's computer. Someone knows if it is possible to recover the encryption key comparing the encrypted file and ...
1
vote
0answers
45 views

Is there anything to worry about — worth putting security on a simple test site?

So I want to make a site, this site won't have users (so no one but me will be able to post to the site) or anything it will just echo out items from Mysql like title and text-body I was wondering if ...
0
votes
2answers
61 views

Content on a usb flash drive available for a limited time [closed]

I need to distribute some content on a USB flash drive. This content should be available for a limited time only. I am looking for some approach to achieve above. So far I do not have information ...
12
votes
6answers
4k views

Is (safe) encryption over compromised line impossible?

I realize something like this would be the holy grail of communications security and have never heard anything to suggest it has been done. Am just wondering. A lot of mathematicians and computer ...
-3
votes
0answers
80 views

Ph.D in Netwok Security? [closed]

I'm already Cisco Network Support Engineer and cleared CCNA Exam . I wanna to start my PhD in network security. What kind of programming skills(Java,c++, Erlang) are required to gain before join PhD ...
3
votes
1answer
97 views

Securing administration network

We would like to secure our administration network from advanced persistant threats and also from rogue administrators. I have already read the best practices from SANS Institute, NSA or other guides. ...
4
votes
2answers
84 views

What encryption and signature systems (don't?) allow for plausible deniability of the OP's key being used?

I need to prevent Mallory from blindly matching encryption and signing keys to messages Hypothetical scenario: A user creates a public key An encrypted or signed payload exists. With only public ...
3
votes
2answers
52 views

Saving Authentication Tokens to Third-Party Websites

So Flickr allows you to authenticate users to your app via app_key and secret and returns an authentication token. I want to securely save that authentication token in my database, but also be able to ...
1
vote
2answers
102 views

Could I ever be legally required to decrpyt user information? [closed]

Suppose I host some web app which stores information about its users. In the interest of confidentiality, that information is stored in an encrypted format. Under what circumstances could a legal ...
1
vote
2answers
161 views

Why do I have to use multiple keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
3
votes
4answers
139 views

How safe is password based key derivation in the case of long password?

I am encrypting files inside a device and store it. So I need to maintain the same key throughout the life cycle of the device. For key derivation I use EVP_bytestokey() of OpenSSL. The problem in ...
0
votes
1answer
74 views

I need to transfer user's private key (RSA) to my App. Is file sharing a good solution?

I've asked a similar question here earlier iOS: Is it ok to store a RSA private key (use to decrypt text) in your application document directory? However, the person recommend me to use keychain ...
1
vote
1answer
36 views

Key derivation inside secure container of HSM

I have to implement custom key derivation function which basically works as follows: I have encryption key K in secure container of HSM. K can't be exported and the only way how to use it is through ...
3
votes
1answer
49 views

Cipher usage by end users and browsers

How do I check in apache logs as to what cipher end users / browsers are using ? Are there other tools to achieve the same to get a result in percentage ? related link: How can I determine the ...
3
votes
1answer
92 views

Are there any passwords managers that use a second hidden encryption drive to hide passwords?

I've heard that encyption program, Truecrypt can create a hidden encrypted drive within an encrypted drive; and even if an attacker accesses the first encrypted drive he/she cannot prove the hidden ...
4
votes
1answer
136 views

Sending Encrypted Messages with Hybrid RSA, AES and HMAC SHA-256

Is this a Secure strategy for sending a large Encrypted Message using Hybrid RSA 2048, AES 256 and authenticated with HMAC SHA-256: Given the Alice already has Bob's RSA Public Key, Alice: ...
-3
votes
1answer
30 views

A collection of tests and demos for security headers and TLS configurations [closed]

There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/) I want to build a ...
3
votes
1answer
132 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
8
votes
1answer
98 views

How to make sure that the cryptographic hardware accelerator is being used in am335x?

I want to use the AES hardware accelerator in am335x. I was able to generate the cryptodev.ko and cryptosoft.ko drivers. From my application program I am making use of openssl apis in CBC mode, and I ...
3
votes
1answer
113 views

Can applying second cipher (including home brew) reduce security

I have asked a question regarding the benefits (if any) of the following scheme: AES(HomeBrew(plaintext)). There are many good answers for that, but many people say that it's theoretically possible ...
0
votes
1answer
200 views

Storing encrypted data for offline use

A user downloads a file from a server. I want to store that file locally on the user's machine so they can view offline. For protection, it should be encrypted while not being viewed. My theory is ...
10
votes
8answers
1k views

Double encryption with home brew algorithm

Everyone says that home brew encryption is not a good idea because one day the algorithm will be known to attacker which sounds reasonable. So that seems it's main problem, on the other hand known ...
0
votes
0answers
76 views

How can secure email be used while avoiding government attention?

Presumably all unencrypted email is available to federal agencies including IP addresses, header information, and email content (eg, through SMTP with or without SSL and TLS -- thunderbird has an ...
14
votes
2answers
2k views

How would I implement “Broadcast Encryption”?

I have a stream that I want to encrypt for broadcast to 10,000 subscribers. I know I should encrypt this data using a symmetric key; and also intend that this symmetric key will be rotated every 30 ...
4
votes
2answers
646 views

Are temporary files an issue when opening and editing an encrypted 7z file?

I am new to security and encryption. I want to store important information like passwords and pin codes so I don't forget them. So far I have been using LastPass but I would prefer a solution I ...
0
votes
1answer
79 views

Is this data encryption process secure?

I have created the following encryption process which I will be using to store CD keys inside my database. Before I use it, however, I need to make sure that this is as secure as possible. From what ...
9
votes
2answers
160 views

How secure is “Firefox Hello”?

The new "Firefox Hello" feature promises easy and safe video conversation. It is not nescessary to create an account, you simply share a link with your partner to start the conversation. The ...
22
votes
2answers
43k views

Security comparsion of 3DES and AES

Which one is more secure and least possible to be broken through cryptanalysis AES or 3DES (no matter performance)? I need to use encryption for my projects to store and secure sensitive information ...
2
votes
1answer
124 views

if a public key cannot decrypt the cipher text, then how can a private key?

I understand the "public" part of public key cryptography. Not the "private" part. For example, let's say our public key is %7 (modulo 7). And the message to be encrypted is 22. And we know that 22 ...
1
vote
1answer
68 views

Basic XOR cipher for longer messages

How much effective strength is the following adding to a basic 512 bit XOR cipher? Private Key = Key0 consists of 512 randomly generated bits. This key is never used to encrypt or decrypt anything. ...
1
vote
1answer
56 views

Are encryption algorithms designed to hinder parallelization?

Are things like large memory requirements and constantly mutable state typically added to encryption alogrithms to hinder the ability of attackers to try multiple candidate keys simultaneously? Also, ...
-1
votes
0answers
51 views

Is it ever acceptable to pluralize the word “encryption” to “encryptions”? [migrated]

I am trying to revise the grammar of someone who insists that the following sentence is correct In Cryptology, encryption is the process of encoding messages or information, and there are ...
3
votes
1answer
44 views

In postgres LDAP authentication, are passwords encrypted?

I am wondering if postgres LDAP login is secure? Would passwords be transmitted in clear text potentially if this is not set up properly?
14
votes
3answers
15k views

Is RedPhone a secure and secret way to communicate?

RedPhone provides end-to-end encryption for your calls, securing your conversations so that nobody can listen in. But really, how is the probability that a voice conversation is wiretapped still? ...
-1
votes
2answers
47 views

What are the advantages in using LUKS + hardware encryption on SSD?

I can't see what the advantages might be, but I think this would slow data transfer down while providing no extra protection. Am I right or am I overlooking something?
4
votes
2answers
232 views

Does adding a non-entropic part to a password makes it less secure?

Suppose I'm encrypting a file via AES using a password of my choice, or creating a TrueCrypt volume using a password and no keyfiles. Which of the following two passwords would be more secure: ...
1
vote
1answer
71 views

How to encrypt columns in a database and be able to easily change encryption key

I have several fields in a database table I would like to encrypt, but I would like to do it in a way that would allow me to easily change the encryption key every n months for security reasons. My ...
2
votes
1answer
65 views

multiple encryption layers and removing them in any order?

I was just thinking (through browsing the site) How possible is it to encrypt data, then encrypt it a 2nd time and then after encrypting it with a 2nd layer, remove the first layer leaving the second ...
1
vote
1answer
37 views

On Mac OSX using FileVault 2, are all user's files unencrypted if the current user has rights to login from cold boot up?

I am taking my Macbook into an Authorized Service Provider to run diagnostics on battery performance and my data is encrypted using FileVault 2. I am assuming the technician(s) will want the ability ...
3
votes
1answer
81 views

Decryption using GRUB and TPM

I'm trying to plan security routine for my new Linux install and few questions came up during searching for solution which meet my needs. Is it possible to use private key from TPM in GRUB to ...
1
vote
1answer
59 views

How to encrypt or store data so that only a pool of processes can share it on Windows?

I am writing an application T1 which is using SQLite database to store some sensitive data and i am trying to encrypt it securely. The issue i am facing is that i don't want my symmetric key to be ...
6
votes
1answer
76 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...
2
votes
1answer
92 views

Is it possible to do Public Private Key Encryption on a chip (hardware)?

Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely? The ultimate goal ...
2
votes
2answers
61 views

Clarification about IV in PBKDF2 to generate encryption key

I've realized that the following implementation isn't truly safe: $pb = pbkdf2('sha256', $_POST['pass'], "enc_salt", 100, 100); $d = openssl_decrypt ($data['container'],'aes-192-cbc', $pb, true, ...
5
votes
2answers
199 views

Files encryption for flash drive privacy/security

Looking to encrypt files on flash drive (for backup) just in case it gets stolen or lost. Don't want to install any extra software like TrueCrypt but instead just use what's already on most computers. ...
0
votes
2answers
114 views

What stopping someone from offering distributed and encrypted email? Just like Bitcoins

Basically Email service that is ran over a network, so it's not owned by any one entity. Everyone can use it and send email to someone else. All messages travel through a web of interconnected ...
4
votes
2answers
3k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...