Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

3
votes
1answer
237 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
1answer
292 views

Klein and PTW wep attack

I'm working on an implementation of Klein's wep attack. For that, I've set up a router with wep encryption and collected 50,000 unique IVs from it. I tried only calculating K[0], meaning - the first ...
0
votes
1answer
58 views

Impact of sharing the private key with a third party for snooping SSL traffic

I am trying to understand the impact of sharing the private key with a third party for snooping SSL traffic. Below are my thoughts, please correct and add if some more impacts are there: One clear ...
-3
votes
1answer
67 views

How to sell a new idea – “100% secure communication”, feedback wanted [closed]

I have thought of an idea (new product) to have 100% secure communication between 2 parties and would like your feedback/ideas on how to sell it. Oh, before you start that there is no such thing as ...
5
votes
1answer
3k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
1
vote
2answers
74 views

Building an anonymous network

Imagine you're building Facebook, except you don't want to reveal user identity for posts and comments. You still want to verify each user's organization. For example, if the user signs up with ...
3
votes
2answers
69 views

Saving Authentication Tokens to Third-Party Websites

So Flickr allows you to authenticate users to your app via app_key and secret and returns an authentication token. I want to securely save that authentication token in my database, but also be able to ...
2
votes
1answer
75 views

Communicate through gpg

I need to frequently communicate with a server in the manner do stuff related to x or send me info of x My thoughts are to directly put the task I want to be executed into the package I want to send, ...
1
vote
2answers
175 views

Why do I have to use multiple keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
2
votes
1answer
88 views

OpenVPN username and password authentication only - unsafe?

Is it safe to only use username and password (and server certificate) for OpenVPN connection authentication? Are username or password ever transmitted in plaintext to the OpenVPN server? I found a ...
3
votes
1answer
138 views

Are there any passwords managers that use a second hidden encryption drive to hide passwords?

I've heard that encyption program, Truecrypt can create a hidden encrypted drive within an encrypted drive; and even if an attacker accesses the first encrypted drive he/she cannot prove the hidden ...
3
votes
1answer
156 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
1
vote
1answer
225 views

Storing encrypted data for offline use

A user downloads a file from a server. I want to store that file locally on the user's machine so they can view offline. For protection, it should be encrypted while not being viewed. My theory is ...
11
votes
1answer
972 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
-2
votes
0answers
26 views

Any idea what type of encryption this is? [duplicate]

I can't seem to find out what this is, I am a newbie at this stuff. 81n5q574po4p977srqo89960000sp14n
0
votes
0answers
38 views

Why isn't a table used to solve the large number factoring problem? [migrated]

Lots of modern encryption (RSA comes to mind) are based on the fact that factoring large numbers is hard. However, multiplying large numbers is much easier, and table lookups are very easy. Since ...
11
votes
3answers
11k views

What is the DUKPT Key Derivation Function?

I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
5
votes
2answers
728 views

Are temporary files an issue when opening and editing an encrypted 7z file?

I am new to security and encryption. I want to store important information like passwords and pin codes so I don't forget them. So far I have been using LastPass but I would prefer a solution I ...
1
vote
1answer
65 views

Determining whether a local area network is encrypting information in transit

My computer is connected to a switch. Numerous other network devices are also connected to the (local) switch. Is there a simple way of determining whether the connection between my desktop and ...
2
votes
2answers
162 views

Is it possible to encode some data in a image and decode the data from hard copy?

I am working on a project which can encode some data in an Image and share it with other people by printing it out as hard copy. Now, other people can take a picture of the hard copy they got and ...
-2
votes
1answer
88 views

How would I encrypt something like this; [closed]

I want to encrypt some very important passwords in a text document or something like it. What would I use to ensure maximum security.
3
votes
0answers
43 views

GPG subkey layout. Separate keys for C, S and E?

I've been reading up a lot on GPG recently. This page describes how to setup so-called "laptop keys". The idea being that if you lose your laptop, or have it stolen, your primary certification key, ...
0
votes
0answers
32 views

Triple-DES DUKPT CBC PIN variant vs Data variant

Does any know the difference between triple des dukpt decryption algorithm with PIN variant and Data variant? I have done Triple DES DUKPT PIN variant, which generate session key from KSN and BDK. ...
-4
votes
1answer
41 views

How to find an encryption algorithm between two hexadecimal numbers? [closed]

I have several numbers that are generated by a server. They are 16 digits long and are hexadecimal. I have no idea whether or not any salting or hashing techniques were used. Can I find the encryption ...
0
votes
2answers
75 views

Encryption in case of distributed architecture

I have application infrastructure as follows - web client -> load balancer -> Apache (web server) -> Weblogic (application server). I could understand that in case of HTTPS request, SSL handshake ...
84
votes
11answers
21k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
0
votes
0answers
35 views

Performances of dm-crypt vs. ecryptfs

The only information I found about the difference of performance between dm-crypt (LUKS mode) and ecryptfs is that given that ecryptfs operates at filesystem-level, it may be slower when doing ...
-1
votes
0answers
44 views

How to ensure message integrity for ciphers created via RSA algorithm [migrated]

In order to send a message over an unsecured channel I have to first encrypt the data using the RSA algorithm. The implementation I use is the javax.crypto.Cipher in Java 7. I'm aware of chosen ...
252
votes
13answers
29k views

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
4
votes
2answers
1k views

Why is ECC more vulnerable than RSA in a post-quantum world?

Forgive me if this should be in the crypto sub, but sometimes the answers there are very mathematical and I would rather have an answer which is a bit lighter on the math but still strong on the tech ...
16
votes
5answers
3k views

The AES Crypt implementation hashes a password 8192 times to generate the key. Is this necessary?

I'm considering encrypting some small files (hundreds of kb apiece) using the AES Crypt reference implementation. Looking at the source, it seems that the encryption key is derived from the IV and the ...
2
votes
1answer
89 views

How to encrypt columns in a database and be able to easily change encryption key

I have several fields in a database table I would like to encrypt, but I would like to do it in a way that would allow me to easily change the encryption key every n months for security reasons. My ...
3
votes
3answers
77 views

Cipher used for request data encryption used by browser

Please note that this is not about how SSL communication happens between browser (I researched and understood it) and client but other aspects. Using Digicert's SSL mechanism explanation I have ...
1
vote
1answer
79 views

How to encrypt or store data so that only a pool of processes can share it on Windows?

I am writing an application T1 which is using SQLite database to store some sensitive data and i am trying to encrypt it securely. The issue i am facing is that i don't want my symmetric key to be ...
1
vote
2answers
176 views

Encrypt data stored in a database

I recently talked to a potential customer who wants to build up a database which contains fairly sensitive data. One of her key requirements is, that the data storeed will be encrypted in a way that ...
2
votes
1answer
121 views

Is it possible to do Public Private Key Encryption on a chip (hardware)?

Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely? The ultimate goal ...
5
votes
2answers
155 views

Are the GET values also encrypted/secured by SSL?

For example we submit a form on the following site: https://example.com (SSL Encrypted) Then the form is submitted as GET method, so it becomes like this: ...
2
votes
3answers
2k views

how long does it take to brute force varying encryption standards?

Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
0
votes
1answer
121 views

Does CryptoWall needs a internet connection to encrypt my files?

Does CryptoWall 3.0 use some resource on the internet to encrypt my files? I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about ...
0
votes
1answer
120 views

How safe is it if encrypted text is exposed?

I know that it is considered safe if both encryption algorithm and password are safely hidden. However, what if the attacker knows that there can only be a number of algorithms used. So how safe is it ...
2
votes
1answer
262 views

What are the risks of encrypting a database with a single symmetric key

An application is required to store sensitive data* on each user. Additional columns are added to the database which store cyphertext encrypted on the application server. The algorithm of choice is ...
1
vote
1answer
84 views

SQL Server Asymmetric Encryption Keys

I have used SQL Server database with data to be encrypted and I will use symmetric key for encryption and will encrypt it by asymmetric key now comes the question how to give user permission to ...
2
votes
1answer
114 views

Is it safe to use a 4-digit PIN for Android system encryption?

I just encrypted my Android phone using the default menu. I was asked for a PIN code (4 digits). Do you think this is a good practice? Is there a limited number of attempts at decrypting the ...
3
votes
2answers
423 views

Requiring 2 keys to access a content

I need to use an external service that can only be accessed by password. I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do. Considering this ...
4
votes
4answers
270 views

Can the FBI or government agencies decrypt my hardrive and/or force me to give them the password?

I have seen other TrueCrypt questions as well "Windows encryption with BitLocker" and "Mac OSX encryption with FileVault". Does the FBI/NSA or other government agencies have access to my data or can ...
0
votes
0answers
22 views

How to do secure file transfer on windows with AD?

I have a requirement to serve files from a windows 2008 (and up) server that will be part of an AD domain to client machines that will also be members of that same domain. The requirements are as ...
5
votes
2answers
114 views

Encrypting Data Without Sacrificing Query Performance

We're building a cloud web app backed by a multi-tenant db. To maximize security we plan to encrypt each customer's data with a separate key. The problem is querying. Say they're in the report ...
0
votes
0answers
11 views

Secret Sharing Encryption [migrated]

Suppose Alice shares a secret block cipher key , KAB with Bob, and a diff erent secret block cipher key , KAC with Charlie. Describe a method for Alice to encrypt an mblock message such that it can ...
-1
votes
1answer
61 views

How can I secure encryption keys in the code? [duplicate]

I have files on the server that is encrypted with AES. I am developing iOS and Android apps to decrypt and process those files in the phone or tablet. To decrypt files on the client apps, I have to ...
2
votes
2answers
147 views

Practical steps for encrypting an encryption key for data stored in MySQL

So I'm working on my first project where user data is stored as encrypted using the user's password as (part of) the key. I have read many similar things about best practices, but the details seems to ...