Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

14
votes
3answers
6k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
6
votes
2answers
5k views

What is the difference between SSH and IPsec?

There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
36
votes
3answers
2k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
8
votes
2answers
12k views

sniffing/recording GSM 3G signals

Is it possible to sniff or record and process GSM 3G signals (from some reciever) given that there is no other signals interrupting etc (the most comfortable conditions) Update (with some supporting ...
2
votes
1answer
1k views

How do I securely store and retrieve a many-time use key?

I am performing some symmetric database encryption/decryption in .net. I am using a single 256 bit private key. (1) Where do I store this key when not in use? (2) How do I securely retrieve this ...
18
votes
3answers
914 views

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
2
votes
3answers
833 views

Are the encryptions “broken” with great computing power?

http://www.dwavesys.com/en/pressreleases.html#lm_2011 Lockheed Martin Corporation (NYSE: LMT) has entered into an agreement to purchase a quantum computing system from D-Wave Systems Inc. I'm ...
10
votes
2answers
2k views

Authenticated Encryption vs. contained and encrypted checksum/hash?

So I read through http://en.wikipedia.org/wiki/Authenticated_encryption and http://www.cryptopp.com/wiki/Authenticated_Encryption and I don't seem to be following the concept. From the simple ...
7
votes
2answers
6k views

How expensive is it to guess a 15 character password, and should I be worried?

I'm currently using AES encryption (at home) on GNU/Linux (one of LUKS AES-256 variants with xts) and on Windows 7 (Truecrypt) with a 15 characters password (alphanumeric lowercase only plus _). ...
4
votes
3answers
14k views

Chrome showing cryptography as 'obsolete'

Similar to this question, Chrome is showing the connection cryptography as obsolete. Opera, IE and Firefox seem perfectly fine with the connection. My guess would be the message authentication is ...
2
votes
1answer
686 views

In PSK TLS, how is the key used for encryption derived?

I'm trying to decrypt a message sent over a secure communication channel using TLS_PSK_WITH_3DES_EDE_CBC_SHA. I now have the client random number, server random number, PSK identity and PSK value. My ...
16
votes
3answers
2k views

What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms?

Why can SHA-1 be considered a secure hash function? That's something I still wonder about. I understand the concepts of why modern asymmetric algorithms are deemed to be secure. They are founded on ...
1
vote
2answers
749 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
3
votes
3answers
408 views

Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?

OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure. But basically, ...
2
votes
2answers
11k views

What are private key cryptography and public key cryptography, and where are they useful?

I don't understand the real world usage scenarios of these cryptography methods. Can any one please explain how they work, with examples and also their usage in the real world?
1
vote
3answers
594 views

Is applying AES multiple times safer?

The KeePass security help page talks about preventing dictionary attacks To generate the final 256-bit key that is used for the block cipher, KeePass first hashes the user's password using ...
-2
votes
1answer
1k views

Cascading Encryption Algorithm using mcrypt or GnuGP

I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
23
votes
2answers
8k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
27
votes
3answers
5k views

Why can a Tor exit node decrypt data, but not the entry node?

Me -> Node A -> Node B -> Node C -> destination The documentation on Tor always states that only the exit node C can see plain text data. How is this possible without me talking to Node C ...
18
votes
8answers
24k views

Which Instant Messaging services use or allow secure protocols, and what do those protocols cover?

We all know there's a myriad of Instant Messaging (IM) services out there. But, which of these services uses or permits protocols that actually secure your communications? For those that do, what ...
15
votes
5answers
2k views

Securing a laptop against attacks (article)

I came across this article when looking for ways of hardening my laptop, and this guide seemed extremely thorough. It is perhaps overly paranoid, but it will be good to have a guide I can trust should ...
55
votes
6answers
44k views

Can my IT department read my Google Hangouts chats while at work?

Is Google hangouts encrypted? Would my work's IT guys be able see pictures and text I send while on a work computer? Yes I know I shouldn't be sending stuff I don't want them to see while at work, but ...
23
votes
6answers
2k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
27
votes
3answers
16k views

Which SSL/TLS ciphers can be considered secure?

The OpenSSL website provides a long list of different ciphers available for SSL and TLS. My question is, which of those ciphers can be considered secure nowadays. I am especially interested in HTTPS, ...
20
votes
3answers
4k views

In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?

It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...
5
votes
4answers
2k views

How to roll my own security mechanism - avoid SSL

I'm looking at implementing my own security mechanism rather than using SSL due to SSL being 'hopelessly broken' and also because it is an interesting exercise :) This is for a client-server internet ...
16
votes
2answers
7k views

When using AES and CBC, is it necessary to keep the IV secret?

If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key? ...
12
votes
2answers
1k views

Timing attack against HMAC in authenticated encryption?

In an answer to another question of mine, it was noted that a class using standard string comparison functions when checking the HMAC in authenticated encryption would make the class vulnerable to ...
13
votes
3answers
4k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
5
votes
2answers
996 views

In a browser web server communication, who decides which encryption protocol to use [duplicate]

My IE browser has SSLv3.0, TLS 1.0,1.1 and 1.2 enabled in the advanced settings. And (I was informed by my server admin) my web server can encrypt data in SSLv3.0 and TLS 1.0 Now which system ...
16
votes
6answers
2k views

How can the impact of cold boot attacks be minimized?

Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
15
votes
3answers
1k views

How secure is aSSL (javascript)? Does it effectively mimic SSL?

Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
15
votes
5answers
1k views

How should passwords be stored if they must be recoverable?

By "encrypting" passwords you are violating CWE-257: Storing Passwords in a Recoverable Format. But this is exactly what the French government wants. They want to be able to obtain the passwords of ...
12
votes
5answers
18k views

Can Skype chat be protected from snooping? Are there safe alternatives?

I use Skype a lot. With all of my clients, staff, contractors and friends, however, the acquisition by Microsoft worries me, as two of my clients are direct MS competitors, and I often work on long ...
10
votes
3answers
9k views

When is it appropriate to SSL Encrypt Database connections?

Let's say I have a web server I setup, and then a database server. However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right? The only time to use ...
9
votes
3answers
2k views

Encrypting user data using password and forgot my password

I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database. ...
8
votes
3answers
305 views

Securing an E-commerce site

I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site. I'm confused as to what the critical ...
7
votes
1answer
7k views

Will double encryption increase the security of cipher vs bruteforce?

Assume I have a function encrypt(mes,key) where mes is the message, and key is the key. The length of key is 64 bits. Last but not least: assume the only way to crack my cipher is a brute-force ...
16
votes
2answers
1k views

Encryption and the “security time decay” of prior encrypted data

This question is on the assumption that any data once encrypted, may (eventually) be decrypted through Brute force (compute power/time) Exploits in the cryptography used Theft of private keys ...
14
votes
2answers
2k views

How would I implement “Broadcast Encryption”?

I have a stream that I want to encrypt for broadcast to 10,000 subscribers. I know I should encrypt this data using a symmetric key; and also intend that this symmetric key will be rotated every 30 ...
13
votes
7answers
24k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
9
votes
5answers
4k views

How can one secure a password/key in source code [duplicate]

If there is a need for source code to have a password in it, how should this be secured? This is purely an example, but say there is an app that is using an API, and you don't want to expose ...
4
votes
2answers
254 views

Is the same decryption key used for data on the server as locally with Lastpass?

Lastpass stores the password databases encrypted on the server. Does it give a database to anyone who asks? If no, then what authentication (i.e. password) is used? I use Lastpass on multiple devices ...
3
votes
1answer
2k views

Is hardware based disk encryption more secure that software based?

As a spin-off of my question on "Advice on buying an encrypted disk" -- and in an effort to address the question "how is hardware based disk encryption better?" -- I've started a new question. My ...
13
votes
3answers
574 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...
11
votes
2answers
1k views

How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?

http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data http://rt.com/news/uk-privacy-internet-freedom-186/ 'Black boxes' will be installed by internet services providers ...
7
votes
2answers
2k views

MAC vs Encryption

I understand the difference between MAC (eg. hmac_sha256, etc.) and Symmetrical Encryption (eg. rc4, etc.), but my question is what advantage does MAC solve that using encryption doesn't? I know that ...
7
votes
4answers
2k views

How effective is iPhone 3GS and 4 device-at-rest encryption?

My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device. In that context how effective is iPhone 3GS and 4 encryption?
6
votes
5answers
2k views

What's the State of the Art of Homomorphic Encryption?

I get the impression from some internet resources I have skimmed that homomorphic encryption is yet computationally very inefficient. However, an Infineon press release from 2010 says that the CPUs of ...
5
votes
1answer
3k views

Security of bcrypt/sha256 key used with AES to encrypt a file

I'm looking to encrypt files using secure hashing and encryption algorithms in Python. Having used bcrypt in the past, I decided to use it for my passphrase calculator, then pass the output through ...