Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

1
vote
1answer
83 views

Can zip files be cracked if they were split into parts and only one part was available?

I am talking here about zip files that were compressed using basic protection and those using AES protection. In both cases, if only one of the many parts of the zip were available, will it be able to ...
1
vote
2answers
118 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...
1
vote
1answer
81 views

HIPAA vs. HTTPS

In the medical/pharmaceutical space as part of legal operating requirements, everyone has to comply with HIPAA standards ( http://health.state.tn.us/hipaa/ ) for moving personal medical information ...
1
vote
1answer
63 views

How strong is the performance impact of signing when using RSA_AES_256_ECDH

To encrypt web communication, I use SSL with a RSA key with a length of 2048 bit, AES key's with a length of 256 bit and the ECDH-algorithm for the negotiation of the AES key's (or to exchange the ...
2
votes
1answer
123 views

Why do major sites(Facebook, Google, etc) still send passwords unhashed? [duplicate]

QUICK SUMMARY: It seems like modern websites, for security's sake, should all have the client hash their own passwords before sending them to the server, who will rehash them, in order to avoid ...
1
vote
0answers
64 views

How to implement secure client-server communication over https using python and m2crypto? [migrated]

I want to secure the communication between a server and multiple clients. The communication goes this way: The client connects to a specific page at the server and checks for a software version. ...
0
votes
0answers
14 views

Storing user password in Keystore [migrated]

I am working on an application in which I would like to create a keystore with a master password and store user passwords after hashing inside it. Is it possible to do so? I am working in Java, so I ...
0
votes
0answers
17 views

Difference between Kerberos and GDOI?

What is the difference between Kerberos and GDOI, I know first is more toward authentication and latter is more toward multicast key management, can I use Kerberose protocol in GDOI for server and ...
4
votes
1answer
46 views

Securing client-side data from users

So my problem, in its general form, is encrypting test questions such that a client-side testing application can access the questions while students cannot. The naive approach, in my opinion, is to ...
0
votes
0answers
19 views

KeePassX and Dropbox [duplicate]

I am currently using KeePassX on Linux to allow me to have a different strong password for each website. With this program there comes two major inconveniences: I lose access to everything in the case ...
2
votes
3answers
141 views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
1
vote
0answers
20 views

CCM instead of key wrap

Is there any instance of NIST or other encryption standards using AES-CCM to encrypt/authenticate key data? I would like to use CCM over a keywrap function, but cannot find any precedent for this in ...
1
vote
0answers
28 views

Spring-MVC : Encryption/Decryption with user password [migrated]

I am working on a Spring-MVC application which uses Hibernate as the ORM and PostgreSQL as the database, in which I am looking for on-the-fly encryption decryption solution, but only for 2 columns in ...
0
votes
1answer
89 views

Secure way to encrypt (not hash) passwords?

I'm building a system that for reasons I'll outline below, can't used hashed passwords, but I'd still like to encrypt them so that it's as hard as possible to crack them, in the (unlikely) event the ...
3
votes
2answers
312 views

Can this modified 'Many' Time Pad be made 'stronger' by using an extrememly long key?

Starting with a one time pad say you want to encrypt some small strings like the words in this sentence but you want to reuse the same OTP key for each string so that when you encounter the same word ...
0
votes
1answer
57 views

Why first kerberos message is not ciphered

When analysing Kerberos exchange (and other similars as Needham, Denning, etc.) I wonder why the first message where the identities of the client and remote are not encrypted. In case not encrypted I ...
-1
votes
1answer
41 views

Do we need to same PGP version for decryption [closed]

Requirement: In our company Location A uses PGP encryption and sending data over internet. In Location B, we have to decrypt the file. Question is what do we require in Location B Do we need to ...
1
vote
1answer
56 views

Retrieve anonymous credentials

Background A registration process to acquire an anonymous, verified account goes like this: Registrant provides proof of individuality to a Registrar. Registrar verifies proof, ensures no prior ...
0
votes
0answers
12 views

generating public/private credentials for MS Outlook email encryption [migrated]

An app running on a CentOS 7 web server needs to receive encrypted emails sent from users of MS Outlook. Can someone please provide explicit instructions as to how I can generate or procure all of ...
1
vote
1answer
47 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strenght ? (PBKDF2 as both ...
1
vote
0answers
76 views

Are there any known weaknesses with ElGamal algorithm? [migrated]

I am working on a messaging system and plan to use ElGamal asymmetric encryption to protect the message contents during storage and transmission. (This would be in addition to TLS used during ...
2
votes
3answers
130 views

Acceptably secure solution for users to log in with a short unique code only (no username)

I am creating a website whereby users are given an account by invitation only, and are sent a unique code by post. Users can then log in (at least the first time) by entering the code only. The goal ...
1
vote
0answers
18 views

How should an ISP approach Mutual Auth TLS for SMTP email? (Domain Auth Email)

I'm looking for an easy to deploy way to make email clients (MUAs) display my email messages in a secure manner. PGP and SMIME both do this today, but they are high touch, and require software or ...
15
votes
0answers
1k views

What is encrypted in this image? [migrated]

In the image above apparently has a hidden link?? I don't know how to do this (even if it may seem simple for some) however I don't believe it's anything malicious. It's a part of a puzzle, but ...
3
votes
1answer
96 views

How cryptographic hardware accelerator is secure?

I am using cryptographic hardware accelerator of am335x. As per documentation it unloads the cryptographic operations from the main CPU and hence increases the performance. But from the security point ...
3
votes
3answers
207 views

Calculate time taken to break AES key

A 256 bit AES key is required to be broken using the brute force method on a 2GHz computer. How long would it take to break the key in the best case and in the worst case situations? Assume that 1000 ...
4
votes
1answer
73 views

Do IVs need to be unpredictable?

I am encrypting a sequence of messages with AES/CTR. For each sequence, I generate a random initial IV, say IV(0). Define IV(i) = MD5(IV(i - 1)) for i = 1, ..., n. Then for each message m(i), I ...
2
votes
1answer
62 views

Is TLS enough to prevent eavesdropping? [duplicate]

Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?
-2
votes
1answer
37 views

Sanity check security scheme, is it secure? Is there cruft?

This article: Life in a post-database world: using crypto to avoid DB writes Prompted me to write this url-crypt Node.js module to convert a Secret into secure urlsafe base64 strings. Think of an ...
1
vote
0answers
41 views

Android 5 encryption

There's been lots of talk about the allegedly improved encryption in Android 5. Some questions about this: What is the maximum length for passphrases? (i.e. is it still limited to 16 characters?) ...
1
vote
0answers
26 views

authentication token not stored in DB

I am implementing a webserver and the guideline I am following suggests: - to create token by a Serializer that takes the IdUser, a symmetric key and an expiry date - provide it to the user but not ...
3
votes
1answer
224 views

SIM card - Cryptography

I would like to have general infos about crypto and commom SIM card in mobile phone(I know there may be different implementations, technos according to the operator...). Is crypto used only for ...
1
vote
0answers
26 views

How can i know my security level as “ SSL 256 bit encryption” [duplicate]

I am using openssl tool to create certificate self-signed certificate I have known that [2048 bit SSL] it is the length of the public key then what about [256 bit encryption] how can i know type of ...
1
vote
1answer
160 views

Perfectly secure Postfix MTA (SMTP) configuration

I want to secure my root server (further) service by service, starting with the SMTP service (Postfix MTA) as the most busy one. I the course of setting everything up, I read a lot about security and ...
-2
votes
1answer
58 views

Tell type of encryption if given both input and output strings [closed]

I have the string Thisisatest that is encoded as MDQ4MGFhMzRhYTNkYjM1OGIzN2NkZTJhYjZiNjUzMjY= and I am trying to find out what encryption is used here. I think that the encoded string is base64 ...
1
vote
2answers
50 views

Client side encryption with sustainability as a service

I only need 2 things. 1) The user to know that only him (not even then admins) can decrypt his data that rely on my server. He will always provide his key to decrypt data. 2) To be able to provide ...
1
vote
1answer
57 views

Why should I have my GPG key expire? [duplicate]

When creating a key pair using gpg it asks me for an expiration date: $ gpg --gen-key Please specify how long the key should be valid. 0 = key does not expire <n> = key expires ...
2
votes
1answer
64 views

Is it necessary to encrypt nonce in cryptographic communication?

Server and client have a pre-shared key K. Assuming that that pre-shared key is safe, so nobody other than server/client can encrypt/decrypt. Client sends a nonce N to server, server then sends back ...
1
vote
4answers
100 views

Which is more effective and 'secure': Compression+Encryption, or only Encryption?

This came up in an IRC discussion on freenode, and now I"m curious. The idea is that someone wants to determine whether or not encryption alone, or compression+encryption (with gpg/pgp being the ...
0
votes
0answers
68 views

Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?

From my understanding domain validation certificate are verified by receiving an email on some special email addresses on the domain (e.g. postmaster@example.com, admin@example.com) or by sending on ...
1
vote
0answers
65 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just ...
1
vote
0answers
54 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
2answers
77 views

Encrypting short data with RSA only?

I have a case where I need to create recovery accounts and I want to create them so that nobody knows the password to them until/unless necessary. Hence, I thought that I would do it using RSA - when ...
0
votes
0answers
70 views

Brute-forcing a RSA private key password vs. LUKS volume

I need to store various private keys for my clients. Given these options, what would be the least prone to brute force attacks: Encrypt the private keys using a separate RSA key (each user get its ...
0
votes
1answer
35 views

How are various softwares' files/information kept safe from me, the user. [closed]

I started making a simple user authentication program just for fun, and I realised I don't know how to keep safe the files that will store all the usernames and passwords. This got me thinking. What ...
1
vote
1answer
95 views

In PSK TLS, how is the key used for encryption derived?

I'm trying to decrypt a message sent over a secure communication channel using TLS_PSK_WITH_3DES_EDE_CBC_SHA. I now have the client random number, server random number, PSK identity and PSK value. My ...
2
votes
1answer
47 views

What does a FIPS validation certificate cover? Just software version or OS and hardware too?

As I understand it, if you want to be FIPS-compliant you have to use FIPS-certified components. My question is how different can your use of the component by from what's on the component's validation ...
1
vote
3answers
82 views

Mitigating the LUKS decryption key residing in RAM for FDE

I've come to find Full Disk Encryption to be a rather unsafe method of securing data as standardized tools are becoming available to just read out the encryption key from RAM, where the system needs ...
0
votes
2answers
108 views

Why use anything other than RSA for transmission encryption?

Being fairly new to the cryptography and data security space, I have sampled a few "Introduction to cryptography" sites/textbooks and they all seem to start in the same general way: This is a Caesar ...
26
votes
7answers
6k views

Can you say that since one time pad encryption is unbreakable, it is the best if used properly?

I'm currently reading about one time pad encryption, and I have a question. They say OTP encryption is unbreakable, and this can be proved mathematically. This is provided that the key used is truly ...