Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
3
votes
3answers
74 views
Storing config securely in a semi trusted shared hosting environment
I'm looking for a pattern to store a config file containing sensitive information in a semi trusted hosting environment. Semi trusted in this case meaning I trust them in general, but not with this ...
1
vote
0answers
44 views
What parts of Bouncy Castle are affected by patents? [migrated]
Given that Bouncy Castle is an Open Source project, it's entirely possible that the contents contains implementations protected by various patents.
Since it's possible for the patent holder to sue ...
4
votes
1answer
143 views
Known plaintext; What cipher is being used here? [closed]
plaintext: CANDY VERY CRANBERRY
ciphertext: TXOtWjYhVk 8&O$4AmSA
plaintext: http
ciphertext: cZf.
plaintext: http
ciphertext: r5Hz
This is definitely somehow decodable from ...
0
votes
0answers
19 views
Why this k parameter is in unary in adversary PPT algorithm? [migrated]
While reading some text on cryptography, I found that algorithm A, that the adversary (called Eve by convention) runs to break the cipher message, needs two parameters, candidate message (y) and ...
3
votes
1answer
63 views
What is the difference between Key Escrow and a Recovery Agent?
From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later.
But in the context of PKI, a Recovery Agent can also recover private keys.
How ...
-1
votes
3answers
133 views
Salting in encryption (rather than hashing)
I am aware of the benefits of adding a salt to values that are hashed using a one-way function. Is adding a salt to a value that is being encrypted (using symmetric encryption) considered to be good ...
16
votes
6answers
1k views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
-2
votes
1answer
200 views
Cascading Encryption Algorithm using mcrypt or GnuGP
I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
21
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
2
votes
1answer
102 views
Making undeterminable containers inside existing file system
Suppose, I have 1 disk partition (previously filled with random data) and create some file system on it (NTFS, FAT, EXT2, etc). I am going to keep some files here (i.e. visible files).
Then i create ...
15
votes
2answers
399 views
Homomorphic encryption used for e-voting?
I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused:
"The homomorphic property of various cryptosystems can be used to
create secure voting systems, ..."
...
5
votes
2answers
409 views
Is this Data Encryption/Storage Method Secure?
Let me first say that I know it is a bad idea to store sensitive information in a mysql database, so please don't respond by saying "DON'T DO IT" or something to that effect. I am building a website ...
3
votes
0answers
237 views
MPPE-Send and Receive key derivation from MS-CHAPv2
I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
4
votes
1answer
208 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
5
votes
4answers
263 views
Do honeywords add any real security?
This paper proposes the concept of honeywords for detecting if a password database has been compromised.
As far as I understand it works like this:
You save n password hashes for each user, one that ...
0
votes
1answer
179 views
Do the Owncloud clients use encryption when transferring files to and from the server?
Do the Owncloud clients use encryption when transferring files to and from the server?
I understand that files are stored un-encrypted on the server, but I’m wondering if they are secured during ...
9
votes
2answers
398 views
Are phone calls on a GSM network encrypted?
When I make a call on my cellphone (on a GSM network), is it encrypted?
3
votes
1answer
153 views
Confidentiality without Encryption - A way to circumvent Internet censorship
Nowadays we see that countries like China and Iran detect and block all encrypted connections as a way to prevent their citizens from communicating over the Internet freely. Although encryption ...
5
votes
1answer
116 views
Database encryption or filesystem encryption?
Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
4
votes
1answer
100 views
How to interpret specific NIST 800-57 cryptoperiod advice?
We are uncertain how to interpret a specific piece of NIST 800-57 - to wit, how long a symmetric key cryptoperiod should be when originator usage and recipient usage begin concurrently. The short ...
0
votes
1answer
114 views
Can anyone determine what kind of encryption this is? [closed]
Here are some examples of the encryption:
J01A062YLMP1
J01A06OEPMP1
J08A07GSVMP1
J08A0625YMP1
K01A06IE2MP1
K01A06GRKMP1
W08A06ZTYMP1
I know the first letter corresponds to a brand, the last 3 ...
3
votes
1answer
150 views
Security of Javascript in mobile browsers
Is Javascript on a mobile browser more secure than Javascript on other types of systems? For instance, if I have a site that includes some client-side (Javascript) encryption code, with the intention ...
2
votes
1answer
76 views
How to Verify the Identity of the Caller of a Web Service
I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.
Now, my question is, how do I ...
3
votes
1answer
89 views
Windows Phone and Hardcoding Values
Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows ...
2
votes
1answer
98 views
Is an encrypted connection to MS-SQL Server really safe?
Quick intro: Small company, VERY limited resources. I pretty much do everything including coffe. I am a programmer, not a security guy. That's why i ask you...
We have an MS-SQL 2008 Database ...
1
vote
1answer
75 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
-1
votes
1answer
183 views
What is a man in the middle attack?
My university provided me with the following slide which is confusing me:
From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then ...
1
vote
1answer
75 views
Symmetric Key Cryptography vs Public Key Cryptography [duplicate]
I understand what the two are so need to go into detail about that, however what I'm curious about is in what kind of situations would we use one over the other? It feels to me as if Public Key ...
0
votes
1answer
65 views
Determine the Identity of Caller
Let me explain my situation.
I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
-7
votes
1answer
82 views
Asymmetric encryption algorithms [closed]
What are the best asymmetric encryption algorithms out there? I am trying to use RSA in my project howoever I have read that it is not quite secure as other asymmetric encryption algorithms.
6
votes
2answers
243 views
Is ECDSA breakable by quantum computers?
Is ECDSA secure from quantum computers? Will quantum computers be able to calculate it's private keys from the knowledge of the public key once there are working quantum computers?
3
votes
1answer
60 views
Clarification on Digital Certificates
I used the makecert tool to create:
self-signed certificate
client certificate
These are the commands I used:
makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
2
votes
1answer
46 views
Sending Digital Certificates
I used the makecert tool in order to create:
a self-signed certificate
a server certificate using the self-signed certificate
a client certificate using the self-signed certificate
I then ...
2
votes
1answer
70 views
Security Certificates - Tools to Generate Security Certificates
I want to create a self-signed certificate that will be installed as a trusted certificate authority.
I then want to create another two certificates which are signed using the private key of the ...
0
votes
0answers
24 views
Is the GTK or MIC in the unencrypted portion of a WPA protected frame?
In order to decrypt traffic you must have all 4 portions of the WPA Handshake. In WPA protected data frames, is there an unencrypted portion of that frame that has some sort of identifiable value to ...
0
votes
1answer
70 views
PCI 3.6.6 cryptographic key procedures include split knowledge
My question is, if you run your own company and there are no employees and you still qualify under assessment D what do you do in a case like this where it is requiring 2 or more people? On a related ...
1
vote
1answer
211 views
The request was aborted: Could not create SSL/TLS secure channel Exception
Let me explain my situation.
I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC.
I then created two certificates using the self-signed ...
2
votes
1answer
59 views
Authenticating a ciphertext
what can be considered as a downside of authenticating a ciphertext?
For example, can we say drawback of authenticating a ciphertext is that we lose
repudiation, for example, we can't prove to the ...
3
votes
2answers
134 views
Are there any serious problems with this method for generating single-use tokens?
I need your advice on the security of this design.
I have a scenario whereby a server application and a smart card application need to share a value e.g. 52, which has been encoded in a long decimal ...
3
votes
4answers
254 views
Is it possible to configure any of wifi protocols so that the network is undetectable?
I am wondering if it possible to configure my DD-WRT router so that the wifi network I am using is undetectable - impossible to tell if there is any network broadcasting even if there are clients ...
5
votes
1answer
282 views
Truly deniable encryption
What tools can be used to make truly deniable encryption?
Suppose, authorities can use any force to make you open your passwords.
Truecrypt can have only one hidden container, which means that ...
11
votes
1answer
226 views
“Please Enter Nth Character” without HSM
This question has been asked a few times, but always in the format
"How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?"
And the ...
4
votes
1answer
104 views
Switching to new encryption method (without losing data?)
Let's say you have a website that provides a service of some kind. Users can log in, they can store some kind of data, and there's various types of encryption in place to keep it all safe. Passwords ...
-3
votes
2answers
88 views
how to identify plain text from cipher [closed]
I am trying to find what encryption algorithm has been used in this code
original text: 11011698
encrypted text/cipher: uIC4hZFECIAYMi%20FWxamjQ==
original text:11008569
encrypted text/cipher: ...
4
votes
2answers
148 views
Secure yet reversible encryption for local data store
I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking ...
4
votes
3answers
2k views
Can Skype chat be protected from snooping? Are there safe alternatives?
I use Skype a lot. With all of my clients, staff, contractors and friends, however, the acquisition by Microsoft worries me, as two of my clients are direct MS competitors, and I often work on long ...
1
vote
2answers
181 views
How to increase VoIP call security?
I am using VoIP for my office because I can use the same number whether I am in USA or anywhere else.
I am using it on my laptop and I have to visit India in the next few days. My friends say rules ...
2
votes
1answer
105 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
5
votes
3answers
208 views
Encrypt then checksum or vice versa?
This is probably a naive question, but here goes: What is better for security over TCP/IP?
Encrypting the payload and then adding a checksum?
Checksuming the payload and then encrypting it?
...
3
votes
3answers
101 views
Avoiding direct object references
Say I wanted to avoid exposing a database primary key in a URL; somehow I must encrypt the key, so that the url only exposes elements of an unenumerable cipherspace. What kind of encryption should I ...
