Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

1
vote
1answer
37 views

Getting file from Amazon s3 encrypted based on user

I am storing my files on Amazon S3. My problem is that whenever a user asks for a file I want to generate an encryption key (user specific key) and encrypt the file and send it to him. So basically I ...
8
votes
0answers
443 views

Is GCM still recommended? [migrated]

I stumbled across a forum thread where a security researcher seemed to have negative feelings towards GCM. I had always thought from prior readings that GCM was the current gold standard for ...
3
votes
1answer
64 views

Is having a unique key to encrypt data not sufficient

Is it necessary to use a unique Initialization Vector (IV) with various cipher modes of operation (e.g. CBC) even though I use a unique key to encrypt plain text every time? It is said that an IV ...
9
votes
1answer
200 views

Why is whatsapp Inc. still caching user data even after introducing the end to end encryption?

Last week Whatsapp introduced the end to end encryption to prevent man in the middle intercept/attack. The company claims that the data such as text, call, video, images and documents are stored ...
-3
votes
2answers
109 views

Is it more secure to delete emails from the server once a client has downloaded them?

From this email provider We strongly adivse people to download their email whenever possible, so as to lessen the amount of personal private data present at any time on the servers. Does ...
1
vote
0answers
36 views

Data recovery from BitLocker encrypted device that has been quick-formatted

I apologize if this is in the wrong place, but I couldn't find anywhere else that seemed appropriate for these questions. My classmate has a 512GB USB drive that he had formatted as exFAT and ...
0
votes
1answer
87 views

Does non-persistent data ever need to be encrypted?

Does non-persistent data ever need to be encrypted? If I had a project with confidential data stored in non-persistent class variables should I be doing anything to protect this data? I am developing ...
2
votes
1answer
133 views

Open source WhatsApp client [closed]

As a follow up to Whatsapp encryption keys discussion and from WhatsApp security whitepaper, it seems that most of the components to a fully secure end-to-end encryption are already there but what ...
4
votes
2answers
84 views

Idea for an encrypted pastebin NON-web application

I have an idea for an app that might be useful (though if it isn't, I've still learned in the process, which is what matters). There are a bunch of encrypted pastebin web apps out there (e.g. ...
1
vote
1answer
60 views

Hide data from user, but process it in application

Is there a way to hide the data that's received somehow from the user? In particular, I have some data that gets send from a webserver to an application. I want the application to process the data, ...
3
votes
1answer
45 views

Is this good/secure method for client-server communication encryption?

Something came to my mind, and I wonder if this is proper method for client-server communication, and if this method is wide-used. On connection, client generates seed, encrypts it using asymmetric ...
11
votes
2answers
269 views

How does WhatsApp's new group chat protocol work and what security properties does it have?

By now everybody has noticed that WhatsApp rolled out full end-to-end encryption recently, for direct communication, for media attachments and for group chats. I've read their white-paper (PDF) and ...
49
votes
2answers
6k views

How is WhatsApp sending end-to-end encrypted messages in push notifications?

WhatsApp implemented end-to-end encryption (whitepaper) in their latest update. How is it possible for WhatsApp to send push notifications with message contents to the Apple Push Notification ...
1
vote
2answers
725 views

WhatsApp end-to-end encryption verification [closed]

IS there any way to verify the encryption from remote or so? Like my friend is 1000 miles away from me the physically QR Code scanning is not possible. So is there any way to verify the same?
1
vote
1answer
46 views

Break encryption by applying accidental-overwrite techniques

I read that there are ways, at least on mechanical drives, to sometimes recover data that was overwritten (not just deleted). Now I was wondering if it was theoretically possible to break a fresh ...
0
votes
0answers
60 views

Could someone explain what this error about? [migrated]

Test connection ([Triatin_SALESBANK_SFTP_Receive_Triatin], [SFTP Receive]) failed with message: Unable to logon[user: ****] into target server [***********:22] via SOCKS proxy ...
-2
votes
1answer
566 views

End-to-end WhatsApp vs Telegram [closed]

What do you think about the latest WhatsApp update? Is now WhatsApp as secure as Telegram? Which one should be trusted? Which one has the strongest and most secure encryption?
14
votes
1answer
387 views

How would one verify that the public key from WhatsApp's servers belongs to the person I expect it to?

WhatsApp had recently announced end-to-end encryption on all communications. While that's an impressive move, I still have a big open question mark. The articles and this white paper suggest that the ...
1
vote
0answers
117 views

WhatsApp end-to-end encryption for all devices [closed]

The news is out, WhatsApp switched on encryption for a billion people. It supports all devices and encrypts texts, photos, videos and calls. There are so many questions that just came to my mind ...
3
votes
1answer
62 views

Is appending plaintext to salt equally safe as appending salt to plaintext

Is using hash(salt, plaintext) equally secure as using hash(plaintext, salt), i.e. can the plain text be appended to salt in place of appending salt to the plain text. Why or Why not? What kind of ...
4
votes
2answers
58 views

Does EMV protect against sniffing PAN data from untrusted network?

I have received conflicting information in regards to the security of PAN data on the wire. Can this be sniffed with properly configured EMV at an atm? To quote from the link below: ...
0
votes
0answers
26 views

How to reverse engineer a cryptography algorithm if some input-output pair is known. [migrated]

I am trying to reverse engineer an unknown encryption algorithm. By this, I mean I dont know what kind of algorithm is used to encrypt the words. But I know some input-output pairs. From this point ...
1
vote
1answer
69 views

Stronger Password-based File Encryption on OS X [closed]

I am wondering if there are any better alternatives than the zip command on the OS X terminal. My intention is to add a password to a compressed file. I have been using: zip -j -e -pMY_SECRET ...
2
votes
2answers
127 views

Is the RSA private key useless without the password?

I notice whenever I generate a new gpg key (using pgp) I always have to assign a password to it, which makes perfect sense. But if I'm not mistaken, gpg is based on prime numbers. How is this ...
5
votes
2answers
128 views

Does TLS authentication encrypt username as well as password?

I connect to my VPN provider using openVPN. The server uses a combination of username / password and TLS authentication. If I am on a public wifi and connecting to my VPN, is my username encrypted? ...
0
votes
1answer
36 views

Encrypt existing SSH key

I've created an RSA keypair for ssh access to a remote server. This all works. When creating the keypair, I didn't enter a password. Now I would like to encrypt the key, secure it with a password. Is ...
0
votes
1answer
31 views

Why is calculating the checksum of an IP Datagram header and then encrypting it not appropriate to provide Data Origin Authentication?

So assuming Alice and Bob have agreed to use a particular symmetric cryptosystem and share an appropriate key, they want to achieve data origin authentication by computing the header checksum of an IP ...
3
votes
5answers
588 views

Why can passwords be used to encrypt data, but are less strong for authentication?

Encryption software is often password based. Even if the adversary gets your computer they can't get the data without knowing the password, and bruteforcing is infeasible. Websites use passwords to ...
2
votes
2answers
42 views

How does GnuPG encrypt secret keys?

When creating a secret key with GnuPG, you are asked for a password to protect it. Which encryption algorithm is used to achieve this? The handbook only says that a symmetric encryption algorithm is ...
4
votes
2answers
50 views

How to check and trust call encryption software

There are lots of software for mobile operating systems providing end-to-end encryption. What is the best way to decide which one is trustworthy if their source is not revealed? Reverse engineering ...
11
votes
2answers
635 views

Replay attacks and PGP email encryption

From my understanding of PGP email, the following is possible: Alice sends a message to Bob. Then Bob can take that exact same message and send to Carol while making it seem to Carol like it is from ...
6
votes
3answers
124 views

Android full disk encryption

I am using Android 4.4.4. There is an option called phone storage encryption. From what I have read the crypto is secure. However, I read this article which said Google is able to reset passwords: ...
-6
votes
0answers
99 views

Android default encryption settings

Does anyone know how to change the Android default encryption settings? I want to use AES256, SHA2-512, increase the iterations to 100k and increase the salt to 256bits. Can I use dmcrypt to change ...
-2
votes
1answer
83 views

Public key encryption for initial challenge-repsonse

I understand public key encryption, public key authentication, how digital signatures work and challenge-response authentication, but what confuses me is when they are all combined, and the question ...
0
votes
1answer
24 views

Veracrypt options to protect against multiple versions of an encrypted volume

I'm planning to use rsnapshot to backup a veracrypt volume as it changes. This means I will have multiple versions of the same volume, with slight differences in data. It is my understanding that ...
7
votes
1answer
85 views

What's the most secure way to circumvent encryption to enable password recovery?

I have a web app (which I've talked about here before). Users can use it to save people's contact details. These contact details are encrypted to ensure that they are difficult to get at if they're ...
3
votes
1answer
33 views

OpenSSL's EVP functions, more specifically EVP_SealInit

Reference: https://wiki.openssl.org/index.php/Manual:EVP_SealInit%283%29 I want to securely share a symmetrical key between two endpoints using OpenSSL's EVP interface. Transferring the encrypted ...
1
vote
2answers
95 views

How can i read the source code of this encoded powershell script from the registry?

I get this line by ProcessExplorer C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -executionpolicy bypass iex ...
3
votes
1answer
73 views

Creating accounts on sites with no security?

I'm sort of confused about security on some sites. Here on stackexchange.com, for example, seem to have no security normaly, but as you log in or create an account, it uses keyexchange and an ...
-4
votes
0answers
28 views

How was the U.S. government able to unlock an encrypted IPhone? [duplicate]

Apparently the FBI was able to unlock the San Bernadino shooter's iPhone. Any clues on how it was done?
3
votes
2answers
72 views

How does PGP grant authenticity?

I'm using the website https://www.igolder.com/PGP/encryption/ to encrypt/decrypt PGP messages and create public/private key pairs. I get that when I send somebody my encrypted message only he can ...
1
vote
1answer
74 views

Is it not advisable to add a 2nd level of encryption to an already encrypted external hard drive?

In a separate post regarding the security level of "WD My Passport 2TB" external hard drive's built-in password encryption, Tom Leek answered in incredible detail that left the enquirer of the ...
2
votes
4answers
180 views

How could online encryption ever work? [duplicate]

I have recently read about the german enigma machine in WW2, It worked in a way that every day the machine configuration was sent per mail to the different operators. (I couldn't find official sources ...
9
votes
1answer
129 views

Handling “forgot password” functionality with encrypted data without security questions

As a sort of follow-up to this question on handling password-reset functionality when dealing with encrypted user data, is there any good method for resetting a user's password in an encrypted web ...
3
votes
1answer
48 views

Is symmetric encryption with one time pre-shared key secure?

Suppose I have a secure channel between client and server, with proper certificate validation etc (actually, ssh session). I want to establish a secure connection between my own application on a ...
20
votes
4answers
1k views

When encrypting cloud-stored data, is it acceptable to use the user's account password?

I'm developing a web service that stores sensitive personal information (such as telephone numbers, addresses, full names, and email addresses) in a database, such that it can be accessed from ...
2
votes
1answer
130 views

Best way to encrypt data using php - I am not sure if I doing it correctly [duplicate]

I want to encrypt some data within my php file when I add the stuff to my mysql database. This is how I do it. I create a static key like: $key = md5("pass"); Then I have two functions called ...
-1
votes
2answers
67 views

Is any systematic method that can detect weak cryptographic algorithm in source code

Weak cryptographic algorithm should be removed from source code to avoid a false sense of security(for example: MD5. Of course, there is possibly the algorithm in source code, but it doesn't use the ...
7
votes
1answer
254 views

Does LUKS actually fully encrypt data on a disk?

Why does TrueCrypt and similair applications take hours to fully encrypt a 1 tb drive, while luks takes a few seconds? Sorry if this is a dumb question, but I don't fully understand how that works.
5
votes
1answer
2k views

What is “NAND mirroring”, the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?

According to Ars Technica, Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...