Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
12
votes
11answers
865 views
For users that does not use PGP, what would be the other channel to securely send them a document?
I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email.
The real question is how to do that?
...
12
votes
3answers
457 views
How secure is aSSL (javascript)? Does it effectively mimic SSL?
Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
12
votes
6answers
3k views
Is AES encrypting a password with itself more secure than SHA1?
This isn't really a practical question, but more a question of curiosity. I heard a CS professor recommend stepping up from md5ing passwords not to SHA1, but to AES encrypting the password using ...
12
votes
7answers
898 views
Has cryptography reached the development level where social engineering is the only reliable method of attack?
Note that for the purpose of this question, "social engineering" means extracting information from humans, be your methods compliant with Geneva Conventions or not.
Simply put: Do cryptographic ...
12
votes
5answers
978 views
How should passwords be stored if they must be recoverable?
By "encrypting" passwords you are violating CWE-257: Storing Passwords in a Recoverable Format. But this is exactly what the French government wants. They want to be able to obtain the passwords of ...
12
votes
6answers
2k views
Is TrueCrypt safe enough to store clear-text-passwords?
The reason: I want to be able to use a portable USB drive to access my passwords on any machine and OS. TrueCrypt seems to be the only program that has sufficient support on all major platforms. So I ...
12
votes
6answers
741 views
Why not RSA-encrypt the entire document?
I have recently learned of a way for person B to verify that a document sent from person A is indeed from person A.
Person A gives Person B his public RSA key. This must be done reliably.
Person A ...
12
votes
3answers
2k views
Forced into using a static IV (AES)
We've had to extend our website to communicate user credentials to a suppliers website (in the query string) using AES with a 256-bit key, however they are using a static IV when decrypting the ...
12
votes
2answers
391 views
Digital Certificate deployment: using two certs for each user?
At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs:
One for signing documents, emails, etc. that is ...
12
votes
5answers
553 views
Is there a digital “safety deposit box” equivalent?
Digital safety deposit boxes: do they exist? if yes, are (any|they) trustworthy?
There are many bricks and mortar financial institutions where one can rent a locked box in a locked room and be ...
12
votes
2answers
357 views
Encryption and the “security time decay” of prior encrypted data
This question is on the assumption that any data once encrypted, may (eventually) be decrypted through
Brute force (compute power/time)
Exploits in the cryptography used
Theft of private keys
...
12
votes
1answer
301 views
Doing a dictionary attack on RSA if you have the public key?
I'm trying to learn exactly how RSA works. Currently I have a very, very simplictic overview that goes like this.
Having the public key allows you to encrypt things. Encrypting the same message ...
12
votes
6answers
619 views
How can the impact of cold boot attacks be minimized?
Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
12
votes
2answers
3k views
Which SSL/TLS ciphers can be considered secure?
The OpenSSL website provides a long list of different ciphers available for SSL and TLS.
My question is, which of those ciphers can be considered secure nowadays. I am especially interested in HTTPS, ...
12
votes
9answers
4k views
Encrypting email for gmail
My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
12
votes
3answers
1k views
When using AES and CBC, can the IV be a hash of the plaintext?
[Originally on programmers.stackexchange.com with title: Can you encrypt with AES+CBC and search the encrypted data]
Basically, I'm going to go with Advanced Encryption Standard with either ...
12
votes
3answers
812 views
What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms?
Why can SHA-1 be considered a secure hash function? That's something I still wonder about.
I understand the concepts of why modern asymmetric algorithms are deemed to be secure. They are founded on ...
12
votes
4answers
780 views
Is Steganography considered encryption and subject to USA export restrictions?
I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
11
votes
3answers
1k views
Encryption and compression of Data
If we want both encryption and compression during transmission then what will be the most preferable order.
Encrypt then compress
Compress then encrypt
11
votes
5answers
7k views
Asymmetric vs Symmetric Encryption
I am currently taking a principles of information security class. While talking about different encryption methods a large number of my classmates seem to believe that Asymmetric Encryption is better ...
11
votes
2answers
2k views
symmetric encryption session keys in SSL/TLS
This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if ...
11
votes
4answers
316 views
Encrypting data by parts vs encrypting the whole data
Suppose I have a file with records, and I have two options to encrypt it:
encrypt the file as a whole
encrypt each record separately and store them together.
Which way is generally preferable and ...
11
votes
4answers
6k views
What ciphers should I use in my web server after I configure my SSL certificate?
There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list.
...
11
votes
2answers
413 views
Is a large number of RSA-encrypted files a vulnerability?
Would having a large number (10^4) of RSA encrypted files make it easier for an attacker to find my private RSA key?
Update: These files would be available to the attacker, and perhaps the content of ...
11
votes
2answers
1k views
What's wrong with storing private keys in the cloud?
I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
11
votes
1answer
266 views
What are the problems with encrypted but unsigned data?
In another question's answer, D.W. wrote:
Make sure there is authenticity protection for the encrypted data (e.g., encrypt and then sign/MAC): you will need both confidentiality and authenticity ...
11
votes
2answers
538 views
Doubling up or cycling encryption algorithms
I've occasionally read the suggestion to enhance security by either doubling up on encryption algorithms (encrypt a message once with one algorithm, then encrypt the ciphertext again with a different ...
11
votes
2answers
2k views
Smartphone / GSM Sniffer
This question would be in the category of SmartPhone Sniffers.
So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
11
votes
2answers
701 views
Flaw in encryption through pseudorandom number stream (from gpg documentation)
I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity:
When I was in college in the early 70s, I devised what I believed was a brilliant ...
11
votes
2answers
931 views
Encryption strategies for multi users access in production systems
I am pretty unknown to encryption strategies in production environments. So my concern is to find a solution how to strongly encrypt data, but make it available to multiple users with different keys.
...
11
votes
1answer
218 views
“Please Enter Nth Character” without HSM
This question has been asked a few times, but always in the format
"How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?"
And the ...
11
votes
1answer
669 views
How would I implement “Broadcast Encryption”?
I have a stream that I want to encrypt for broadcast to 10,000 subscribers. I know I should encrypt this data using a symmetric key; and also intend that this symmetric key will be rotated every 30 ...
11
votes
2answers
5k views
Multi-boot with full hard drive encryption and pre-boot authentication
How would I set up a multiboot system which supports full hard drive encryption and pre-boot authentication.
I have a system with Ubuntu, Windows 7, Windows XP, and I would like to install Red Hat. ...
11
votes
3answers
1k views
How are mobile telephony networks like LTE and HSPA encrypted?
How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
10
votes
7answers
3k views
What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?
I'm interested in updating this two pronged question for 2011:
What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective?
What cryptology is most ...
10
votes
6answers
1k views
Is Steganography a safe method to store secret data?
I want to put some parts of my secret data into specific file with Steganography method. Is this method as safe as other encryption methods like RSA or SHA?
10
votes
2answers
6k views
What are the differences between MD5, SHA and RSA?
MD5 tools output hexadecimal values. In the same manner, do SHA and RSA together produce a hexadecimal (or any other) output?
What are the differences between the MD5, SHA and RSA algorithms?
10
votes
4answers
746 views
Future proof encryption possible in theory?
Let's say I have a message that I want to keep safe for the next 100 years. Is it theoretically possible?
Let's say the message is unique (raw picture data, raw video video data, raw text data) and ...
10
votes
5answers
313 views
Security of using passwords or even passphrases to encrypt files
Is it ever appropriate to use real-world passwords to encrypt files to be sent via unsecure means.
By real world, I mean a password that is memorable and memorisable by a mere person?
I am implying ...
10
votes
4answers
944 views
Using computer random number generators to produce keys, it is secure?
Does generating an encryption key using the random number generator on one's computer present a security risk? If so how might that risk be mitigated, specifically when generating RSA key pairs in ...
10
votes
6answers
859 views
Identity-Based Encryption - how secure is it?
I was always taught never to invent my own crypto algorithm, and never to trust someone who has a proprietary algorithm.
I'm looking at Voltage SecureMail, which uses IBE (identity-based encryption) ...
10
votes
5answers
384 views
what would be a good way for a doctor to send xrays encrypted to another doctor?
As a dentist, I often want to send medical information including digital xrays to another doctor. What would be a good/easy way to do this encrypted?
Our organization currently requires that all ...
10
votes
3answers
1k views
Computationally simple, lightweight replacement for SSL/TLS
Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
10
votes
3answers
6k views
Understanding 2048 bit SSL and 256 bit encryption
On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm
What exactly is the difference here and why are two encryption bits ...
10
votes
2answers
371 views
Is it possible to have a key for encryption, that cannot be used for decryption?
For example, a server might have some encrypted logs or storage or whatnot, that would only be used for reference later. This way even if the server is hacked, everything is still OK until the hacker ...
10
votes
4answers
505 views
What is the key when facial recognition is used as a password?
I get the basics of what face recognition is and the fact that it is used to protect PC's and as a login replacement.
However, if it was to be used for encryption, where the role of the key is played ...
10
votes
5answers
2k views
SQL field level encryption, how safe is it?
I am considering encrypting my database and/or encrypting only certain columns in a few tables. Is it worth the time? I mean, how much of a burden would it be on someone if they were to get a hold of ...
10
votes
4answers
2k views
OS with encrypted RAM?
Are there any applications, JIT frameworks or operating systems that focus on encrypted virtual memory, or perhaps virtual machines that do something similar? I know there are processors (albeit old, ...
10
votes
4answers
1k views
Is it feasible to encrypt customers personal data? (name, address etc…)
Seeing the Sony Personal data kerfuffle unfold has gotten me thinking about the encryption and securing of personal data - obviously credit cards can (and should) be encrypted, making data breaches of ...
10
votes
1answer
4k views
What key exchange mechanism should be used in TLS?
There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
