Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
11
votes
3answers
1k views
How are mobile telephony networks like LTE and HSPA encrypted?
How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
4
votes
1answer
151 views
Why is ECC more vulnerable than RSA in a post-quantum world?
Forgive me if this should be in the crypto sub, but sometimes the answers there are very mathematical and I would rather have an answer which is a bit lighter on the math but still strong on the tech ...
12
votes
9answers
4k views
Encrypting email for gmail
My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
8
votes
5answers
234 views
How to support secure creation of a user account over an external API via a queued job?
So this question is delving into security and encryption and the problem potentially hasn't been encountered by many. Answers may be theoretical. Let me outline the scenario...
A website frontend is ...
7
votes
4answers
1k views
What Partial Homomorphic Encryption implementations exist and how do I leverage them?
It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
2
votes
1answer
155 views
ECDHE_RSA and gmail
I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange.
Based on my understanding of TLS and Gmail, my client ...
10
votes
4answers
753 views
Future proof encryption possible in theory?
Let's say I have a message that I want to keep safe for the next 100 years. Is it theoretically possible?
Let's say the message is unique (raw picture data, raw video video data, raw text data) and ...
16
votes
2answers
12k views
How to estimate the time needed to crack RSA encryption?
How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
6
votes
2answers
414 views
How can I prevent people from duplicating my barcodes [duplicate]
I would like to manage my inventory using a barcode system, but I am afraid that people will be able to scan or copy my barcode and make duplicates.
I would like to offer a discount card that has a ...
-3
votes
1answer
75 views
OTR encrypted chatroom or IM [closed]
I need a secure, encrypted environment for conducting text based interviews online. It's for academic research purposes where data protection is paramount so there cant be any data stored on 3rd ...
2
votes
1answer
60 views
Mutual Anonymity in key exchange
If Alice (sender) sends a private message embedded with public key of the Bob(recipient) through onion network, so in this key exchange, does Bob remains anonymous to Alice as Alice knows about the ...
3
votes
4answers
126 views
Anonymized Votes
Background
Looking to create an anonymous voting system. The system must track whether or not a user voted on an item (public information), but only that user is ever allowed to know whether they ...
1
vote
1answer
136 views
Exchange of DEK and KEK (encryption keys) between app server and key server
In my application, it is required to encrypt a user's data before inserting it into the mysql database. I am using AES algorithm to encrypt the data using a 256 bit hash (and is calling it Data ...
5
votes
2answers
168 views
Is it safe to sync private keys between iOS devices using iCloud?
My iOS app has to handle storing private keys for the user. Normally I would just use Keychain Services for this as I would a password, but it would be great if I could sync the keys between the ...
5
votes
1answer
116 views
When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?
When you take ownership of a TPM in Windows 7 you encounter a screen like this:
Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
-1
votes
2answers
146 views
Hiding emails from Google [closed]
From what I understand Google reads/scans all my emails so that they cab "provide" targeted ads and maybe for other reasons.
If a have a group of people who want to hide their emails from Google, how ...
-3
votes
2answers
293 views
Is pixel based image encryption secure?
I have encrypted an image using pixel encryption method. I just used a bmp image for that. What I did is, I retrieved each pixel value from the image and obtained the value of red, green and blue ...
1
vote
1answer
371 views
Vulnerabilities in Host Proof Hosting
I've recently been doing some research on Host-Proof Hosting, specifically in a web app environment. It seems like a pretty rock solid method of security, but I'm certainly not a security expert and ...
0
votes
2answers
188 views
Where do I securely store application-specific symmetric key?
I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere.
From a similar ...
3
votes
5answers
301 views
Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?
I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"?
Furthermore, are there any practical ...
1
vote
0answers
39 views
Can double encryption with different key increase the security? [duplicate]
Encrypting the file using same encryption algorithm using different Keys can increase the security or not?
0
votes
0answers
116 views
Is it possible that AES could be broken? [closed]
Much like DES was broken for years, but never truly released to the public until quite some time later. I know that AES was more open to the public when it was initially developed, and many proposed ...
1
vote
3answers
112 views
Cryptography key gathering tool
I am wondering if there exist a tools which can return the value of the one of the private key if the following are known:
1) Encryption Algorithm
2) Public key
3) Plain text
4) Cipher text
Or may be ...
0
votes
1answer
102 views
Is this a secure method for authenticating clients?
I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy.
Client sends a ...
3
votes
2answers
245 views
Does it make any difference of the order Hashing and Encrypting in terms of security?
I am implementing a password vault program with java. I have programmed a triple DES for encryption and a SHA256 for hashing.
My question is would it make any difference if I first hash the raw data ...
18
votes
3answers
8k views
What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?
I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services?
I don't understand email protocols in details, but as far as I know email traffic is ...
1
vote
3answers
130 views
Should private messages be encrypted?
I want to implement a private messaging system to my website, but I'm wondering if the content of the -supposedly private- message between Alice and Bob should be stored in plain text in the database ...
8
votes
1answer
522 views
Truecrypt compromised?
In light of recent developments in computer forensics and "password recovery" utilities, can encryption technologies such as TrueCrypt still be relied on for a high degree of protection?
It would ...
1
vote
1answer
102 views
Is it secure to use a custom written Php extension for handling + hashing (db) keys?
I'm designing the security of a new application and try to figure out what the best way is to store the keys of the mysql AES encryption in the file system. I've seen several options like store it ...
1
vote
2answers
300 views
will google detects tor browser?
Usually while we browse Google through our i.p we will be redirected to respective countries,i normally use tor browser for anonymity,today while i browse google i got redirected to ...
3
votes
1answer
128 views
Why do PGP master keys only have a single subkey, and tie certification with signing by default?
After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
2
votes
2answers
108 views
Many-time pad on image data, how to proceed?
I have raw image data that is XOR-encrypted with a fixed-size one-time pad repeated over the length of the image. I know what the format of the image data container is so I can successfully retrieve ...
6
votes
3answers
307 views
How secure is HTTPS with weak ciphersuites?
Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
3
votes
1answer
299 views
Will double encryption increase the security of cipher vs bruteforce?
Lets say, I have a function
encrypt(mes,key)
where :
mes = message
key = key
Length of key is 64bits.
Lets say, that only way to crack my cipher is brute force attack.
If I use
...
8
votes
1answer
2k views
Wheres the salt on the openssl aes encryption?
Im interested in knowing how and where openssl inserts the generated salt on an AES encrypted data. Why? Im encrypting data in Java classes and need to guarantee that i can use openssl to decrypt them
...
1
vote
1answer
129 views
Dual Linux System with Whole Disk Encryption
(This is a continuation of my question on Ask Ubuntu.)
My goal is I want to have a Xubuntu/Ubuntu dual boot, with a catch - I want the disk to be fully encrypted with the dm-crypt (native supplied) ...
2
votes
1answer
86 views
Security on dedicated lines
Is it safe for a company not to use any encryption on customer's data when it is transferred between data centers on dedicated lines?
By customer data I don't mean passowrds/credit card info. Just ...
5
votes
1answer
94 views
Security and authentication problem
We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes.
First of all, lets imagine a real world scenario:
Imagine that a user ...
2
votes
1answer
94 views
How do I get my Encryption Certificate back?
I was using Windows 7 Professional. I encrypted a few personal pics and videos on my hard drive. Unfortunately someone deleted the encryption certificate.
Now I have installed Windows 8 and have ...
2
votes
1answer
64 views
Can we reverse engineer binlog with row format to make MySQL AES_ENCRYPT visible?
Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual ...
0
votes
0answers
49 views
Best strategy using encryption to ensure that only authorized application can access smartcard? [closed]
I want to encrypt the data in smart card to ensure the safety of the data so no unauthorized application could access these data, any suggestion about good mechanism to do that? what is the best ...
2
votes
3answers
78 views
How do I transfer the HMAC?
I have a file I'd like to encrypt with a symmetric key using AES-256 and then use an HMAC for integrity. So I don't "roll my own" scheme which I know is a big mistake, what are the standards for using ...
1
vote
1answer
105 views
Implementation review - Independent key, admin side and user side
The admin of the website needs to read user data. So, if the key is derived from the user pass, then the admin has to know the user pass, not exactly a good idea.
The following encryption scheme was ...
1
vote
2answers
108 views
Is it bad practice to send decryptable data?
If I'm authenticating an action, is it a bad practice to authorize the connection using a decryptable hash that does have a specific algorithm, but only the remote machine knows?
Is sending ...
1
vote
3answers
121 views
Use Authentication using 2 encrypted strings
So, basically I am trying to log a user in with a cookie and do not query DB to improve performance.
Here is a brief idea:
Transmit everything via SSL
Set a Global secret key A and secret key B
...
0
votes
2answers
122 views
Encrypting Fields in Database
I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
4
votes
2answers
241 views
Evernote hacked - precautions?
On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software.
...
4
votes
3answers
176 views
Can encryption twice with two keys in different sequences lead to the same result?
I am looking for an encryption algorithm for one of my current papers. The basic requirement is that, suppose I have two keys k1 and k2, and the E(k1,t) means encrypt t with key k1.
Are there any ...
1
vote
2answers
3k views
Recovering encrypted SD card after Android Factory Reset
I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card.
Phone did a factory resync and now data on SD card is still encrypted.
Is there a way ...
1
vote
1answer
283 views
Why so long to break 128-bit encryption?
I read that 128-bit encryption takes millions of years to break. But if I encrypt a file using say winzip that uses 128-bit encryption but the password I use is only one character long (for example ...
