Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

2
votes
5answers
153 views

Does publishing the md5sum of a private key compromise the private key in any meaningful way?

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an ...
1
vote
1answer
76 views

How is the username and password captured on this mobile device?

I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html The poster says: For both of these ...
2
votes
1answer
168 views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
3
votes
2answers
50 views

Consequences of putting a serial number into an AES key

I have an embedded device with a secure memory of only 128 bits. I have to store the serial number (16 bits) and the AES key (128 bits) into this space. What are the consequences of putting the 16 ...
2
votes
2answers
289 views

In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?

I have mobile devices (low power, low bandwidth) need to act as a proxy for certain types of P2P encrypted data, such as voting, bitcoin payment, or other specific-purpose usage, and I want to make ...
0
votes
0answers
19 views

How do TSC (TKIP sequence counter) calculate into WPA?

I'm reading about 802.11, from IEEE's pdf (IEE pdf), from page 1191, and in particularly I'm reading about TKIP. And to decrypt and to encrypt used a TSC (TKIP Sequence Counter) as you can see in ...
5
votes
1answer
49 views

Can a mobile phone be induced to fall back to 2G comms?

http://techcrunch.com/2015/02/25/gemalto-2/ So, a bunch of SIM card keys were most likely stolen, but Gemalto claims that this would only affect 2G networks. Supposing all that is true, it's still ...
5
votes
2answers
107 views

Files encryption for flash drive privacy/security

Looking to encrypt files on flash drive (for backup) just in case it gets stolen or lost. Don't want to install any extra software like TrueCrypt but instead just use what's already on most computers. ...
-5
votes
0answers
18 views

computer security [duplicate]

Assume that user A is about to use some website that requires login credentials. User A starts his web browser, types the website’s URL, and submits the URL request. The web server hosting the ...
2
votes
3answers
102 views

Maintaining data security in motion with SSL

I am hosting with a HIPAA compliant hosting company, as we are required to do because of the industry I am in. We have a BAA executed with them, and their responsibility terminates at the application ...
2
votes
2answers
130 views

Mount ecryptfs directory via SSH

I have access to a server that I use for backups. I use rsync with the --delete flag to make an exact copy of my backup directory. I have no need for incremental backups. The backup directory on the ...
0
votes
1answer
154 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
11
votes
1answer
1k views

How to study the packets sent by a keylogger

One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it. I have a strong doubt that it is a key-logger. ...
5
votes
5answers
191 views

How to avoid to lose data encrypted because it was encrypted by no longer supported software?

How can I avoid losing data that is encrypted using methods that may become obsolete? I have valuable family records I wish to secure, so I plan to encrypt them before putting them in long-term ...
0
votes
1answer
43 views

How are various softwares' files/information kept safe from me, the user [closed]

I started making a simple user authentication program just for fun, and I realised I don't know how to keep safe the files that will store all the usernames and passwords. This got me thinking. What ...
11
votes
0answers
779 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
2
votes
1answer
82 views

Difference between fully homomorphic and semi-homomorphic encryption

What is the difference between fully homomorphic and semi-homomorphic encryption?
1
vote
1answer
749 views

Improving stateless REST API authentication token - or ditch it for database persistence?

I'm looking to implement stateless REST authentication into an API. I've been reading up on articles here, and have implemented an idea that works, but I was hoping to get some feedback on its ...
-1
votes
2answers
91 views

Is it a secure encoder and hasher?

I want to ask if my code secure or not. if this is not secure please tell me the reason. This code is mixed of Rjindael-256, base64_encode and SHA-512. function xencoder($input,$key) { $salt = ...
-2
votes
0answers
62 views

Can I use the output from a DRBG directly as K for AES, or do I need to use a key generator algorithm? [migrated]

NIST has 3 validated "Recommendation for Random Number Generation Using Deterministic Random Bit Generators" (DRBG's) that are based on NIST SP 800-90A: Hash_DRBG (based on hash functions) ...
1
vote
1answer
41 views

Search Engine security for searches associated with the same searcher [closed]

A number of years ago AOL leaked potentially identifiable information, because all of the searches leaked were associated with the same 'user', and as such they could be put together to identify the ...
1
vote
1answer
56 views

PKI/Why does Microsoft require my cert before encrypting an email?

Microsoft doesn't allow sending public-key encrypted messages using Outlook 2003-2012 on Windows 7-8x environments without first creating your own Digital ID or private key for signing. Per ...
1
vote
1answer
83 views

Any way to revoke old key pair?

There is a many-year-old 1024 DSA key in the public keyservers under my name. There is a 2048 ELG-E subkey for it. I didn't create these keys, they were created for me by a former employer without my ...
4
votes
0answers
97 views

Linux Plausibly Deniable File System

Is there any way to encrypt a linux filesystem in such a way to maintain plausible deniability? E.g. "Hidden OS support," the way Truecrypt and Veracrypt work, they only support Windows OS due to low ...
7
votes
10answers
3k views

How can I share files with other individuals using the cloud in a secure way?

I would like to use a dropbox because it is easy and convenient. But I want to encrypt the files with the public key of the intended recipient, so he will be the only one who can access the data in ...
2
votes
2answers
125 views

How can an attacker identify the encryption method with only ciphertext?

Assume that attacker only could obtain ciphertext, but knows that method is symmetric. Is there a way to find which algorithm was used for the encrytion? And in general, if attacker knows the ...
2
votes
2answers
125 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
12
votes
3answers
3k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
4
votes
2answers
186 views

Why does the first call to DecryptUpdate in AES-CBC return 16 fewer bytes?

While decrypting a file by CBC mode of AES algorithm, the output length is 16 bytes lesser than that of the input length. For example if you pass a buffer of 512 bytes it decrypts 496 bytes. It ...
2
votes
1answer
57 views

Authenticity of PDF document printed from Word

My MS Word Add-In generates PDF preview of DOCX file on client PC and uploads both files to server. I cannot generate PDF on server. Is there any way to make sure that the PDF is the printed version ...
2
votes
0answers
90 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
4
votes
2answers
118 views

How to securely store application data on mobile device

How can security be enhanced to the maximum in a messaging app storing messaging history on the device (like whatsapp)? I am specifically referring to methods to minimize the risk of the data being ...
4
votes
2answers
49 views

Secure encrypted storage of values that allows DB lookups?

I'm developing a system that has to store Finnish national identification numbers as securely as possible while allowing "does this identification number exist in the system?"-type queries over a web ...
1
vote
1answer
44 views

Encoding Same Message with Different IV (AES/CBC)

Let's say I encrypt a message using AES/CBC twice, with the same key but two different IVs. Is this safe? Or can the resulting ciphertexts be used against each other to obtain information about the ...
6
votes
2answers
576 views

BitLocker Password Change

My team at work was recently working on encrypting some hard drives using Microsoft's BitLocker on Windows 7 hosts. The initial encryption for the 2TB drives took several hours to complete. This is ...
-1
votes
2answers
123 views

when integrity is implemented using encryption arises any problem?

when confidentiality is implemented using encryption arises a problem: "how the receiver knows the message is really sent by the sent as it is claims?". when authentication is implemented using ...
18
votes
2answers
26k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
5
votes
1answer
101 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
1
vote
1answer
71 views

Android email encryption [closed]

Is there a reliable (in terms of security), open-source application for handling (send/receive + en-/decrypt) encrypted emails on Android? Something like TextSecure for emails. I just found a command ...
0
votes
3answers
109 views

Please critique my encryption scheme for a very small microcontroller [closed]

I am new here and not an cryptography expert; but I have been using encryption library for a while. My company is working on a small hardware device. It is powered by a microcontroller so memory is an ...
1
vote
1answer
474 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
19
votes
3answers
2k views

Why do HTTPS requests include the host name in clear text?

I'm having a little bit of trouble understanding why the HTTPS protocol includes the host name in plain text. I have read that the host name and IP addresses of an HTTPS packet are not encrypted. Why ...
3
votes
1answer
150 views

Secure Connection between two mobile (Android and/or iOS) devices

I've a Device A which will communicate with multiple devices on a network (BLE and/or NFC). All the devices will be handled a Token upon authentication which somehow needs to be transferred over to ...
0
votes
1answer
67 views

How to pick an encryption algorithm (cipher) and mode for PHP's mcrypt, for encrypting passwords?

There are numerous algorithms listed in the PHP documentation: http://php.net/manual/en/mcrypt.ciphers.php How strong is each one and what criteria to use when picking one? Also the ...
1
vote
1answer
146 views

Possible shellcode mailed to me

When I opened my email this morning I found a rather odd message in my mail box. It didn't seem like your every day spam email as it looked like a base64 encoded string and nothing else. Here is a ...
9
votes
9answers
20k views

Is Windows BitLocker secure?

Naturally I feel that I have to ask this question, since it's a built-in feature in Windows. Let's say someone has physical access to my PC, is there an easy way for them to access a BitLocker ...
21
votes
5answers
3k views

Is it possible to “read” secure (using SSL or TLS) messages if you know the message?

If I am communicating over a secure line (secured using SSL or TLS) and I send the server a message. Could someone eavesdropping tell what that message was if they knew before hand a list of messages ...
0
votes
1answer
38 views

What are the risks of file server access over wireless? [closed]

In our office, all computers connect to the network over wireless. The wireless is protected by a pass phrase and communication is AES encrypted. On the same network is a file server that is used ...
-1
votes
1answer
49 views

What would be a problem with using a block cipher to encrypt the traffic of an online game?

I have a question and can't really find the answer. Here are my 3 possibilities. I think it is the 2nd one but want a different opinion. a)The communications require a key exchange not supported by ...
2
votes
1answer
89 views

How does this encrypted webmails works?

In the last days I was looking on Tutanota, ProtonMail, LavaBoom, and others webmails that promise to respect users privacy. For all those, the one I most liked was Tutanota. I did few tests with ...