Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

12
votes
2answers
1k views

Timing attack against HMAC in authenticated encryption?

In an answer to another question of mine, it was noted that a class using standard string comparison functions when checking the HMAC in authenticated encryption would make the class vulnerable to ...
38
votes
9answers
19k views

Are powerline ethernet adapters inherently secure?

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
21
votes
6answers
8k views

Is AES encrypting a password with itself more secure than SHA1?

This isn't really a practical question, but more a question of curiosity. I heard a CS professor recommend stepping up from md5ing passwords not to SHA1, but to AES encrypting the password using ...
15
votes
2answers
4k views

What's wrong with storing private keys in the cloud?

I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
11
votes
2answers
6k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
10
votes
5answers
14k views

What does “key with length of x bits” mean?

I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
8
votes
1answer
3k views

How does adding a random serial number improve a certificates' security?

This article says: "Finding collisions is a tricky process, since it requires you to muck with the bits of the public key embedded in the certificate (see this paper for more details). Also, ...
4
votes
11answers
4k views

Definitely safest password storage scheme?

I already asked this on StackOverflow but I was suggested this would be a better suited place and I found no way to "move" the question so I have to copy it. Believe, I know, there are hundreds ...
19
votes
2answers
41k views

Security comparsion of 3DES and AES

Which one is more secure and least possible to be broken through cryptanalysis AES or 3DES (no matter performance)? I need to use encryption for my projects to store and secure sensitive information ...
18
votes
3answers
4k views

Is SHA1 weak for SSL?

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
15
votes
5answers
2k views

The aescrypt implementation hashes a password 8192 times to generate the key. Is this necessary?

I'm considering encrypting some small files (hundreds of kb apiece) using the aescrypt reference implementation. Looking at the source, it seems that the encryption key is derived from the IV and the ...
13
votes
4answers
6k views

Does symmetric encryption provide data integrity?

Let's say I have one server that encrypts a file with a symmetric key, e.g. AES-CBC, and sends it to clients that decrypt it. Does that provide data integrity when decrypted? Or is it possible for ...
10
votes
5answers
2k views

Can voice chat be spied?

I wonder if voice chat (via public services like yahoo, google talk, skype, etc) is practically secure? Is it possible for the ISP or any middle point? I do not consider hacking the computers, but ...
9
votes
2answers
10k views

Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?

is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks. If it can, how, but if not, is there another ...
9
votes
4answers
2k views

How would you analyze an image to find out if there are scripts embedded in it?

How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
15
votes
4answers
6k views

OS with encrypted RAM?

Are there any applications, JIT frameworks or operating systems that focus on encrypted virtual memory, or perhaps virtual machines that do something similar? I know there are processors (albeit old, ...
14
votes
3answers
4k views

Forced into using a static IV (AES)

We've had to extend our website to communicate user credentials to a suppliers website (in the query string) using AES with a 256-bit key, however they are using a static IV when decrypting the ...
8
votes
3answers
1k views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
8
votes
4answers
2k views

What Partial Homomorphic Encryption implementations exist and how do I leverage them?

It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
4
votes
2answers
764 views

In a browser web server communication, who decides which encryption protocol to use [duplicate]

My IE browser has SSLv3.0, TLS 1.0,1.1 and 1.2 has enabled in the advanced settings. And (I was informed by my server admin) my web server can encrypt data in SSLv3.0 and TLS 1.0 Now which system ...
16
votes
6answers
2k views

Principle of asymmetric algorithm in plain english

I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
16
votes
2answers
2k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
15
votes
5answers
8k views

SQL field level encryption, how safe is it?

I am considering encrypting my database and/or encrypting only certain columns in a few tables. Is it worth the time? I mean, how much of a burden would it be on someone if they were to get a hold of ...
13
votes
2answers
3k views

GPG File size with multiple recipients?

If I encrypt a file for multiple users how does the file size change? Does the size of the output double for two users. How about 10 or 100 users?
12
votes
5answers
6k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
11
votes
5answers
3k views

Storing private asymmetric key in application binary?

I would like to give a daemon-style process (i.e. no user interaction) access to a shared secret key so that it can access a shared, encrypted data file. User applications accessing the same encrypted ...
9
votes
3answers
11k views

Why triple DES used in EDE mode?

Why is triple DES is calculated in encrypt decrypt encrypt mode? Why a decrypt in the middle? And isn't decrypt = encrypt since DES in a symmetric cipher?
7
votes
1answer
710 views

Should I include a random padding in every HTTPS request and response?

According to the following paper, it is possible to decrypt HTTPS traffic by inspecting AJAX calls and using the size parameter as a cryptographic oracle. Should I be sending a variable length ...
6
votes
1answer
11k views

How can I tell if a PPTP tunnel is secure?

PPTP has been demonstrated to be broken in many ways, and most installations are insecure. But it is also theoretically not broken if configured correctly. As an end-user, is there a simple way for ...
9
votes
1answer
724 views

Reversible, recoverable user data encryption scheme

From this earlier question, I have a general need to obfuscate a set of third-party credentials stored in a user account, which are then used in an internal Winforms software client. The scheme from ...
8
votes
7answers
2k views

Is there any asymmetrically encrypted file system?

Is there a file system providing a directory where everybody can write, but only the directory owner can read the files? In theory it could be done by encrypting using the public key while writing, ...
7
votes
1answer
7k views

Are there any known vulnerabilities in PPTP VPNs when configured properly?

PPTP is the only VPN protocol supported by some devices (for example, the Asus RT-AC66U WiFi router). If PPTP is configured to only use the most secure options, does its use present any security ...
7
votes
10answers
4k views

How can I share files with other individuals using the cloud in a secure way?

I would like to use a dropbox because it is easy and convenient. But I want to encrypt the files with the public key of the intended recipient, so he will be the only one who can access the data in ...
6
votes
2answers
8k views

How can I recover encrypted files after system reinstallation

I had a file which contains images and videos, I was using the windows 7 ultimate and I had encrypted the file. Now I have copied that file to my hard disk and format that operating system and again. ...
6
votes
3answers
12k views

Which type of encryption algorithms android supports, and which would be better?

I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports. Regarding DES and AES (As wiki documentation) ...
4
votes
2answers
162 views

Is the same decryption key used for data on the server as locally with Lastpass?

Lastpass stores the password databases encrypted on the server. Does it give a database to anyone who asks? If no, then what authentication (i.e. password) is used? I use Lastpass on multiple devices ...
4
votes
1answer
349 views

Has the wedge security flaw been fixed for credit cards?

According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed? Is it the same law as the one ...
3
votes
3answers
6k views

Chrome showing cryptography as 'obsolete'

Similar to this question, Chrome is showing the connection cryptography as obsolete. Opera, IE and Firefox seem perfectly fine with the connection. My guess would be the message authentication is ...
18
votes
1answer
851 views

Doing a dictionary attack on RSA if you have the public key?

I'm trying to learn exactly how RSA works. Currently I have a very, very simplictic overview that goes like this. Having the public key allows you to encrypt things. Encrypting the same message ...
13
votes
2answers
907 views

Does the haystack theory work

The haystack theory is the recommendation to put repeated characters in your password in order to make it harder for brute force to reveal. Does this have any mathematical basis? Or is it snake oil?
13
votes
4answers
2k views

Is Steganography considered encryption and subject to USA export restrictions?

I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
11
votes
4answers
8k views

What's the standard way to encrypt a file with a public key in Java?

I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the ...
8
votes
1answer
447 views

Protecting emails in your database

It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database. Not just from hacking, but from disgruntled employees or engineers ...
7
votes
2answers
2k views

ssh public/private key pair

I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
6
votes
2answers
2k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
5
votes
5answers
1k views

What's the State of the Art of Homomorphic Encryption?

I get the impression from some internet resources I have skimmed that homomorphic encryption is yet computationally very inefficient. However, an Infineon press release from 2010 says that the CPUs of ...
3
votes
1answer
2k views

What are the Netscape Cert Type attributes? Why/when are they needed?

What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions? Example: There is the Client/Server Extended Key Usage (X.509) but there is ...
3
votes
4answers
5k views

What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase

(Note: originally posted in SO - advised to post on SSE) With regards to Rijndael encryption, what (if any) are the best practices (and consequences) regarding the periodic modification of one or ...
3
votes
3answers
2k views

Is encrypting data with a private key dangerous?

I have been reviewing code for various internal apps that handle secure transmission of data with external systems. These follow the following process: RSA encrypt data with 3rd party public key RSA ...
2
votes
3answers
3k views

Why different key exhange techniques for ssl key exchange?

During ssl key exchange, I have read that sending the symmetric key to the server encrypted with the server's public key is an old technique. Now for key echange Diffie hellman and other techniques ...