Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

4
votes
1answer
59 views

Infinite one time pads, brute force multiple pads?

So based on my understanding using the same key for encrypting two completely random plain texts when using an otp cipher will still retain perfectly secret. This is based on the answers on this ...
3
votes
3answers
120 views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
-1
votes
1answer
51 views

Using and creating a custom 2 way encryption function [closed]

I am trying to create a 2 way encryption function using PHP. As yet I do not have a very good system at all, it is severely flawed and highly insecure, it is using a substitute cipher running from ...
1
vote
1answer
54 views

How can I extract the encrypted master key from LUKS header?

I know that a LUKS partition has a plain-text header that stores many informations like master key (MK) digest, MK iterations of PBKDF2, information about the 8 key-slots etc. I also know that in the ...
20
votes
1answer
2k views

TLS Bicycle Attack - What cipher is free from flaws to use?

Recently a novel attack on TLS stream ciphers was developed by Guido Vranken, dubbed Bicycle and referenced in this Websense's blog post. It was based on a characteristic of stream ciphers that says ...
3
votes
2answers
114 views

RAM Encryption. Is it possible? [duplicate]

Without adding any additional hardware, is RAM encryption possible? If so are there any known and currently used implementations for Linux or Windows systems? And if this is something that is possible ...
-2
votes
1answer
97 views

LastPass Emergency Access

any idea how "emergency access ", the new feature of the last pass, is working? I cant find any detailed information on the encryption/decryption process. How can we be sure that they don't keep a ...
4
votes
3answers
90 views

Securely storing an encryption key on AWS

Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server? I am storing encrypted information in a MySQL database and my cryptography key is stored ...
0
votes
1answer
126 views

Encrypting the System Infrastructure

The requirements are to Encrypt the data in our servers 'at rest' and the 'database' - in short the whole infrastructure. Threat Model - to protect a possible data-breach by an adversary (or from ...
0
votes
0answers
31 views

can I recover encrypted image files from an old Android phone where I know the pin used but the device key is unknown?

I think I know the OS version that was used to encrypt the images but I don't know if that is relevant. I assume if I know the encryption algorithm/software used (ie. CryptFS) and can brute force the ...
4
votes
0answers
49 views

Bidirectional encrypted server to server communication using TLS

I have 2 Windows servers and would like to set up encrypted communication between them using TLS. I've been reading up on TLS and X.509 certificates and I think I have a reasonable plan, but would ...
4
votes
1answer
57 views

What types of trade-offs are appropriate when using encryption/authentication on devices with low bandwidth?

This is my first foray into this Stack Exchange, and I have limited knowledge of the InfoSec world, but I'll try to make this a pointed, answerable question. I'm tasked with investigating including ...
1
vote
1answer
61 views

chrome app (javascript) - storing encryption password in memory

I'm building a chrome app that encrypts user messages on the client. The encryption is performed using the forge js library. I want to ask for the encryption password once, and use it to encrypt all ...
3
votes
3answers
238 views

Paypal has red lock by https?

This is what paypal says when I log in near the top left near https://. Is this ok?
2
votes
1answer
48 views

Licensing system for client side code web application

I have a client-side web application running on SharePoint Site Collection, each site collection has it's own unique id. I want to use a licensing process to lock the app to a site collection. This ...
0
votes
2answers
76 views

GET Security over HTTPS [duplicate]

I am wondering if using the HTTP GET method over HTTPS to pass a username and password to a middle tier application would be safe. Essentially I am considering using a PHP include statement to ...
8
votes
1answer
391 views

How to use encryption on a site that only uses an IP address, no domain name?

You can use SSL/TLS certificates and etc. on sites with domain names, but I don't know if it's possible to use them for IP addresses. If this is the case, would I have to use a self-signed cert and ...
4
votes
1answer
54 views

Protect sensitive information in a password-free, shared database

I'm working on a webserver that stores resources in Redis. To make swarm-deployments as hassle-free as possible, I'm implementing an option where the server doesn't need to access the filesystem to ...
-5
votes
1answer
38 views

Help to identify this type encoding/encryption? [closed]

What type of encoding/encryption is this? $1$JbzSrvQl$WMLs938aP.EeDn/0dDFQx/
7
votes
2answers
68 views

What does “revoking” a key actually do?

I am currently encrypting some personal information using gpg (gpgdir actually). I have a copy of my private key printed onto a sheet of paper in the form of a data matrix lest I lose the digital copy ...
3
votes
1answer
56 views

Where to store IV and salt when doing clientside encryption with no server

I'm making a chrome app that does client side encryption of user messages. There is no server in my architecture. The encrypted text messages are saved as files in the user's Google Drive. I'm using ...
5
votes
1answer
55 views

Why is the Key Derivation Function important?

Let's consider this openssl command : openssl enc -aes-256-cbc -pass pass:PASSWORD Why is it important to have a good Key Derivation Function? This answer to another question suggest that GnuPG is ...
-1
votes
2answers
78 views

Which is more secure a full disk or file encryption? [duplicate]

There are probably two ways to encrypt your computer full disk encryption which completely locks down the computer between when it is off and when it has booted but after everything loads you computer ...
-1
votes
1answer
43 views

Is there any kind of encryption that returns constant number of characters?

I wonder if there is any kind of publicly known encryption (not hashing) algorithm that generates constant number of characters independent of the input. I have came across an online platform that ...
3
votes
1answer
84 views

What are the problems of using OTP encryption with TRNG?

I've programmed a simple One-Time Pad "encryptor" that can merge two files into one by using bitwise XOR. The pseudo-random key files are generated by using the CryptGenRandom() function from ...
10
votes
3answers
722 views

Using encryption inside of SSL connection

We are using SSL to make our connection between clients and backbone servers safer. Does it really make sense if also we use another encryption mechanism to encrypt transmitted data twice? For ...
8
votes
3answers
230 views

what does LUKS header contain?

What is contained inside the LUKS header ? I know, the header has size of 2MB. Also, cryptsetup supports "detached header", where the header can be stored in a separate file. Thus, for example, I can ...
1
vote
1answer
35 views

How does AES-GCM handle large blocks with a 128 bit key?

I would like to apply AES-128 byte encryption on GCM mode. I know the logic to apply AES_GCM using 128 bit data. But I have a larger data to encrypt (Not necessarily multiple of 16 bytes). As the ...
3
votes
1answer
136 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
2
votes
1answer
108 views

Strange RSA usage - how secure is it?

Is following communication scheme secure? To my mind, it uses RSA modulus and public key exponent as a cryptographic secret, which is strange usage of RSA, but can it be easily broken because of ...
3
votes
1answer
43 views

How and when is a MAC sent across during a TLS connection?

I have been trying to get my head around the MAC part of the TLS connection as both the key exchange and cipher seem to make sense. As far as I understand the MAC is used to ensure that the ...
3
votes
1answer
62 views

What is the best method for key exchange?

I have application working between server and client. All messages must be encrypted and decrypted. I use AES algorithm and I want method to hide the key. I found Diffie-Hellman algorithm, but my ...
22
votes
1answer
1k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
2
votes
1answer
54 views

Possible security risk with disk encryption key getting swapped to the hard drive

I've recently read about the cold boot method, where it's possible to obtain the key for an encrypted filesystem from DRAM. This can be done even after the computer is turned off, but it requires ...
3
votes
3answers
127 views

File encryption on a solid state drive

It seems a lot of computers are switching to solid state drives, and one of the downsides of this is that it seems to make encryption of individual files basically useless, because when you encrypt a ...
2
votes
0answers
48 views

Safe to Encrypt ClientId (Integer value) to use as Client Key?

Asked a follow up question (see this link). Based on my understanding, I have to issue an unique ClientId and Client Secret Key to the API subscribers right after the registration phase (client lives ...
-2
votes
2answers
135 views

How are people still copying and redistributing DRM-protected music

...when DRM-protected material is encrypted using the AES cipher, which there are currently no efficiently computable cracks for?
2
votes
1answer
135 views

Purely as a technical matter, is it possible to make otherwise-strong encryption implemetations that contain governmental backdoors?

So to be clear right-off-the-bat: I think re-designing modern encryption to include governmental "backdoors" is, on balance, a quite bad idea, for any number of good reasons. Nor (FWIW) do I actually ...
4
votes
1answer
50 views

Which protocols employ cover traffic

Do the protocols employed by wpa 2 and vpns use "cover traffic". A constant busy signal that would not allow for meta data analysis. If not is there a service that does this for you.
0
votes
2answers
119 views

Is hack.chat safe from packet sniffing?

So I recently found this tool called hack.chat. It's a disposable, browser-based IM system. If I were to use this at a friends house, public network, or at work, it is possible for someone on the ...
3
votes
2answers
126 views

Intercepted encrypted traffic

If your internet connection is encrypted, will snoopers still be able to tell when you are active; for example, clicking a link as opposed to merely reading a webpage. Will a snopper be able to see ...
2
votes
0answers
67 views

Unable to access “encrypted.google.com” with “proxy.googlezip.net”

I use Google data compression proxy with Firefox (Abrowser 38). Most websites are loaded without any problem but unable to access encrypted.google.com So, is this is normal? i.e I've to use system ...
-2
votes
1answer
81 views

Storing Data Without Knowing Anything About the User

Let me start by stating that this is really my first foray into encryption. I have written username/password systems, and such, and am familiar with salting and hashing passwords... but I have never ...
2
votes
1answer
46 views

Crypto in browser

It's almost 2016 and javascript encryption libraries have been around for a while. My question is, have they improved? Or should we still abandon the idea of having encryption done in our browsers? ...
1
vote
0answers
32 views

AES keyfile size

I would like to encrypt files using a key file instead of a password. What I would do is: 1) Generate X random bits using openssl rand X > mykey 2) openssl enc -aes-256-cbc -in secretfile -out ...
2
votes
1answer
54 views

Sniffing WPA2 PSK traffic with the key but without association

Assume a situation where a wireless access point is using WPA2-PSK, and it is configured to allow only a single client association at one time. Client A connects to the access point with PSK and ...
1
vote
1answer
87 views

SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication

Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true. Let's say we have the following variables for ...
2
votes
1answer
82 views

WebCrypto algorithms and differences with other crypto libraries

I was looking at the WebCrypto crypto libraries coming form the W3C. Looks like only a few cryptosystems are supported, including AES-CBC, AES-CTR, AES-GCM, and RSA-OAEP. ...
-3
votes
2answers
179 views

How secure are Skype calls?

How secure are Skype voice and video calls? Obviously they do not use end-to-end encryption, so anything transmitted can be read and stored by Microsoft. But what about other 3rd parties? What do we ...
0
votes
1answer
57 views

How to encrypt something with a key? [closed]

I read a lot about security on the internet, especially how services like telegram work with their encryption and how they do it. I also heard of the Diffie-Hellman Key Exchange, which was quite ...