Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
5
votes
1answer
94 views
Security and authentication problem
We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes.
First of all, lets imagine a real world scenario:
Imagine that a user ...
1
vote
1answer
127 views
Dual Linux System with Whole Disk Encryption
(This is a continuation of my question on Ask Ubuntu.)
My goal is I want to have a Xubuntu/Ubuntu dual boot, with a catch - I want the disk to be fully encrypted with the dm-crypt (native supplied) ...
3
votes
1answer
292 views
Will double encryption increase the security of cipher vs bruteforce?
Lets say, I have a function
encrypt(mes,key)
where :
mes = message
key = key
Length of key is 64bits.
Lets say, that only way to crack my cipher is brute force attack.
If I use
...
0
votes
0answers
49 views
Best strategy using encryption to ensure that only authorized application can access smartcard? [closed]
I want to encrypt the data in smart card to ensure the safety of the data so no unauthorized application could access these data, any suggestion about good mechanism to do that? what is the best ...
2
votes
1answer
93 views
How do I get my Encryption Certificate back?
I was using Windows 7 Professional. I encrypted a few personal pics and videos on my hard drive. Unfortunately someone deleted the encryption certificate.
Now I have installed Windows 8 and have ...
2
votes
1answer
152 views
ECDHE_RSA and gmail
I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange.
Based on my understanding of TLS and Gmail, my client ...
1
vote
4answers
101 views
certificate usage for signing and encryption
I have a question for basic operating with certificates in emails and pdfs. Im familiar with public key cryptography.
The scenario:
In my scenario I want to send a confidential email to a person A ...
2
votes
3answers
77 views
How do I transfer the HMAC?
I have a file I'd like to encrypt with a symmetric key using AES-256 and then use an HMAC for integrity. So I don't "roll my own" scheme which I know is a big mistake, what are the standards for using ...
2
votes
1answer
63 views
Can we reverse engineer binlog with row format to make MySQL AES_ENCRYPT visible?
Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual ...
1
vote
2answers
105 views
Is it bad practice to send decryptable data?
If I'm authenticating an action, is it a bad practice to authorize the connection using a decryptable hash that does have a specific algorithm, but only the remote machine knows?
Is sending ...
1
vote
3answers
121 views
Use Authentication using 2 encrypted strings
So, basically I am trying to log a user in with a cookie and do not query DB to improve performance.
Here is a brief idea:
Transmit everything via SSL
Set a Global secret key A and secret key B
...
0
votes
2answers
122 views
Encrypting Fields in Database
I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
2
votes
1answer
134 views
Does SQL Server CE 4 decrypt data securely?
I am going to store data in an encrypted SQL Server CE 4 database, where the database is doing the encryption. (Note that SQL CE is the embedded version, not the fully installed server.)
When the ...
4
votes
2answers
240 views
Evernote hacked - precautions?
On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software.
...
4
votes
3answers
176 views
Can encryption twice with two keys in different sequences lead to the same result?
I am looking for an encryption algorithm for one of my current papers. The basic requirement is that, suppose I have two keys k1 and k2, and the E(k1,t) means encrypt t with key k1.
Are there any ...
1
vote
1answer
278 views
Why so long to break 128-bit encryption?
I read that 128-bit encryption takes millions of years to break. But if I encrypt a file using say winzip that uses 128-bit encryption but the password I use is only one character long (for example ...
0
votes
1answer
243 views
Can active attacks really decrypt a particular AES-256, CBC, PKCS#7 encrypted file?
I recently found out that active attacks are a threat against AES-256, CBC mode, padded with PKCS#7 (the CBC mode in particular. I should supposedly change to EAX to guard against these attacks).
...
4
votes
2answers
218 views
How less secure is an encryption if we know something about the original data?
I have a number of files encrypted with a key derived from a password. In line with standard practice, I use a random salt and password and do many PBKDF2 iterations to obtain an encryption key and ...
1
vote
2answers
3k views
Recovering encrypted SD card after Android Factory Reset
I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card.
Phone did a factory resync and now data on SD card is still encrypted.
Is there a way ...
6
votes
1answer
284 views
Encrypting sensitive data in software and storing/decrypting it on a server
I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing.
I'm developing software which has 2 parts - a C# program run ...
1
vote
1answer
93 views
PKCS#7 message constructed by our code, any weaknesses in the output?
We have this as the PKCS#7 encrypted message. We would like to open this up for review and analysis here, for people to poke holes. This sample is generated via test certificates and keys. The concern ...
0
votes
1answer
392 views
How does PKCS#7 padding work with AES-256, CBC mode?
I'm a bit confused with AES-256, CBC, and how it works with padding (PKCS#7).
Whenever I encrypt data of multiples of 16 bytes (the block size), extra 16 bytes are always padded at the end.
For ...
3
votes
4answers
380 views
How to “demonstrate” man-in-the-middle attack?
I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project).
Over the years a bunch ...
2
votes
3answers
65 views
Are private keys generated by different software packages compatible?
I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
1
vote
5answers
2k views
Cracking CISCO ASA Passwords
I've got a copy of a Cisco ASA config and i want to crack the following example passwords
I've got the following lines in the config
ASA Version 8.4(2)
!
hostname ciscoasa
enable ...
3
votes
4answers
189 views
Is it safe to have the salt equal to IV?
If I'm using AES-256 CBC to encrypt, getting the 32 byte key using multiple iterations of the PBKDF2 function with a 16 byte salt, is it safe for me to let IV be equal to the salt?
(Edit: The salt is ...
3
votes
2answers
174 views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
1
vote
2answers
129 views
What is a better practice - RSA Encryption vs Windows authentication
I have two machines running windows OS with IIS and window OS with MS SQL. In the production web.config file I configure the IIS to use a user name and password when connecting to the DB and then I ...
0
votes
2answers
136 views
How can I encrypt something user provided without risk of the key being exposed?
So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must ...
0
votes
2answers
57 views
How can I set up signed downloads?
Scenario
I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
1
vote
4answers
198 views
Strategies to store/remember very long password?
If future proof encryption is - in theory - possible it will require long password.
What are some of the strategies for storing or remembering very long - in this case rarely used - password?
For ...
3
votes
1answer
208 views
Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?
Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects.
I need to store (or use an existing) private key on a ...
1
vote
3answers
557 views
Encrypt data within mobile app and send to web service
I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service?
Basically I will ...
3
votes
3answers
130 views
Is it safe to mix authentication methods?
Is it a good idea to "combine" authentication methods?
Example we can use username/password method to authenticate a user from a server.
What if we used this as a first authentication step to get ...
5
votes
1answer
726 views
Android / CyanogenMod encryption vs GNU/Linux
Hi I am trying to understand how encrypting an Android based phone works compared to a GNU/Linux host which relies on LUKS dm-crypt.
Here is what I understand: Encrypted LVM on GNU/Linux is an ...
0
votes
1answer
138 views
AES encrypt secret key with plaintext
We need to be able to retrieve password. Hashing is one-way, we can't do that.
So we ended up using AES.
We want to know if the following schema is safe or not. I am only familiar with modulo PK ...
3
votes
2answers
171 views
Is it reasonable to prevent timing attacks by using fixed processing time
I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing.
Part 1
Is it a good idea to ...
0
votes
0answers
80 views
Any idea what this has been encrypted with [closed]
The cipher text looks like this:-
dO+4ubRqxB801u3ZLZx2A5dvmHCbw3MnQYxDkhSRLoOJ7CFiPg7Xxhzf1T8g69iB
+JLEKvBlESQJTnSJkEEesgBnVAwrAz/v9MGgVp//gOV9xlyUca7UOI5kZglQq6WX ...
1
vote
1answer
343 views
is it possible to use smime in the webclient of gmail?
I could not find any options in the webinterface of Gmail.
all I could find was a Firefox plugin to use SMIME with Gmail, but it seems to be outdated
8
votes
3answers
269 views
How practical/important is the Lucky Thirteen TLS attack?
I was reading this article which talks about a new attack against TLS being called Lucky Thirteen. It claims to allow repeatable MitM attacks against HTTPS connections.
It's described as being fairly ...
0
votes
1answer
80 views
Auto encrypt chunks of content for backup, best practice?
I'm just curious and it's more like a mind game, I'm not into cryptography.
How would one encrypt data that's constantly generated? Put the data automaticly into chunks encrypt the chunk and send it ...
1
vote
2answers
98 views
Need a time consuming symmetric encryption
I have a database with millions of entries, each entry encrypted with a (different) password. Normally, only one entry is needed at a time. If somebody steals the database, I want to make it hard for ...
3
votes
2answers
87 views
Securing Time Sensitive Data
I have a number of time sensitive, embargoed pieces of information that I need to distribute over the Internet and have received at a precise time. I'm currently dealing with the problem by uploading ...
5
votes
4answers
127 views
How to avoid to lose data encrypted because it was encrypted by no longer supported software?
How can I avoid losing data that is encrypted using methods that may become obsolete? I have valuable family records I wish to secure, so I plan to encrypt them before putting them in long-term ...
2
votes
1answer
92 views
Credit card data - sharing and storage [duplicate]
What is the industry standard for sharing credit card data between client (thin & thick) and server?
2
votes
2answers
159 views
Utility to hide several encrypted messages in single file
I am interested, are there existing utilities/projects under way devoted to combining encryption and steganography.
I would like to
- combine two or more messages, encrypted with separate ...
3
votes
5answers
251 views
Does a binary executable have to have some critical plain-text components?
When companies package binary executables, they are often encrypted, compressed, scrambled, and otherwise made so that your lazy hacker can't simply open the program up in Notepad++ and see the code.
...
2
votes
2answers
139 views
Slow down symetric encryption
I'm developing a program in Java. In one step data should be encrypted and exported in a file.
As of now we are encrypting in AES-256
I want to slow down a possible brute force attack as much as ...
4
votes
1answer
148 views
Saved passwords (use case)
I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together.
Both the data and the password are encrypted ...
-4
votes
1answer
140 views
Secure Web application Password vault/manager [duplicate]
I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a ...
