Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

17
votes
1answer
792 views

Doing a dictionary attack on RSA if you have the public key?

I'm trying to learn exactly how RSA works. Currently I have a very, very simplictic overview that goes like this. Having the public key allows you to encrypt things. Encrypting the same message ...
17
votes
5answers
3k views

Does using the same encryption algorithm multiple times make a difference?

In TrueCrypt I noticed the option to encrypt a volume with multiple encryption algorithms i.e. AES-Twofish-Serpent. Would it be useful to encrypt something with the same algorithm multiple times? For ...
17
votes
3answers
8k views

Are phone calls on a GSM network encrypted?

When I make a call on my cellphone (on a GSM network), is it encrypted?
17
votes
1answer
25k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
16
votes
6answers
7k views

How do I prevent copying of my PDF files?

One time while I was printing my documents at a copy center, I saw they dragged-and-dropped my PDFs from my flash drive to their desktop. How do I protect my files without using password? Is there a ...
16
votes
6answers
2k views

Principle of asymmetric algorithm in plain english

I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
16
votes
4answers
3k views

Is it dangerous to publicly share ciphertext?

Alice wants to share a message with Bob, but Alice and Bob can never be in the same place at the same time. We can assume they both know each others public keys (or agreed on a shared key, if that ...
16
votes
9answers
3k views

Are there any systems out there that use a one-time pad?

I'm still new to information security, but I have read a bit about the one-time pad. The point that sticks out to me the most is that it is supposedly unbreakable. Has this method of encryption ever ...
16
votes
3answers
2k views

Why do HTTPS requests include the host name in clear text?

I'm having a little bit of trouble understanding why the HTTPS protocol includes the host name in plain text. I have read that the host name and IP addresses of an HTTPS packet are not encrypted. Why ...
16
votes
9answers
3k views

Hide the fact of e-mail communication

Bob has a mistress. Her name is Alice. Bob`s wife Eve knows Bob is unfaithful, but she does not know who the mistress is. Alice does not know Bob is married. Bob needs to communicate with Alice over ...
16
votes
3answers
2k views

Is it safe to write the salt AND/OR the IV at the beggining of an encrypted file?

I want to encrypt a file with AES in CBC mode (maybe another mode is better for file encryption...I don't know, but suggestions are welcome!). What I usually do is that I first write a few random ...
16
votes
2answers
20k views

Is it possible to decrypt a satellite TV signal without using a smart card?

And if it is possible, why has it been decided to keep using a smart card for this task? I will be grateful if you can provide some practical examples on how to bypass the use of a smart card (if ...
16
votes
2answers
2k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
16
votes
2answers
3k views

How does non-ephemeral Diffie-Hellman key exchange become compromised in SSL when the RSA private key is leaked?

From my understanding, one of the major reasons we recommend Diffie-Hellman Ephemeral (e.g. DHE or ECDHE) over non-ephemeral DH, for SSL / TLS, is that compromise of the RSA private key (i.e. private ...
15
votes
7answers
9k views

What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?

I'm interested in updating this two pronged question for 2011: What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective? What cryptology is most ...
15
votes
4answers
10k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
15
votes
3answers
6k views

Block chaining modes to avoid

Everyone knows that ECB operation mode with a block cipher should be avoided because of clear and obvious weaknesses. But little attention is given to comparison of the other modes in the context of ...
15
votes
4answers
2k views

Future proof encryption possible in theory?

Let's say I have a message that I want to keep safe for the next 100 years. Is it theoretically possible? Let's say the message is unique (raw picture data, raw video video data, raw text data) and ...
15
votes
4answers
3k views

In what ways does Full or Partial Homomorphic Encryption benefit the cloud?

Can someone explain, in plain English, the practical ways FHE and PHE can be leveraged in the cloud? Some interesting (and confusing) links include this Microsoft Research PDF and this wiki entry. ...
15
votes
5answers
2k views

The aescrypt implementation hashes a password 8192 times to generate the key. Is this necessary?

I'm considering encrypting some small files (hundreds of kb apiece) using the aescrypt reference implementation. Looking at the source, it seems that the encryption key is derived from the IV and the ...
15
votes
3answers
675 views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
15
votes
5answers
7k views

SQL field level encryption, how safe is it?

I am considering encrypting my database and/or encrypting only certain columns in a few tables. Is it worth the time? I mean, how much of a burden would it be on someone if they were to get a hold of ...
15
votes
4answers
6k views

OS with encrypted RAM?

Are there any applications, JIT frameworks or operating systems that focus on encrypted virtual memory, or perhaps virtual machines that do something similar? I know there are processors (albeit old, ...
15
votes
3answers
827 views

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
15
votes
2answers
3k views

What's wrong with storing private keys in the cloud?

I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
15
votes
6answers
2k views

How can the impact of cold boot attacks be minimized?

Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
15
votes
3answers
8k views

How to encrypt database connection credentials on a web server?

OWASP advise against storing DB credentials in plain text: https://www.owasp.org/index.php/Password_in_Configuration_File However, they don't provide suggestions of how to encrypt the DB access ...
15
votes
0answers
733 views

Understanding HTTPS: why use both symmetric and asymmetric key cryptography? [duplicate]

As a Web Developer I recently realised my understanding of HTTPS is poor and am currently endeavouring to better understand it. After some initial reading I'm left a bit puzzled as to why initially ...
14
votes
10answers
15k views

Encrypting files on Google Drive

It's my understanding files kept on Google Drive are not protected. I would like to have them encrypted so that to be able to view or modify them one must enter a password. I foresee a potential ...
14
votes
3answers
929 views

start point into cryptography and encryption [closed]

Recently I am growing passion for security/encryption/cryptography. I follow some famous people in this domain on twitter and read articles over the web. However, this topic seems deep and every time ...
14
votes
3answers
2k views

Is amazon S3 secure enough to hold personal documents?

I have a client who is looking to hold personal information such as Driving Licences and Insurance documents in order to verify if a user of the site is who they say they are and lives where they say ...
14
votes
3answers
3k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
14
votes
6answers
2k views

Why not RSA-encrypt the entire document?

I have recently learned of a way for person B to verify that a document sent from person A is indeed from person A. Person A gives Person B his public RSA key. This must be done reliably. Person A ...
14
votes
3answers
4k views

Forced into using a static IV (AES)

We've had to extend our website to communicate user credentials to a suppliers website (in the query string) using AES with a 256-bit key, however they are using a static IV when decrypting the ...
14
votes
6answers
608 views

Primary Key as Salt?

Is it okay to use the primary key as the salt in a Users table? The only disadvantage that I can see is if the PK changes (unlikely), then the passwords break. What are your thoughts?
14
votes
4answers
13k views

Is RedPhone a secure and secret way to communicate?

RedPhone provides end-to-end encryption for your calls, securing your conversations so that nobody can listen in. But really, how is the probability that a voice conversation is wiretapped still? ...
14
votes
9answers
5k views

Encrypting email for gmail

My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
14
votes
3answers
5k views

Does Android encryption really prevent law enforcement access?

Google recently announced that in Android L encryption would be turned on by default: For over three years Android has offered encryption, and keys are not stored off of the device, so they ...
14
votes
3answers
4k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
14
votes
4answers
1k views

Doubling up or cycling encryption algorithms

I've occasionally read the suggestion to enhance security by either doubling up on encryption algorithms (encrypt a message once with one algorithm, then encrypt the ciphertext again with a different ...
14
votes
4answers
627 views

Database Encryption Security

I am encrypting and decrypting my database data from my web applications API. If my web server is compromised, what is to keep someone from using that same method to retrieve the data? For example, ...
14
votes
2answers
3k views

What should I know before configuring Perfect Forward Secrecy?

PFS has gained attention in our audit department because of its innate ability to limit our exposure if someone steals our private key. What pitfalls or common mistakes should I be aware of before ...
13
votes
3answers
5k views

Can Cryptolocker (Or Other Ransomware) Encrypt Files That Are Already Encrypted?

If you have already encrypted files, are they still vulnerable to being encrypted a second time by a program like Cryptolocker, or would this protect them?
13
votes
11answers
1k views

For users that does not use PGP, what would be the other channel to securely send them a document?

I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email. The real question is how to do that? ...
13
votes
3answers
1k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
13
votes
8answers
4k views

Is Steganography a safe method to store secret data?

I want to put some parts of my secret data into specific file with Steganography method. Is this method as safe as other encryption methods like RSA or SHA?
13
votes
2answers
32k views

What are the differences between MD5, SHA and RSA?

MD5 tools output hexadecimal values. In the same manner, do SHA and RSA together produce a hexadecimal (or any other) output? What are the differences between the MD5, SHA and RSA algorithms?
13
votes
4answers
8k views

Is it generally a bad idea to encrypt database fields?

I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
13
votes
4answers
5k views

What are you doing when you move your mouse randomly during a truecrypt volume creation?

Is that called a 'round' every time you move your mouse when creating a new volume? I'm talking about the screen with the random numbers during the volume creation process. What is the purpose of ...
13
votes
2answers
1k views

How Does A Random Salt Work? [duplicate]

I don't understand how using a random salt for hashing passwords can work. Perhaps random salt refers to something other than hashing passwords? Here is my thought process: The salt is used to add ...