Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
10
votes
1answer
566 views
Native rsync protocol security
Is the native rsync protocol (port 873) secure? Does it encrypt data or credentials?
I'm planning on using rsync to store encrypted files in the cloud, I'm wondering whatever the password is ...
10
votes
4answers
587 views
Encrypting IP addresses in a MySQL database
I'd like to encrypt IP addresses in my MySQL database, with the following constraints:
Does not need to be resistant to attackers that can execute queries.
Must be resistant to attackers that have ...
10
votes
2answers
471 views
Storing sensitive information securely
I know there have been a few questions about this already, but I just wanted to know if anyone can take a look at my design plans to see if there are any gaping security holes. I am in the process of ...
10
votes
3answers
540 views
Encryption-Laws in Iran
According to this article Iran has criminalized the usage of encryption and VPNs.
According to this blog post it is still possible to use SSH tunnels in Iran.
For me SSH is encryption and thus ...
10
votes
3answers
777 views
How to encrypt database connection credentials on a web server?
OWASP advise against storing DB credentials in plain text:
https://www.owasp.org/index.php/Password_in_Configuration_File
However, they don't provide suggestions of how to encrypt the DB access ...
9
votes
4answers
2k views
Does symmetric encryption provide data integrity?
Let's say I have one server that encrypts a file with a symmetric key, e.g. AES-CBC, and sends it to clients that decrypt it. Does that provide data integrity when decrypted? Or is it possible for ...
9
votes
6answers
371 views
Security of email [duplicate]
Possible Duplicate:
How commonly are SSL/TLS or S/MIME used by e-mail providers?
Say, Alice uses gmail and Bob uses hotmail. Alice wants to send an email to Bob.
Alice goes to gmail ...
9
votes
7answers
5k views
Which Instant Messaging services use or allow secure protocols, and what do those protocols cover?
We all know there's a myriad of Instant Messaging (IM) services out there. But, which of these services uses or permits protocols that actually secure your communications? For those that do, what ...
9
votes
3answers
2k views
What are you doing when you move your mouse randomly during a truecrypt volume creation?
Is that called a 'round' every time you move your mouse when creating a new volume? I'm talking about the screen with the random numbers during the volume creation process. What is the purpose of ...
9
votes
5answers
1k views
Storing private asymmetric key in application binary?
I would like to give a daemon-style process (i.e. no user interaction) access to a shared secret key so that it can access a shared, encrypted data file. User applications accessing the same encrypted ...
9
votes
2answers
706 views
How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?
http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data
http://rt.com/news/uk-privacy-internet-freedom-186/
'Black boxes' will be installed by internet services providers ...
9
votes
5answers
1k views
Use RSA keypair for PGP encryption and decryption
Is there a way that I can use a RSA keypair with PGP?
What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
9
votes
3answers
703 views
How can I encrypt a file with .NET and have the same file size of the original file?
I'm using .NET and I've written an awesome routine (xD) that encrypts and decrypts a file using AES256 CBC. It works perfectly, but now they told me that the encrypted file must be of the same size of ...
9
votes
5answers
629 views
Is it worth the effort to store FTP passwords encrypted?
I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
9
votes
2answers
662 views
Does AES-192 provide better encryption than AES-256?
this wikipedia article describing AES says:
Related-key attacks can break AES-192 and AES-256 with complexities 2^176 and 2^99.5, respectively.
Does this mean that AES-256 is actually a weaker ...
9
votes
2answers
3k views
where to store a key for encryption
I am looking for a way to store a key used for password encryption. I am using a mysql db which would store a user name and an encrypted password that would be encrypted using ...
9
votes
4answers
4k views
What's the standard way to encrypt a file with a public key in Java?
I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the ...
9
votes
4answers
685 views
Why encrypt data in memory?
I saw that KeePass not only encrypts its password-database-file, it also can encrypt the passwords it holds in memory. This is just an example. I thinking of a new project dealing with sensitve / ...
9
votes
3answers
3k views
Encrypting with Mongo
How can I achieve the following goals?
All compute and storage to be located in the cloud.
Encryption in transit of all data between web nodes and db nodes running MongoDB.
How to set up tunnels? ...
9
votes
5answers
549 views
When brute-forcing DES, does knowing something about the plaintext help?
Data Encryption Standard (Wikipedia)
I know that with brute force there are 2^56 possible keys to check (56 bits, each either a 1 or 0). But let's say I know the message itself is only made up of ...
9
votes
4answers
529 views
How would you analyze an image to find out if there are scripts embedded in it?
How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
9
votes
3answers
996 views
Question about dictionary attacks on GnuPG symmetric encryption
They say algorithms like AES can't practically be broken given a long enough key length (> 128 bits). If I use GnuPG to encrypt a file using AES:
gpg -c --cipher-algo AES secretfile
it asks me for a ...
9
votes
3answers
1k views
Suitable cipher for SMS encryption
I would like to create application for encrypting SMS messages. After long enough discussions I decided to use symmetric encryption, since handling public/private keys issue is too difficult for most ...
9
votes
3answers
598 views
Is TDEA (TripleDES) invulnerable to the weak keys of DES?
The key space of DES includes some keys that are weak, which results in a ciphertext that is extra vulnerable to cryptanalysis.
Is TDEA (also known as TripleDES) invulnerable to those weak keys? Or, ...
9
votes
2answers
52 views
Do I need to password-protect an “Electronic Copy” of health information given to a patient on e-media?
I'm struggling to find good documentation regarding requirements around security and encryption of patient clinical information when delivered to a patient in electronic format. Patient portals, ...
9
votes
1answer
336 views
What role does cryptography play in anti-piracy?
As a follow-up to Cipher for Product Registration, are there secure yet usable cryptographic standards/protocols for protecting software and data used by software? I'm interested in hardware and ...
9
votes
1answer
239 views
Reversible, recoverable user data encryption scheme
From this earlier question, I have a general need to obfuscate a set of third-party credentials stored in a user account, which are then used in an internal Winforms software client. The scheme from ...
9
votes
1answer
210 views
Optimal variable sizes in the Secure Remote Password protocol
I am implementing the Secure Remote Password protocol:
U = <username> -->
<-- s = <salt from passwd file>
a = random()
A = g^a ...
8
votes
5answers
902 views
Confusion: Why isn't a passhrase encrypted SSH key two factor auth?
I'm trying to figure out the best practices for accessing my devbox from a public terminal.
Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
8
votes
7answers
12k views
How can I determine the encryption strength of an SSL connection
If I've connected to a https url, how can I determine the cipher strength of the connection? My understanding is that after the asymmetric public-key handshake the information is encrypted using a ...
8
votes
5answers
338 views
What can one do when encryption methods fail?
I'm in search of an expert to answer my curiosity. Suppose that methods like AES/DES, SSH, PGP, RSA, etc. can be cracked or fail somehow. In other words, suppose that it's possible to determine one ...
8
votes
3answers
1k views
What common products use Public-key cryptography?
I want know what common use products are there that use public key/private key cryptography?
8
votes
5answers
7k views
Compute the AES-encryption key given the plaintext and its ciphertext?
I'm tasked with creating database tables in Oracle which contain encrypted
strings (i.e., the columns are RAW). The strings are encrypted by the application
(using AES, 128-bit key) and stored in ...
8
votes
5answers
1k views
What is the benefit with using encrypted RAM Memory?
I sometimes hear that encryption is used for the RAM Memory, but I don't really understand why this is needed.
Why is RAM Memory needed to be encrypted? and is this done by the hardware, the ...
8
votes
5answers
2k views
How can I decrypt data with Java, without hard-coding the key?
I hope this is not a chicken-egg problem or reinventing the wheel but here goes.
I have a Java application that needs to access a password protected file (actually during the application startup).
The ...
8
votes
5answers
1k views
How can encrypted traffic bypass the Great Firewall of China when it is being blocked?
The Great Firewall of China is controlled by the government and has put in place a "learning algorithm" to block unapproved encrypted traffic. The only way to get encrypted traffic through the ...
8
votes
3answers
618 views
In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?
It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...
8
votes
5answers
5k views
How secure is NTFS encryption?
How secure is the data in a encrypted NTFS folder on Windows (XP, 7)?
(The encryption option under file|folder -> properties -> advanced -> encrypt.)
If the user uses a decent password, can this ...
8
votes
4answers
599 views
Automated encryption detection
Is there any program that, given a cipher text, it would tell me what the encryption algorithm is?
What if I have the plain text? Is there something that can be done in that case?
8
votes
4answers
2k views
moving from MD5 to SHA-512
This question is more of a security policy than a technical security question.
Many years ago I developed an asp.net site, implemented Forms Authentication, and stored the user passwords as MD5 ...
8
votes
3answers
440 views
Most widespread use of PGP after 20 years
Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP ...
8
votes
1answer
522 views
Truecrypt compromised?
In light of recent developments in computer forensics and "password recovery" utilities, can encryption technologies such as TrueCrypt still be relied on for a high degree of protection?
It would ...
8
votes
7answers
2k views
Why can an encrypted private key be brute forced?
When using SSH keys to authenticate to a server for remote access, why is it possible to devise the true key and therefore the passphrase from an encrypted private key, without checking each guess of ...
8
votes
3answers
274 views
How practical/important is the Lucky Thirteen TLS attack?
I was reading this article which talks about a new attack against TLS being called Lucky Thirteen. It claims to allow repeatable MitM attacks against HTTPS connections.
It's described as being fairly ...
8
votes
2answers
3k views
Checklist on building an Offline Root & Intermediate Certificate Authority (CA)
Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite.
Here is an image of the default cryptography settings ...
8
votes
3answers
742 views
Security implications of storing the password hash along an encrypted AES key
I am using the PKCS#5 standard to generate a key using a random and unique salt and the user's password in input. Consider this key as the "encryption" key.
The "encryption" key is used to encrypt a ...
8
votes
2answers
809 views
Which cipher suites with AES cipher provide forward secrecy?
Does standard AES with RSA (reported by Opera as TLS v1.0 256 bit AES (1024 bit RSA/SHA)) provide perfect forward secrecy?
Which SSL3.0 and TLS1.0 ciphers do provide forward secrecy?
Which ciphers ...
8
votes
2answers
314 views
Are phone calls on a GSM network encrypted?
When I make a call on my cellphone (on a GSM network), is it encrypted?
8
votes
3answers
562 views
Is it safe to store a single symmetric key encrypted with several different RSA public keys?
For the field-based encryption of a database containing sensitive information, I was thinking of the following design:
Every user has a smartcard used for client certificate login.
After login the ...
8
votes
3answers
485 views
Does the SSL encryption strength of a website really matter?
When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart.
Immediately there seems to be 4 major ...
