Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

0
votes
2answers
733 views

What are the Standard Practices for Securely Storing Encryption Keys in Databases

I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ? To add a ...
0
votes
1answer
1k views

Hash the signing key of an authentication token in database

I have clients which are all browsers. All clients render just a single page application getting data from a Web API. The design of the API follows REST principles. I use token-based authentication ...
0
votes
1answer
127 views

Encryption key generation performance

A question for cryptography experts. Imagine we have a conceptual Notes.app: There are notes (title|content) stored as AES-256 encrypted strings Application has to present a list of all notes (...
3
votes
1answer
493 views

Is it bad practice to add an encrypted private key to source control?

I understand that it is bad practice to add passwords and secret tokens to source control, with obvious implications arising if you are working on an open-source or related project. Rather, you ...
0
votes
2answers
100 views

What is the meaning of “Key Deletion” operation?

In the context of Key Management and encryption/decryption, what does "Deleting a Key" mean exactly? What are the implications of "Key Deletion", in terms of: Decryption of the old data (i.e. data ...
2
votes
2answers
7k views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
1
vote
3answers
390 views

Using public/private key without signed certificate

I am working on a java program and I am now working on its network security. I want to use a secure connection since it transfers a lot of sensitive information. On all security guides it is mentioned ...
1
vote
2answers
1k views

What is best way to encrypt a blob with public key?

I need to encrypt byte arrays blobs fields of approx 50k to 100k each in .net with a public key then store in SQL/Server thendestroy original data. When the data is retrieved by the ultimate owner, ...
49
votes
4answers
26k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
3
votes
1answer
56 views

Storing original length of encrypted message

Does storing the actual length of the message in metadata make an encrypted message more vulnerable to attack?
0
votes
2answers
220 views

I need two separate hidden volumes in disk encryption. What are my options? [closed]

C: for system (Windows) D: for my files Makes much more sense to me than packing everything on the same volume, right? Is there a disk encryption utility capable of doing this? I don't know much ...
136
votes
5answers
128k views

Is Telegram secure?

There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption. But they store all the messages in their servers and WhatsApp ...
1
vote
2answers
1k views

best practice for encrypted filesystem inside a file

This is an extension of my question on UNIX. Let's suppose I create a file, map it to /dev/loop0, and create a LUKS partition inside dd if=/dev/zero of=myfile bs=1M count=1000 losetup /dev/loop0 ...
0
votes
1answer
133 views

Securely transmit sensitive data

I am creating a java application which is dependent on a server. On startup the application will transmit sensitive information (passwords and emails) which will be sent to the server and from there ...
6
votes
2answers
1k views

Are smart watches secure?

My Pebble smartwatch, like many (most?) other smart watches, uses Bluetooth Low Energy (Bluetooth Smart, BLE, BTLE, etc) to communicate with my smart phone. There's some security in the link, ...
1
vote
1answer
504 views

MySQL encryption without knowing key

I am currently struggling with how to correctly implement storage of encrypted fields in a MySQL db, without knowing the encryption key. The result I am trying to achieve is to encrypt certain pieces ...
4
votes
3answers
1k views

How is it on some removable media, when enabling/disabling password protection the changes happen immediately?

For example I have a WD Passport external hard drive. After installing WD security I can enable and disable password protection, however the settings basically get applied instantaneously. Does this ...
1
vote
1answer
125 views

Only one entry in No-SQL database needs encrypting

So I have the document format as follows: { id : plaintext, date-created : plaintext, data : binary } The data entry needs encrypting and decrypting. My idea was to have a private key, ...
8
votes
3answers
382 views

How can I allow acces to encrypted data if only 2 out of 3 users provide a secret?

I want to encrypt data, but make sure that no single user can decrypt the data. Further, it is important not to require ALL users to be present to decrypt. This will allow for some flexibility and ...
12
votes
1answer
305 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...
0
votes
1answer
99 views

How strong is this encryption? [closed]

Given Dictionary containing 1000 three-letter words: dictionary=abc,def,ghi,jkl,mno,pqr... Randomly chosen words from the dictionary: 10-bits-passwords=abc,def,ghi Randomly chosen three words from ...
0
votes
2answers
221 views

DHE Verification

I'm just struggling to get my head around this. In certificate signing with static Diffie Hellman the public key and certificate information is sent to the CA who verifies the certificate ...
1
vote
0answers
410 views

Bouncy Castle C# API and NTRUEncrypt

I want to play around with NTRUEncrypt and I found this tweet that NTRUE is now part of bouncy castle. But I cannot find any proof of the existence in the source code of teh Bouncy Castle C# API, ...
0
votes
1answer
360 views

A Question about Database Encryption [closed]

I've been looking around for an answer to this for some time now and I felt that this place would be a good venue to ask this. How can one improve the security in a MySQL database? The database that ...
0
votes
1answer
127 views

Encryption and Deniability

I have the following problem: Alice wants to send Bob a message such that Bob knows it is from Alice but at the same time he cannot prove that Alice send him this message. The solution I came up with,...
5
votes
1answer
2k views

Best practice for data security on a web application

I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information. For storing ...
0
votes
2answers
136 views

What influences the speed of rendered php page using encryption [closed]

I've built a web app which uses the openssl_private_decrypt() functions. The rendering of a page with 15 messages encrypted with these functions takes remarkely longer as the ones without. (3-4 times)...
-1
votes
2answers
202 views

Are there any mail services that don't store encryption keys?

According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for ...
0
votes
2answers
83 views

Encrypting user details

This isn't really language specific, but I'm wondering if anyone has any suggestions for a security model securely storing some user details in a way that could be accessed in an automated fashion. i....
0
votes
1answer
364 views

Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?

I would like to try to build a Virtualbox image to use with Vagrant. This is the features: Login with SSH + 2FA (Google Auth) No X No internet connection Copy unsigned transaction, sign it and ...
1
vote
1answer
478 views

Why does not GSM use any stream cipher mode (OFB, CFB)?

If I understand correctly GSM uses A5/1 stream cipher. My question is why doesn't it use a stream cipher mode like OFB or CFB?
-1
votes
3answers
6k views

Is a Pattern Lock any more secure then a typical text password? [duplicate]

I've been trying to find a way to secure a webpage that is easy to do (ie gaining access) yet still fairly secure. So, while a 4 char numeric password would be fairly quick to enter, it wouldnt be ...
2
votes
1answer
2k views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
1
vote
2answers
390 views

What are the security risks associated with storing passwords on the internet?

With products such as LastPass that store encrypted passwords on remote servers, what are the associated risks that aren't applicable to locally stored and encrypted passwords? If something is ...
6
votes
1answer
1k views

DPAPI equivalent on linux?

I have an app server and a db server. I want to send certain data to the db encrypted, using a DEK (data encryption key). Ideally, this DEK is read protected on the linux file system and encrypted ...
3
votes
1answer
9k views

How to Encrypt Credit Card number for storing it in sql server database according to PCI DSS Requirement?

According to PCI-DSS 3.4 Requirement: Render PAN unreadable anywhere it is stored by using the below methods: One-way hash Truncation Index tokens and pads Strong cryptography with associated key-...
1
vote
2answers
807 views

Idea for hiding your mobile phones' location, and still be able to place and receive calls. Any suggestions?

The diagram below is a thought experiment that could provide a certain level of privacy to mobile (smart)phone users, beyond what they currently have. Some of it is purely theoretical, but it should ...
1
vote
3answers
342 views

How to minimise risk to sensitive data in temp files in shared hosting environment before encryption?

openssl_pkcs7_encrypt() requires the data to be encrypted to be read from a file and so unfortunately it requires sensitive data to be written to temporary file before being encrypted. In a shared ...
4
votes
2answers
418 views

Is authorisation with token secure?

I have a general security question: Let's say there is a client-server application with authorisation by login and password using a secure connection between server and client (https). User can have ...
3
votes
1answer
4k views

Where to keep key file used as composite key for Keepass 2

I used to use a master password and "Windows User Account" to get into my password datasbase with Keepass 2. Then I realized the "Windows User Account" option is garbage because if you ever want to ...
0
votes
2answers
119 views

Should things that need to be reversed be encrypted?

I was told by a friend earlier that Encrypting something that needs to be reversed is a bad idea as it gives the illusion of security Is this true? The way I see it, it can't really hurt to ...
16
votes
3answers
2k views

Is it safe to write the salt AND/OR the IV at the beggining of an encrypted file?

I want to encrypt a file with AES in CBC mode (maybe another mode is better for file encryption...I don't know, but suggestions are welcome!). What I usually do is that I first write a few random ...
14
votes
4answers
2k views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
-1
votes
2answers
3k views

How to check if a transaction on a web connection is encrypted

Someone just asked me: How can I know whether a message or data is encrypted during a transaction on trading website? I know most (maybe all) online trading sites uses encryption techniques ...
6
votes
2answers
687 views

Requiring 2 keys to access a content

I need to use an external service that can only be accessed by password. I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do. Considering this ...
-7
votes
1answer
283 views

What is the excellence of RSA vs my algorithm [closed]

I was wondering that what make RSA Asymmetric Cryptography Algorithm special. So I wrote a very simple algorithm that do the same work (Generate Public and Private Key) Now I want to ask you that What ...
2
votes
1answer
1k views

Which digest algorithm to use with creating a public/private key pair

I'm generating a Public/Private key pair in PHP with the following: <?php $config = array( "digest_alg" => "sha512", "private_key_bits" => 4096, "private_key_type" => ...
-1
votes
2answers
352 views

Is AES feasible for secure hashing files? [closed]

There was already a similar topic "Why AES is not used for secure hashing, instead of SHA-x?", but it was not about files specifically, and I, personally, am not convinced by the answers in it. "AES ...
5
votes
3answers
722 views

Android and FIPS

I've recently been tasked with a research project to write a "secure messaging application" using "government approved protocols" (the government being the USA). I'm taking this to mean asymmetric ...
4
votes
3answers
2k views

What is the most secure way to send emails using PGP?

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server. GPG has several features available, namely: 1) ...