Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

1
vote
2answers
196 views

Protecting passphrases within an application

First off, I'm not very familiar with encryption best-practices. My use-case is simple: I'm creating an application that will be reading encrypted documents and decrypting them dynamically to do some ...
9
votes
3answers
6k views

Is multiple encryption a good idea?

I know that many encryption algorithms, while secure, have vulnerabilities. To reduce risks, would multiple encryption like this Blowfish_CbC ( Rc2_OFB ( AES128_CBC (myfilecontent))) be a good ...
10
votes
2answers
16k views

Do VPNs provide sufficient protection over public wireless networks?

I know that VPNs are the standard way to secure communication between a remote user and their primary network, but I've never felt entirely comfortable relying on them when using an open wireless ...
63
votes
5answers
22k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
1
vote
3answers
357 views

Logic for generating Strong Password?

I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website. Is there any logical suggestion or step function to generate strong ...
0
votes
2answers
531 views

Anonymous proxy over SSL [closed]

Can you name any anonymous proxy software that don't use VPN connections? Basically, I'm analyzing different encrypted traffic and now I need to analyse a simple anonymity proxy traffic. I'm analyzing ...
2
votes
1answer
8k views

Encrypting string in JavaScript and decryption in Java [closed]

I would like to know if there is any library to do encryption in JavaScript and decryption in Java. I have already tried many APIs, but am not getting the same values in Java. I want public-private ...
6
votes
3answers
1k views

Computer decryption algorithms and knowing the solution

This is a general question about using computers to decrypt information. It has puzzled me for a while. The question is really two parts: How does a computer check if a "guessed" key is the correct ...
3
votes
2answers
568 views

Signing data bigger than allowed RSA Block size?

I've enountered a small problem while implementing a modified version of the Station-to-Station protocol (STS). Say we have two principals A and B, where both of them knows the other's public key: ...
2
votes
2answers
11k views

Excel 2007 Encryption Strength

With a strong password of 10+ characters, mixed case, etc... Is the encryption of a Excel 2007 document secure enough to create reasonably strong defense against a brute force attack? What encryption ...
1
vote
4answers
2k views

Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?

I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following ...
9
votes
3answers
6k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
2
votes
3answers
747 views

Please recommend best-practices documents for sharing encrypted data with non-technical end-users

Is there one, or several, "best practices" documents which cover in clear simple language how to share data among a non-technical support staff and non-technical end-users at various organizations? ...
1
vote
1answer
188 views

How dependable can data encryption be without re-entry of password on startup?

I posted a comment awhile back, and thought I would turn it into a question. Example: There is a feature in the Microsoft SQL Server for full database encryption, which seems to have an option that ...
1
vote
1answer
896 views

Testing my network using aircrack-ng not working

I an using Fedora 17 With Intel 5100 card. When I execute the command: [root@fedora user]# aireplay-ng -9 mon0 10:26:46 Trying broadcast probe requests... 10:26:46 Injection is working! 10:26:48 ...
0
votes
1answer
506 views

Should I encrypt data on my server as an extra layer of protection?

I'm going to create a client-server application that stores a user's sensitive financial information on the server. I would like to encrypt this data so that even if a hacker gets access to the ...
2
votes
1answer
859 views

Vulnerabilities in Host Proof Hosting

I've recently been doing some research on Host-Proof Hosting, specifically in a web app environment. It seems like a pretty rock solid method of security, but I'm certainly not a security expert and ...
4
votes
2answers
2k views

How does VPN encryption work?

I've been searching and searching, but I can't seem to find a good-enough technical explanation. From what I've gathered, there are two "things" able to secure VPNs: 1) Pre-Shared Key: This handles ...
2
votes
1answer
1k views

How do I securely store and retrieve a many-time use key?

I am performing some symmetric database encryption/decryption in .net. I am using a single 256 bit private key. (1) Where do I store this key when not in use? (2) How do I securely retrieve this ...
6
votes
2answers
1k views

Does using both GPG encrypted files and encrypted filesystem make sense?

For a few years i stored my personal text files encrypted using an asymmetric key through GnuPG. Now i thought that it is a good idea to also encrypt my hard drive partition. Does it make sense to use ...
11
votes
5answers
3k views

Is it worth the effort to store FTP passwords encrypted?

I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
3
votes
3answers
213 views

How to know who I am protecting database information from?

I am trying to determine whether I need to use transparent database encryption (TDE) or encryption at web server to protect data in a database. Here are a couple articles I've read on the subject, ...
5
votes
5answers
678 views

Can hash functions be used with CTR or OFB mode?

I have been writing a class that encrypts and decrypts with block ciphers. I want to use Counter Mode(CTR/CM). We know that Counter Mode generates a keystream basing on counters, then XOR the ...
-1
votes
1answer
539 views

What encryption hash function I should use for password securing? [duplicate]

Possible Duplicate: How to securely hash passwords? What is the best encryption algorithm? MD5, SHA1, SHA2 or maybe something else? Can you explain me why?
4
votes
3answers
177 views

I want to have the security of my crypto code checked, how should I go about doing so?

Specifically part of my system stores encrypted information in a database. I wrote the code that actually does the encrypting/decrypting using an existing cipher. How should I go about making sure ...
5
votes
3answers
13k views

Better techniques than url parameter encryption

I'm a programmer working on an application where the only choice/vs/deadline was to implement symmetric encryption on url parameter values. The data is insensitive in nature, but we needed to prevent ...
5
votes
1answer
327 views

SSL CipherSuite Choices

In SSL/TLS, is the CipherSuite chosen by the server or the client? Also, can the certificate in any way dictate or modify the CipherSuite?
2
votes
0answers
64 views

Using GPG or PGP for symmetric database encryption/decryption in c# [duplicate]

Possible Duplicate: Using GPG or PGP for symmetric database encryption/decryption in c# I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short ...
3
votes
1answer
1k views

Using GPG or PGP for symmetric database encryption/decryption in c#

I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short pieces of information, which need to be individually encrypted when a specific method is called. I ...
11
votes
1answer
5k views

When using AES and CBC, is it necessary to keep the IV secret?

If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key? ...
3
votes
1answer
114 views

Is it a bad idea to let the user responsible for his own symmetric key?

I work for a company that provides a web app where we would like to give the user some sort of "digital safe". In this safe, the user can store and download whichever files he wants. The idea is that ...
2
votes
3answers
2k views

When to use the different types of Encryption / hash algorithm?

I'm studying for CISSP and know they will ask what type of encryption to use in different situations. Does such a list exist or is there a general rule of thumb to use?
9
votes
4answers
6k views

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them. When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
10
votes
2answers
1k views

How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?

http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data http://rt.com/news/uk-privacy-internet-freedom-186/ 'Black boxes' will be installed by internet services providers ...
1
vote
0answers
220 views

OpenPGP CFB mode examples [closed]

Does anyone know where to get worked out examples of OpenPGP's CFB mode encryption? I know RFC 4880 explains it very precisely, but I managed to mess it up somehow. I got one example from asking on ...
14
votes
4answers
10k views

Is it generally a bad idea to encrypt database fields?

I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
10
votes
5answers
2k views

Can voice chat be spied?

I wonder if voice chat (via public services like yahoo, google talk, skype, etc) is practically secure? Is it possible for the ISP or any middle point? I do not consider hacking the computers, but ...
3
votes
1answer
419 views

Is there a way to store user files without being able to decrypt them?

I'd want to build a secure file storage web application. Currently ordinary password authentication is used for login. After login this password is used for encryption and decryption of user files at ...
8
votes
3answers
1k views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
1
vote
4answers
470 views

Are there vunerabilities with this authentication mechanism?

I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire. I was ...
1
vote
2answers
492 views

Hash, encryption of file… key? Need help [closed]

So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an ...
1
vote
0answers
325 views

what is this hash type? [closed]

Actually I have this hash but I don't know what cryptographic hash function generated it. 4753305A7A673D7A5A442156 I know password is 12345678 I extracted this pass from PLC device Mitsubishi
0
votes
2answers
660 views

How to safely collect bank account from website?

I want to collect bank account information from my customers on my website. I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or ...
2
votes
2answers
2k views

how long does it take to brute force varying encryption standards?

Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
2
votes
1answer
177 views

How are AV scanners protecting against encrypted (PGPd) malicious code?

As a user of PGP I worry about receiving a virus that was previous encrypted with my public key, which anybody can get by querying many PGP key servers. What prevents an attacker to target a PGP user ...
2
votes
1answer
2k views

How does small dish satellite secure their signal?

For example how does Direct TV's small plastic cards control who receives the TV signal? How is the signal encoded in a way that can allow future updates without the provider needing a new satellite? ...
2
votes
1answer
63 views

Does SGC Support reduce HTTPS security?

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption. This article says SGC should never be ...
4
votes
3answers
3k views

What does it mean for a digital certificate to be “signed”?

When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
0
votes
1answer
282 views

any small idea to decode this algortihm from php script [closed]

So I think the algorithm is based on the php function ENCODING_decode defined in includes/encoding.php (which i don't have) . The encoded result $xId_campaign_encoded from the php script has ...
2
votes
2answers
170 views

Why would encrypting data result in a call to a Domain Controller

This KB article mentions an issue where signing or encrypting information may result in a network IO call to a Domain Controller. Apparently the RSACryptoServiceProvider's SignData and VerifyData ...