Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

1
vote
2answers
342 views

Nested encryption for multiple users

I've developed a web application (developed in .NET MVC 4) which have multiple users with personal login credentials. The web application holds a lot of content uploaded by the users. My client would ...
11
votes
2answers
559 views

Forward secrecy for kids

In the Scouts, it is popular to use secret codes to write messages (which are simple ciphers). I want to introduce Forward secrecy to the kids so they can use it with these ciphers. So, if the ...
3
votes
1answer
227 views

Can we build a key exchange protocol without certificates?

Assume that the server and the client both has some secret key K. Is it possible to have a key exchange protocol with authentication between them such that MITM attack cannot hold and if the key is ...
1
vote
1answer
350 views

What is the strength of the key derivation function on Android device encryption?

What is is strength of the key derivation? Specifically, how many milliseconds or microseconds would it take a desktop computer to check a guessed password to see if it is a match? I am aware this ...
1
vote
1answer
220 views

SAML2 encryption

I am new to SAML2 and have a question. We have a customer that is saying that they want to encrypt the user data they are sending to us. Here is an overview of how I have this implemented today: User ...
2
votes
3answers
148 views

Limit attempt of user login against PBKDF2

I have been tasked been tasked by my boss to change the encryption system of our web application from MD5 to PBKDF2 as MD5/SHA1 has been shown to be breakable in recent years . I argued against it ...
0
votes
1answer
58 views

Is embedding the EAX nonce inside the Associated Data considered safe?

As the nonce bits would be used twice in that case, does that break EAX security? The examples I've seen using EAX have separated the nonce from the Associated Data, but to me it makes more sense to ...
0
votes
1answer
273 views

Protecting user data via encryption

I am working on a fitness app, and it is going to have the following user data: email, first name, last name, birth date, height, weight over time, Body Mass Index over time and heart rate over time. ...
1
vote
2answers
725 views

Google's usage of RC4

I was reading about Google's usage of RC4 and an answer on stackexchange website stated the following: I know Google uses RC4 for most of its services, and this is the reason one shouldn't keep ...
0
votes
4answers
375 views

How does an encryption key work? [closed]

I'm having trouble understanding how an encryption key works. for example: if the word was 'hello' its encrypted value could be 'GHSSDgsd2', what would happen to the encrypted value if the key was '...
0
votes
0answers
32 views

How does an encryption key work? [duplicate]

I'm having trouble understanding how an encryption key works. for example: if the word was 'hello' its encrypted value could be 'GHSSDgsd2', what would happen to the encrypted value if the key was '...
3
votes
2answers
2k views

What are the pros and cons of using a password safe instead of writing passwords on paper?

Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
5
votes
5answers
3k views

Credit card information being sent over HTTP? [duplicate]

My fiancee was browsing a website (www.medievalbridalfashions.com) and about to make a purchase when I noticed something. During checkout, everything appeared to be getting sent over plain HTTP. I ...
5
votes
2answers
1k views

Encrypt user data when they log in with Facebook, Gmail, etc

I made a login system. The user can login by: using a normal email / password (bcrypted). using a service like facebook, gmail, etc. So far so good. Now I want to store sensitive information (ftp ...
-1
votes
2answers
150 views

Executing PHP WeService script by clicking a link within an e-mail

I'm receiving e-mail from my PHP/MySQL application with certain links. I was thinking on including an UUID as part of the link, which would point to a Web Service that ONLY reads those UUIDs. Those ...
0
votes
1answer
147 views

Encrypting data in a load-balanced application - am I doing this right?

A web application I'm developing needs to store some sensitive data in a database. I need to be able to retrieve and use this data later on so hashing isn't enough. The web application might, at some ...
1
vote
1answer
154 views

How to generate Initalization Vectors correctly

I'm working on a project that splits large files into several encrypted fixed-size blocks (e.g. 4KiB). Those blocks shall be used to be stored persistently on a storage device. Blocks are encrypted ...
-2
votes
2answers
330 views

I want to implement UART module in Xilinx with Encryption functionality so which algorithm i shuld choose RSA or AES [closed]

i designed code for uart module now i want to include Encryption code before sending the data which algorithm is better for me RSA or AES
1
vote
2answers
1k views

Security of several files all using same password/key (7zip, AES256)

I'm working on a simple secure mirror for potentially untrusted services like Dropbox, Owncloud and so on. (Current code may be seen here: http://www.codeduce.com/extra/secure_mercurial) Currently I'...
-3
votes
1answer
67 views

Algorithms to store and send data

I would like to store data, and send it by mail. What is the best way to encrypt it, and being able to decrypt it? My guess would be RSA, but is there a better way? (Considering that the other person ...
1
vote
0answers
65 views

Needed: Reference data on the rate of adoption of secure email protocols [closed]

I am working on a security presentation in which I need to show that the incidence of unencrypted email protocols (e.g. POP, IMAP without STARTTLS) over the past 10 years has decreased and the amount ...
0
votes
1answer
152 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an SSL-...
10
votes
4answers
5k views

Location to store an encryption key

I'm building a secure system which stores messages on a server in a Postgresql database. The messages are stored encrypted with PHP's openssl_encrypt() function with the AES-256-CBC method. At the ...
2
votes
3answers
179 views

Should we encrypt in-app user messaging?

We have an app running where among other things people can send messages to each other. Obviously admins and content managers that have access to CMS can see what people are sending to each other. Is ...
75
votes
5answers
12k views

What kinds of encryption are _not_ breakable via Quantum Computers?

There's the recent article NSA seeks to build quantum computer that could crack most types of encryption. Now I'm not surprised by the NSA trying anything1, but what slightly baffles me is the word "...
4
votes
2answers
7k views

Why would you need a salt for AES-CBS when IV is already randomly generated and stored with the encrypted data?

I was looking at this code and came across these comments which says encrypting without a salt is insecure. Why would it be insecure when you are already using a random IV for each value? I think the ...
3
votes
2answers
2k views

What does Gazzang zNcrypt actually protect against?

In an effort to increase security of our website, I'm reading up on Gazzang zNcrypt, which claims to protect data in databases from breaches. Technically, it seems to do filesystem encryption. As far ...
4
votes
3answers
298 views

Is there any reason in particular encryption keys aren't arbitrarily large?

It's my understanding that the more bits an encryption key has, the longer it takes to break the encryption. What is the down side of having a larger encryption key or why don't we see keys of size 2^...
2
votes
2answers
208 views

How secure are the GPG/PGP keyservers?

Importing a GPG key with a KeyID or fingerprint seems to rely on keyservers. Doesn't this invite man-in-the-middle attacks, in which someone would alter the keys to allow them to decrypt the data? ...
3
votes
3answers
765 views

validate file encryption without decryption key

I may be asking for something impossible here. I want to know if it is possible to set up a 3rd party storage system where the service provider cannot decrypt the clients files, but can de-dupe the ...
-3
votes
2answers
110 views

Facing hard encryption [closed]

I have a little problem with encryption. I have this cipher text "AA969CF9657F77C597C8EAFF1594D59374E4977F" and i know that correspond to "http://jogos.meo.pt/". I have another samples, but i can´t ...
2
votes
5answers
2k views

Is asymmetric encryption vulnerable to man-in-the-middle attacks?

I'm looking for ways to send private messages over a public channel, and in doing this I stumbled in asymmetric encryption, which is just perfect for what I was looking for at first - A and B ...
1
vote
1answer
270 views

How can brute force scripts tell once they're found the correct key?

If you have a random block of data and you encrypt it with a key, how can a brute force script tell when it has found the correct key? Is it possible without some sort of reference to the original ...
1
vote
2answers
886 views

Is SSH secure and what are the recommended modes of operation?

Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH? It seems there has been very little discussion ...
0
votes
1answer
198 views

Any issues with this security design for cloud storage? Server doesn't even need to know password to log someone in

I've created an algorithm I think I'm going to use for a cloud storage service I'm developing- if there are no issues or vulnerabilities with it. It's this along with TLS and forward secrecy ...
1
vote
1answer
99 views

How to change TEA round count? [closed]

I cribbed the public domain TEA source from wikipedia ( http://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm ), looks like this - uint32_t v0=v[0], v1=v[1], sum=0, i; /* set up */ ...
0
votes
3answers
146 views

Best way to store passwords for a LAN tool?

I am making an app in Python for linux as a front end to the router (to automate some tasks). But I need to log in to the router before I can do any operations on it and since it uses a http-auth I ...
7
votes
2answers
4k views

Risks of client-side encryption using Stanford Crypto Library

I'm building a simple web application for encrypted chat. Each message will undergo 256-bit AES encryption on the client side, using the Stanford Javascript Crypto Library. No unencrypted data or ...
0
votes
4answers
241 views

Is knowing 'a' encrypted with 'b' and 'b' encrypted with 'a' a possible threat?

Excuse me for question name, but I couldn't find any other suitable title. I want to validate client connecting to the server. My algorithm looks like that: Clients sends his login - plaintext ...
2
votes
2answers
3k views

What are the vulnerabilities of using a 256 bit encrypted PDF file over email?

I often send confidential documents to others using encrypted PDF files (i.e. files with a user password, and typically with an owner password as well) to prevent both accidental forwards and snooping....
3
votes
2answers
2k views

Look over my Web API Authentication Scheme

I want some advice on my Authorization/Authentication scheme that I will be using for my Web API that I am writing. Firstly the Authentication : 1) When a user first logs in and they are authorized, ...
15
votes
2answers
1k views

Does the haystack theory work

The haystack theory is the recommendation to put repeated characters in your password in order to make it harder for brute force to reveal. Does this have any mathematical basis? Or is it snake oil?
0
votes
3answers
148 views

Basic simple encryption with already installed tools

If you are exchanged email messages with people using Linux, Windows and some odd Mac and want to implement some really basic security, encrypting all messages, just trying to avoid some non-...
1
vote
1answer
5k views

4096 Bit RSA Encryption Cracked [duplicate]

I'm new to encryption and still learning about it; I overheard someone this weekend mentioning that 4096 bit encryption was "cracked" by listening to the CPU and searched for this to confirm it ...
4
votes
1answer
311 views

Securing wifi with encryption

So I have been hearing that using WPS Pin is not secure at all and that there are available downloads that can brute force attack the pin until it uncovers it depending on what encryption you use. I ...
0
votes
1answer
908 views

How secure is a partial 64bit hash of a SHA1 160bit hash?

So http://en.wikipedia.org/wiki/SHA-1 SHA-1 produces a 160-bit (20-byte) hash value and As of 2012, the most efficient attack against SHA-1 is considered to be the one by Marc Stevens with ...
2
votes
2answers
662 views

Consider a “zero-knowledge” file host such as mega.co.nz. How can one prevent users to upload unencrypted content?

I am wondering how could a zero-knowledge host such as mega.co.nz prevent users to just upload files in clear, and, for example, to discredit the site by uploading a large quantity of illegal material ...
-2
votes
1answer
134 views

What is this encrypted with or where can I find examples of encryptions to compare it with? [closed]

I have a hash thingy I am trying to decode and I have done relatively little with encryption, though I would like to try to learn some more. The hash is: 1YMTpavsFq7ykllC3CCsg3e1li31re1nROxuW1wqIqpk ...
3
votes
4answers
2k views

For someone who has a key and ciphertext, is it possible to find out what encryption algorithm was used?

For someone who has a key and ciphertext, is it possible to find out what encryption algorithm was used?
3
votes
1answer
3k views

Token authentication and storage / websocket issues

My application is running an API authentication that uses tokens rather than cookies. This leads me to ask a few questions : What is the most secure way to store the token ? By using random ...