Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

1
vote
0answers
47 views

Vigenere polyalphabetic cipher

A Vigenere polyalphabetic cipher has a repeated keyword length of k, and encrypts any of 26 letters using a rotation cipher. What is the keyspace of this cipher?
0
votes
0answers
34 views

Storing hashed or encrypted password in session? [duplicate]

I need users to be able to encrypt and decrypt without entering their passwords every time. One way is to store the hashed password in session, and use it for encryption and decryption. Problem with ...
5
votes
5answers
1k views

How can one secure a password/key in source code [duplicate]

If there is a need for source code to have a password in it, how should this be secured? This is purely an example, but say there is an app that is using an API, and you don't want to expose ...
9
votes
4answers
246 views

What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?

Also: Is it something that can be achieved with limited funds? I ask because I am intrigued by the obstacles that are in place.
0
votes
2answers
65 views

How do you protect strings in code from users decompiling them and seeing them [duplicate]

For an example say we have an application such as a client based application which connects to an API using an api key. We are saying for this purpose there is no OAuth. How would a string or in this ...
0
votes
1answer
132 views

Which is the Best Cipher Mode and Padding Mode for AES Encryption? [closed]

As per PCI-DSS 3.4 requirement: For storing Credit Card Data Strong Cryptography should be used. I decided to use AES Encryption which is a strong and mostly recommended crypto for encrypting ...
1
vote
1answer
73 views

Is a Diffie Hellman Ephemeral key good material for being used as a symmetric cipher algorithm key?

I am designing a secure protocol (for academic/learning purposes) and I am at the point where I need to (re)design the key exchange step. In my previous implementation, I used to rely on RSA to ...
1
vote
0answers
70 views

Designing a security and encryption strategy for MongoHQ

I'm trying to design the best strategy to achieve the following goals: Securing data-on-the-wire between my server and MongoHQ. Encrypting all data-at-rest with MongoHQ (possibly key values as ...
1
vote
0answers
25 views

How to store Initialization Vector securely for AES Encryption? [duplicate]

I'm using AES Encryption for encrypting credit card details and so I will store my DEK in Ecnrypted form and do we need to encrypt the Initialization vector for storage?
13
votes
2answers
2k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
1
vote
0answers
32 views

Message and Key Security

I'm reading Post-Quantum Cryptography, and in the page 106 in the beginning of the Section 3 it says: In this section we consider the message security (opposed to key security) of code-based ...
7
votes
4answers
4k views

Unlock hard drive vs full-disk encryption

When I turn my notebook on, it asks me for the password to unlock the BIOS and than it asks me for the password to unlock the hard drive. How different is this 'password to unlock the hard drive' ...
3
votes
1answer
112 views

How to decrypt the Encrypted DEK using KEK which are separated in servers?

Decrypting the DEK using KEK under PCI-Standards, which are separated by Servers: Let say for example we have server1 and server2 Server1: It is in East US, called it as Application Server. ...
2
votes
0answers
45 views

Why doesn't Bitlocker mix the password with stored key?

Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of ...
-1
votes
2answers
69 views

How to use encryption on proprietary software

I wonder if it's possible to develop a secure point to point encryption application (a pgp message application for example) on a proprietary software. If such an application was developed, let say on ...
3
votes
4answers
189 views

Are there Ciphers designed to be slow?

To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to ...
1
vote
1answer
398 views

Are post requests secure?

If a post request is sent from a client on a website without SSL, is the request secure? For example, I visit a site badsecurity.com, and I login using a password: Will this password be encrypted ...
4
votes
3answers
177 views

What is a good rebuttal to users who wish all data WITHIN Db be encrypted?

I am building an application in VB.NET (WinForms) utilizing SQL Server 2008 R2 as a Backend. The application is to track employee's money they defer each paycheck, or month, to deposit into separate ...
1
vote
3answers
201 views

How is it on some removable media, when enabling/disabling password protection the changes happen immediately?

For example I have a WD Passport external hard drive. After installing WD security I can enable and disable password protection, however the settings basically get applied instantaneously. Does this ...
6
votes
3answers
6k views

Full Disk Encryption with GPT disk support

On my old computer I used Truecrypt full disk encryption. My old computer however was running Windows 7 with a standard MBR partition scheme. I recently got a new laptop with the fancy UEFI support. ...
4
votes
2answers
533 views

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually). I'm trying to navigate the labyrinth of US export regualtions - something I ...
0
votes
1answer
54 views

Theoretical key encryption question

I have a question regarding encryption and message sending. There are 2 hosts, A and B with their own secret key kA and kB (assuming this is not PKI). It is known that when A wants to send a message ...
0
votes
1answer
41 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
3
votes
3answers
108 views

Is a pre-shared secret enough for encryption?

Suppose: A and B are initially configured to possess the same key. -- the key is only known by the pair -- no key needs to be public A has an algorithm, a, that takes a message(plain ...
4
votes
5answers
447 views

Is it possible to restrict USB keys to only certified ones, and block that key's access on other computers

I am working on security for an organisation, we have purchased some encrypted USB keys but wanted to stop any employees leaking data. is there any way to stop their laptop accepting any key but the ...
5
votes
2answers
4k views

How do I decrypt an Adobe Triple DES ECB-mode encrypted password?

So as you may have heard, the Adobe user database with 130 million records was leaked recently. I want to find out what password I used for the Adobe account I created to make sure that I'm not using ...
3
votes
1answer
39 views

Storing original length of encrypted message

Does storing the actual length of the message in metadata make an encrypted message more vulnerable to attack?
0
votes
1answer
122 views

Questions about RSA/asymmetric key encryption?

I've been reading a lot about quantum computers and RSA. I know RSA security relies on the difficulty of factoring an extremely large number with just two prime factors. Apparently quantum computers ...
0
votes
3answers
232 views

A service that claims beyond army level encryption

I would like to understand if this service is as safe and good as it claims to be: https://unseen.is This is what they say: ... Many other services that offer encryption keep the key, but ...
7
votes
3answers
453 views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
5
votes
5answers
606 views

What are the steps to take in order to securely transmit credit card information via a standard web form?

I have a client who wants to be able to have new customers who sign up with them online for a delivery service to be able to submit their credit card information as well. Once the information is ...
2
votes
1answer
437 views

Where to keep key file used as composite key for Keepass 2

I used to use a master password and "Windows User Account" to get into my password datasbase with Keepass 2. Then I realized the "Windows User Account" option is garbage because if you ever want to ...
5
votes
3answers
538 views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
0
votes
0answers
17 views

How can it be possible to have encrypted communication between a server and a client if the server has only a public key [duplicate]

If only the server has an electronic certificate (User ID, Version, Public key), how can be possible the encrypted communication between the client and the server?
0
votes
1answer
80 views

Server Encryption - Best practice [closed]

Q: For servers running Windows 2008 and up, what would be the most reliable whole disk encryption? We want to protect our data from unauthorized access. Right now, we used BitLocker. However, the ...
0
votes
1answer
105 views

Why are PSTN lines not encrypted?

While reading this article: Does Skype use encryption? I came to know that PSTN do not have encryption. Why it is like that? More so since we have our PSTN phones now more powerful (in terms of ...
7
votes
3answers
918 views

Truly deniable encryption

What tools can be used to make truly deniable encryption? Suppose, authorities can use any force to make you open your passwords. Truecrypt can have only one hidden container, which means that ...
9
votes
3answers
889 views

Best practices on securely storing access tokens

What would be the best practices for storing access tokens of another api for your users? In particular I'm developing an application with some friends that let's user log into Facebook to both ...
0
votes
1answer
80 views

Should I encrypt Long-lived Facebook Access Token when storing them in my DB?

I own an application that grabs some Long-Lived Facebook Access token, in order to be use later according to the corresponding logged user. Should I need to encrypt them before storing them, to avoid ...
1
vote
2answers
386 views

How secure is EncFS compared to TrueCrypt?

If I choose the paranoia option for EncFS and for TrueCrypt I create containers using the encryption algorithm AES-Twofish-Serpent and the Hash Algorithm Whirlpool. Are both methods equally secure, ...
0
votes
5answers
113 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
1answer
48 views

Is encryption less resistant to brute-forcing compared to hashing?

I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I ...
4
votes
1answer
87 views

Should IBAN and bank details be considered private data and encrypted?

To pay off our users, they are asked to enter their IBAN and bank name and bank address. The users are mostly based in Europe. As far as I know (see also this question) these details can not be used ...
0
votes
3answers
192 views

How to store user credentials like Mint.com [duplicate]

If you have a website that need to store user's credentials for other sites, how do you store those credentials securely? An example is Mint.com where you give them your username/password for your ...
2
votes
3answers
166 views

What does Windows's built-in encryption do, if I can seemingly always read my encrypted files?

I'm playing around with certificates and encryption on a Windows system, but either it isn't working or I don't know how it should works. When I encrypt a file its name changes to green. But then, I ...
0
votes
1answer
69 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
3
votes
0answers
132 views

Is 'Forge' Javascript crypto library secure?

I need a client-side crypto library. I've seen https://github.com/digitalbazaar/forge linked many times on stackexchange. Forge seems to be the most complete and well-documented crypto library for JS. ...
3
votes
3answers
100 views

How to simply and efficiently generate different keys from one password?

I saw here that using the same key to encrypt and mac (in that order) a message could eventually be unsafe. What is the best way to generate two different keys from the same password (using a PBKDF ...
5
votes
2answers
246 views

Is the connection to Tor hidden services encrypted?

It's possible for Tor exit nodes to sniff traffic on normal websites, unless you connect via SSL/HTTPS. But what about hidden services, they don't seem to support the HTTPS protocol. Can the exit ...
0
votes
3answers
71 views

How does a third party file encryption get along with OS native file encryption?

I sort of understand what is meant by no security level beyond "cannot break it" but I have a much more involved question about having more than one form of encryption on a computer at once. Suppose ...