Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

20
votes
2answers
1k views

Does holding an AES-encrypted string and its cleartext from a database help an attacker in decrypting other parts of the database

I have a question regarding Encryption. Say an attacker stole my entire database. In that database all the data was encrypted. If the attacker took one piece of encrypted data and for some reason knew ...
5
votes
2answers
136 views

Should Android apps for communication encryption and security require permissions like identity, device ID, contacts, etc.?

There is a Android application Threema for communication encryption and that says it does not collect user data, but it requires the following permissions: identity, contacts and device ID. Can ...
0
votes
2answers
47 views

Asymmetric Encryption for Multiple Recipients?

Let's assume an arbitrary group of people who hold a key pair and who make their public key online accessible. Let X, A, B and C be arbitrary people from that group. Now X wants to encrypt a message ...
4
votes
1answer
59 views

Infinite one time pads, brute force multiple pads?

So based on my understanding using the same key for encrypting two completely random plain texts when using an otp cipher will still retain perfectly secret. This is based on the answers on this ...
3
votes
3answers
120 views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
11
votes
2answers
309 views

How to store private data both securely and publicly accessible?

The task may not be solvable in as broad a formulation as in the title, but this is my scenario (which is somewhat similar e.g. to newsletter subscriptions and therefore certainly has already been ...
-1
votes
1answer
51 views

Using and creating a custom 2 way encryption function [closed]

I am trying to create a 2 way encryption function using PHP. As yet I do not have a very good system at all, it is severely flawed and highly insecure, it is using a substitute cipher running from ...
1
vote
1answer
59 views

How can I extract the encrypted master key from LUKS header?

I know that a LUKS partition has a plain-text header that stores many informations like master key (MK) digest, MK iterations of PBKDF2, information about the 8 key-slots etc. I also know that in the ...
0
votes
1answer
126 views

Encrypting the System Infrastructure

The requirements are to Encrypt the data in our servers 'at rest' and the 'database' - in short the whole infrastructure. Threat Model - to protect a possible data-breach by an adversary (or from ...
95
votes
13answers
25k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
3
votes
2answers
114 views

RAM Encryption. Is it possible? [duplicate]

Without adding any additional hardware, is RAM encryption possible? If so are there any known and currently used implementations for Linux or Windows systems? And if this is something that is possible ...
20
votes
1answer
2k views

TLS Bicycle Attack - What cipher is free from flaws to use?

Recently a novel attack on TLS stream ciphers was developed by Guido Vranken, dubbed Bicycle and referenced in this Websense's blog post. It was based on a characteristic of stream ciphers that says ...
-2
votes
1answer
97 views

LastPass Emergency Access

any idea how "emergency access ", the new feature of the last pass, is working? I cant find any detailed information on the encryption/decryption process. How can we be sure that they don't keep a ...
8
votes
3answers
231 views

what does LUKS header contain?

What is contained inside the LUKS header ? I know, the header has size of 2MB. Also, cryptsetup supports "detached header", where the header can be stored in a separate file. Thus, for example, I can ...
12
votes
3answers
1k views

How secure is “Firefox Hello”?

The new "Firefox Hello" feature promises easy and safe video conversation. It is not nescessary to create an account, you simply share a link with your partner to start the conversation. The ...
0
votes
0answers
32 views

can I recover encrypted image files from an old Android phone where I know the pin used but the device key is unknown?

I think I know the OS version that was used to encrypt the images but I don't know if that is relevant. I assume if I know the encryption algorithm/software used (ie. CryptFS) and can brute force the ...
9
votes
3answers
15k views

Encrypt data within mobile app and send to web service

I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service? Basically I will ...
24
votes
1answer
23k views

What key exchange mechanism should be used in TLS?

There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
10
votes
4answers
8k views

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them. When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
2
votes
2answers
144 views

Machine readable, user non-readable - XML file

I need some advice as I have been unable to find anything useful via the web - (Google search). I have used the application EventGhost so as to create a custom shell, that I run using the Windows 7 ...
10
votes
4answers
15k views

What do key size and block size mean in cryptography?

Can some one simply explain the meanings and the difference between symmetric key and block size. Why 64 block size not safe any more and they increase it to 128 (AES,...,Serpent)? And what about key ...
4
votes
1answer
57 views

What types of trade-offs are appropriate when using encryption/authentication on devices with low bandwidth?

This is my first foray into this Stack Exchange, and I have limited knowledge of the InfoSec world, but I'll try to make this a pointed, answerable question. I'm tasked with investigating including ...
4
votes
0answers
50 views

Bidirectional encrypted server to server communication using TLS

I have 2 Windows servers and would like to set up encrypted communication between them using TLS. I've been reading up on TLS and X.509 certificates and I think I have a reasonable plan, but would ...
3
votes
3answers
239 views

Paypal has red lock by https?

This is what paypal says when I log in near the top left near https://. Is this ok?
1
vote
1answer
61 views

chrome app (javascript) - storing encryption password in memory

I'm building a chrome app that encrypts user messages on the client. The encryption is performed using the forge js library. I want to ask for the encryption password once, and use it to encrypt all ...
5
votes
3answers
181 views

How do Windows services access folders encrypted with NTFS EFS

If I understood correctly, when I enable NTFS encryption (EFS) for a specific folder in Windows, it uses specific account's user name/password (salted) to create asymmetric keys for data encryption ...
3
votes
2answers
3k views

can I trust Boxcryptor closed source software? Encryption of files for cloud hoster

Boxcryptor https://www.boxcryptor.com is not Open Source. Can I trust this? Is it secure? No government backdoor? Because there is no alternative for OS X and iOS.
3
votes
2answers
302 views

Is it possible to do Public Private Key Encryption on a chip (hardware)?

Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely? The ultimate goal ...
2
votes
1answer
48 views

Licensing system for client side code web application

I have a client-side web application running on SharePoint Site Collection, each site collection has it's own unique id. I want to use a licensing process to lock the app to a site collection. This ...
0
votes
2answers
76 views

GET Security over HTTPS [duplicate]

I am wondering if using the HTTP GET method over HTTPS to pass a username and password to a middle tier application would be safe. Essentially I am considering using a PHP include statement to ...
3
votes
1answer
105 views

Offering a privacy scenario with PHP mcrypt library

first of all, sorry if my question is not clear, because English is not my first language. Anyway, let-me explain the concept I'm struggling to solve as the best solution. I have some guys, and they ...
8
votes
1answer
391 views

How to use encryption on a site that only uses an IP address, no domain name?

You can use SSL/TLS certificates and etc. on sites with domain names, but I don't know if it's possible to use them for IP addresses. If this is the case, would I have to use a self-signed cert and ...
4
votes
1answer
54 views

Protect sensitive information in a password-free, shared database

I'm working on a webserver that stores resources in Redis. To make swarm-deployments as hassle-free as possible, I'm implementing an option where the server doesn't need to access the filesystem to ...
5
votes
1answer
158 views

Is there an equivalent of an Apple cryptochip in Android devices?

Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several ...
-5
votes
1answer
38 views

Help to identify this type encoding/encryption? [closed]

What type of encoding/encryption is this? $1$JbzSrvQl$WMLs938aP.EeDn/0dDFQx/
28
votes
4answers
2k views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
3
votes
1answer
56 views

Where to store IV and salt when doing clientside encryption with no server

I'm making a chrome app that does client side encryption of user messages. There is no server in my architecture. The encrypted text messages are saved as files in the user's Google Drive. I'm using ...
5
votes
1answer
55 views

Why is the Key Derivation Function important?

Let's consider this openssl command : openssl enc -aes-256-cbc -pass pass:PASSWORD Why is it important to have a good Key Derivation Function? This answer to another question suggest that GnuPG is ...
1
vote
1answer
36 views

How does AES-GCM handle large blocks with a 128 bit key?

I would like to apply AES-128 byte encryption on GCM mode. I know the logic to apply AES_GCM using 128 bit data. But I have a larger data to encrypt (Not necessarily multiple of 16 bytes). As the ...
3
votes
1answer
85 views

What are the problems of using OTP encryption with TRNG?

I've programmed a simple One-Time Pad "encryptor" that can merge two files into one by using bitwise XOR. The pseudo-random key files are generated by using the CryptGenRandom() function from ...
-1
votes
2answers
78 views

Which is more secure a full disk or file encryption? [duplicate]

There are probably two ways to encrypt your computer full disk encryption which completely locks down the computer between when it is off and when it has booted but after everything loads you computer ...
10
votes
4answers
11k views

Unlock hard drive vs full-disk encryption

When I turn my notebook on, it asks me for the password to unlock the BIOS and than it asks me for the password to unlock the hard drive. How different is this 'password to unlock the hard drive' ...
-1
votes
1answer
43 views

Is there any kind of encryption that returns constant number of characters?

I wonder if there is any kind of publicly known encryption (not hashing) algorithm that generates constant number of characters independent of the input. I have came across an online platform that ...
10
votes
3answers
722 views

Using encryption inside of SSL connection

We are using SSL to make our connection between clients and backbone servers safer. Does it really make sense if also we use another encryption mechanism to encrypt transmitted data twice? For ...
8
votes
1answer
388 views

Is Bluetooth 4.0 traffic encrypted by default/design?

I wonder if the BLE (v4.0) traffic is encrypted by default or by design, or is it just optional? If the former, is the traffic encrypted using a key derived just from the pairing pin or is there some ...
0
votes
2answers
224 views

What is the best way to encrypt a json object in Java?

I have a Json array JsonArray people; which holds JSON objects representing people. Currently I am saving them as plaintext in a json file. try { OutputStream out = new ...
3
votes
1answer
848 views

How does Freenet maintain access to 'freesites' while retaining plausible deniability about content?

On Freenet you can host websites deemed 'freesites' which are publicly accessible by everyone. As I understand, Freenet can serve a variety of content, some which is illegal, which is why content is ...
6
votes
2answers
182 views

How to really treat security between peers in WebRTC

Recently I've been implementing WebRTC in my project and would like to add security and privacy to the couple. I then decided to search on and found something if it is really necessary to impose ...
3
votes
1answer
136 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
1
vote
4answers
160 views

Is connection to keyserver encrypted?

When you retrieve someone's information from a keyserver to add him to your pgp keyring, that is made through unencrypted keyservers, unless the user uploaded it to https://keyserver.pgp.com/. Even ...