Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

14
votes
5answers
9k views

Encrypting files in a windows environment

We have certain client data which must be encrypted at all times. The part we have been struggling with is encrypting files on network shares. Currently we have network folders encrypted using PGP ...
9
votes
1answer
129 views

Handling “forgot password” functionality with encrypted data without security questions

As a sort of follow-up to this question on handling password-reset functionality when dealing with encrypted user data, is there any good method for resetting a user's password in an encrypted web ...
9
votes
2answers
239 views

When do encryption viruses run? [duplicate]

Viruses that encrypt your files, like the recently very common 'Locky', seem to perform a lot of work before they are 'done'. I wonder, when do these programs run? They must take quite some time, ...
1
vote
2answers
95 views

How can i read the source code of this encoded powershell script from the registry?

I get this line by ProcessExplorer C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -executionpolicy bypass iex ...
18
votes
3answers
18k views

Is Signal a secure and secret way to communicate via voice calls?

Signal (former RedPhone) provides end-to-end encryption for your calls, securing your conversations so that nobody can listen in. But really, how is the probability that a voice conversation is ...
68
votes
12answers
23k views

Is Google overreaching by forcing me to use TLS?

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? ...
45
votes
4answers
65k views

How to estimate the time needed to crack RSA encryption?

How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
2
votes
4answers
182 views

How could online encryption ever work? [duplicate]

I have recently read about the german enigma machine in WW2, It worked in a way that every day the machine configuration was sent per mail to the different operators. (I couldn't find official sources ...
20
votes
4answers
1k views

When encrypting cloud-stored data, is it acceptable to use the user's account password?

I'm developing a web service that stores sensitive personal information (such as telephone numbers, addresses, full names, and email addresses) in a database, such that it can be accessed from ...
19
votes
2answers
2k views

Homomorphic encryption used for e-voting?

I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused: "The homomorphic property of various cryptosystems can be used to create secure voting systems, ..." ...
8
votes
4answers
295 views

Searching encrypted storage

I have been reading some very interesting academic papers regarding the ability to search encrypted data without needing to actually decrypt the data. Doesn't this defeat the purpose of encryption in ...
3
votes
2answers
72 views

How does PGP grant authenticity?

I'm using the website https://www.igolder.com/PGP/encryption/ to encrypt/decrypt PGP messages and create public/private key pairs. I get that when I send somebody my encrypted message only he can ...
4
votes
2answers
739 views

Can fully homomorphic encryption be practical?

Fully homomorphic encryption has been implemented by Craig Gentry using ideal lattices. Can it be applied to data stored on a private cloud setup in practice? I've seen references here and on other ...
4
votes
3answers
181 views

Strange RSA usage - how secure is it?

Is following communication scheme secure? To my mind, it uses RSA modulus and public key exponent as a cryptographic secret, which is strange usage of RSA, but can it be easily broken because of ...
1
vote
1answer
74 views

Is it not advisable to add a 2nd level of encryption to an already encrypted external hard drive?

In a separate post regarding the security level of "WD My Passport 2TB" external hard drive's built-in password encryption, Tom Leek answered in incredible detail that left the enquirer of the ...
7
votes
2answers
215 views

Is it easier to crack a ZIP file than a 7z archived file given they have the same password?

I am interested in knowing if either of them is easier to crack than the other because of inherent flaws.
4
votes
6answers
14k views

Is it theoretically possible to decrypt a file without the key/password?

Hear me out ... On TV shows like Criminal Minds they make it out to appear that any encrypted files can be easily decrypted, even without a key. The character, Garcia, just simply "pushes some ...
3
votes
1answer
48 views

Is symmetric encryption with one time pre-shared key secure?

Suppose I have a secure channel between client and server, with proper certificate validation etc (actually, ssh session). I want to establish a secure connection between my own application on a ...
2
votes
1answer
130 views

Best way to encrypt data using php - I am not sure if I doing it correctly [duplicate]

I want to encrypt some data within my php file when I add the stuff to my mysql database. This is how I do it. I create a static key like: $key = md5("pass"); Then I have two functions called ...
-1
votes
2answers
67 views

Is any systematic method that can detect weak cryptographic algorithm in source code

Weak cryptographic algorithm should be removed from source code to avoid a false sense of security(for example: MD5. Of course, there is possibly the algorithm in source code, but it doesn't use the ...
7
votes
1answer
254 views

Does LUKS actually fully encrypt data on a disk?

Why does TrueCrypt and similair applications take hours to fully encrypt a 1 tb drive, while luks takes a few seconds? Sorry if this is a dumb question, but I don't fully understand how that works.
5
votes
1answer
2k views

What is “NAND mirroring”, the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?

According to Ars Technica, Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...
8
votes
2answers
792 views

Implications of the proposed Burr-Feinstein senate bill? [closed]

It has been rumoured (I guess it is more than a rumour) that senators Burr and Feinstein will be introducing legislation requiring companies to provide the government (with warrants) access to encrypt ...
1
vote
2answers
84 views

How are private and public keys different?

While reading about DKIM I saw that the sender's private key is used to encrypt a hash, later decrypted by the recipient using the sender's public key. This is exactly the other way compared to ...
2
votes
1answer
146 views

Is an encrypted .dmg file decrypted on the dropbox server? [closed]

I'd like to use built in tools to create an encrypted drive in OS X that I can sync with Dropbox. To this end, I've created a 'sparse bundle' encrypted volume (.dmg) that remains in ~/Dropbox. My ...
0
votes
3answers
186 views

How secure would this method be considered for password storage

Ok I am currently storing the passwords in most secure way I could think of. With use of Encryption and Hash. The passwords are first generated by user as plain-text with minimum length of 6 ...
0
votes
0answers
27 views

when/how does an encrypted volume .dmg change to reflect the file system it stores

I'm trying to verify that storing a .dmg file stays encrypted while only the mounted file system is unencrypted (see here). My thought was to create a .dmg containing a text file, make a copy of the ...
17
votes
2answers
3k views

Are Playstation 4 communications really harder to monitor?

I have read on the net that authorities are having troubles monitoring Playstation 4 communications. As usual the news are very non technical. What makes the Playstation 4 network harder to ...
1
vote
1answer
112 views

Decryping a RAR file with same password

I came across a problem very similar recently and wondered if anyone knew how to solve this. So say for example I have an RAR archive called archiveA.rar and a password to protect it the password is ...
1
vote
0answers
107 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
1
vote
2answers
85 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
1
vote
0answers
13 views

Multiple email addresses connected to same PGP identity [duplicate]

I am setting up PGP (using GPGTools GPG Suite for OS X) and I use multiple email addresses daily. It appears I have several choices on how to do this, and I am wondering what is most secure/most ...
6
votes
5answers
2k views

Does a binary executable have to have some critical plain-text components?

When companies package binary executables, they are often encrypted, compressed, scrambled, and otherwise made so that your lazy hacker can't simply open the program up in Notepad++ and see the code. ...
3
votes
3answers
232 views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
6
votes
2answers
1k views

Can I use SHA-512 hash as AES key?

I want to combine hashing and encryption for better security. So can I use a hash key generated from SHA-512 as a key in AES. For example, I have a password "secret", I calculate SHA-512 hash for it ...
-3
votes
2answers
62 views

NTAG216 lock bytes security [closed]

I want to ask about the "lock bytes" implemented on the NTAG216 by NXP. What exactly are these and how do they work? Are they a standard or is it some proprietary technology by NXP? Are there any ...
4
votes
1answer
325 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
1answer
174 views

What would be a simple example of an asymmetric encryption function (asymmetric function)?

I am trying to understand RSA encryption but the algorithm seems quite complex. I know that with asymmetric encryption you use a key and a function to encrypt data and a different function to decrypt ...
82
votes
15answers
17k views

Why would someone “double encrypt”?

If I have a website or mobile app, that speaks to the server through a secured SSL/TLS connection (i.e. HTTPS), and also encrypt the messages sent and received in-between user and server on top of the ...
19
votes
6answers
29k views

Compute the AES-encryption key given the plaintext and its ciphertext?

I'm tasked with creating database tables in Oracle which contain encrypted strings (i.e., the columns are RAW). The strings are encrypted by the application (using AES, 128-bit key) and stored in ...
0
votes
1answer
36 views

Potential FileVault problems in my setup

After FBI vs. Apple, I have a few questions about the security of my data. Here's my setup: AppleID is connected to local account I don't remember exactly, but I think I have selected option "Allow ...
1
vote
1answer
44 views

Key rotation for shared secret keys - recommendation

When using software that does encryption using shared secrets what are the recommended practices for changing the keys. To be specific, this is a distributed software running in a cluster and the ...
1
vote
0answers
65 views

How to enable ECDHE in openjdk-1.8.0 in CentOS 6.7?

I have seen many posts that hinted ECDHE is available in the SunEC provider way back in openjdk-1.6.0. My environment: CentOS 6.7 with openjdk 1.8.0.71-1.b15.el6_7. No ECDHE. Made 2 changes in ...
3
votes
2answers
100 views

Why does my private OpenPGP key look different between devices?

Something I noticed, when I use gpg --export-secret-keys -a on different computers: My private key looks different, even though they are the same key pair. Is that normal or does this indicate ...
18
votes
3answers
2k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
3
votes
2answers
460 views

Storing a user's password in a retrievable manner

I currently store my users passwords as PBKDF2 hashes, for the authentication part of my web application. Each user also has their own private key and public key (also stored in their user profile in ...
6
votes
3answers
99 views

What is the benefit of adding data encrypting key then store it (encrypted) along with data

To protect user's sensitive data, I am considering the following 2 approaches: Create 1 data encrypting key (DEK) for each user, use it to encrypt (using AES CBC mode with a random IV for each ...
0
votes
2answers
200 views

Why does Telegram not use end-to-end encryption? [closed]

Signal and Telegram are both mobile applications that "try" to ensure secure chats. Signal uses end-to-end encryption, Telegram does this as well (in 'secret chats') but it does not use end-to-end ...
3
votes
1answer
97 views

What happens when encrypted email is in-transit?

If you're using a service that offers end-to-end encryption, what happens when you send an email to another non-encrypted email address? Let's say I write my email in ProtonMail and then send it to a ...
8
votes
3answers
2k views

Why can't the FBI copy the contents of an iPhone they are trying to crack?

Making the news rounds now is a story about the courts ordering Apple to disable the automatic deletion of data after 10 failed password guesses. What I don't understand is, why doesn't the FBI just ...