Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
1
vote
2answers
3k views
Recovering encrypted SD card after Android Factory Reset
I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card.
Phone did a factory resync and now data on SD card is still encrypted.
Is there a way ...
1
vote
1answer
286 views
Why so long to break 128-bit encryption?
I read that 128-bit encryption takes millions of years to break. But if I encrypt a file using say winzip that uses 128-bit encryption but the password I use is only one character long (for example ...
3
votes
4answers
384 views
How to “demonstrate” man-in-the-middle attack?
I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project).
Over the years a bunch ...
0
votes
1answer
249 views
Can active attacks really decrypt a particular AES-256, CBC, PKCS#7 encrypted file?
I recently found out that active attacks are a threat against AES-256, CBC mode, padded with PKCS#7 (the CBC mode in particular. I should supposedly change to EAX to guard against these attacks).
...
6
votes
1answer
290 views
Encrypting sensitive data in software and storing/decrypting it on a server
I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing.
I'm developing software which has 2 parts - a C# program run ...
4
votes
2answers
220 views
How less secure is an encryption if we know something about the original data?
I have a number of files encrypted with a key derived from a password. In line with standard practice, I use a random salt and password and do many PBKDF2 iterations to obtain an encryption key and ...
1
vote
5answers
2k views
Cracking CISCO ASA Passwords
I've got a copy of a Cisco ASA config and i want to crack the following example passwords
I've got the following lines in the config
ASA Version 8.4(2)
!
hostname ciscoasa
enable ...
1
vote
1answer
96 views
PKCS#7 message constructed by our code, any weaknesses in the output?
We have this as the PKCS#7 encrypted message. We would like to open this up for review and analysis here, for people to poke holes. This sample is generated via test certificates and keys. The concern ...
0
votes
1answer
411 views
How does PKCS#7 padding work with AES-256, CBC mode?
I'm a bit confused with AES-256, CBC, and how it works with padding (PKCS#7).
Whenever I encrypt data of multiples of 16 bytes (the block size), extra 16 bytes are always padded at the end.
For ...
2
votes
3answers
65 views
Are private keys generated by different software packages compatible?
I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
2
votes
2answers
160 views
Utility to hide several encrypted messages in single file
I am interested, are there existing utilities/projects under way devoted to combining encryption and steganography.
I would like to
- combine two or more messages, encrypted with separate ...
25
votes
8answers
46k views
How to determine what type of encoding/encryption has been used?
I've looked on this site and on SE. but i couldn't get a handle on this.
Is there a way to find what type of encryption/encoding is being used?
For example, I am testing a web application which ...
3
votes
4answers
190 views
Is it safe to have the salt equal to IV?
If I'm using AES-256 CBC to encrypt, getting the 32 byte key using multiple iterations of the PBKDF2 function with a 16 byte salt, is it safe for me to let IV be equal to the salt?
(Edit: The salt is ...
0
votes
2answers
136 views
How can I encrypt something user provided without risk of the key being exposed?
So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must ...
1
vote
2answers
129 views
What is a better practice - RSA Encryption vs Windows authentication
I have two machines running windows OS with IIS and window OS with MS SQL. In the production web.config file I configure the IIS to use a user name and password when connecting to the DB and then I ...
3
votes
2answers
189 views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
2
votes
3answers
862 views
When to use the different types of Encryption / hash algorithm?
I'm studying for CISSP and know they will ask what type of encryption to use in different situations. Does such a list exist or is there a general rule of thumb to use?
2
votes
7answers
472 views
Tracking unique web site visits without logging IP addresses
On Monday, some IP address xxx.xxx.xxx.xxx visits my site. I log it.
On Tuesday, another IP address yyy.yyy.yyy.yyy visits my site. I log it.
If the two IP addresses are equal, I throw out the ...
0
votes
2answers
57 views
How can I set up signed downloads?
Scenario
I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
1
vote
5answers
548 views
making an iPhone/Android app which sends a user password to my server, how to secure?
I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login.
I don't have SSL on my website, but it's just a reviews website and ...
11
votes
4answers
6k views
What ciphers should I use in my web server after I configure my SSL certificate?
There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list.
...
5
votes
2answers
2k views
How safe is the ownCloud encryption in a trusted LAN?
ownCloud looks like a promising locally hosted dropbox alternative. However, it has been pointed out that the encryption is not exactly strong... (The ownCloud team does at least provide a list of ...
1
vote
4answers
198 views
Strategies to store/remember very long password?
If future proof encryption is - in theory - possible it will require long password.
What are some of the strategies for storing or remembering very long - in this case rarely used - password?
For ...
1
vote
3answers
587 views
Encrypt data within mobile app and send to web service
I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service?
Basically I will ...
3
votes
1answer
215 views
Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?
Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects.
I need to store (or use an existing) private key on a ...
3
votes
3answers
130 views
Is it safe to mix authentication methods?
Is it a good idea to "combine" authentication methods?
Example we can use username/password method to authenticate a user from a server.
What if we used this as a first authentication step to get ...
5
votes
1answer
745 views
Android / CyanogenMod encryption vs GNU/Linux
Hi I am trying to understand how encrypting an Android based phone works compared to a GNU/Linux host which relies on LUKS dm-crypt.
Here is what I understand: Encrypted LVM on GNU/Linux is an ...
0
votes
1answer
139 views
AES encrypt secret key with plaintext
We need to be able to retrieve password. Hashing is one-way, we can't do that.
So we ended up using AES.
We want to know if the following schema is safe or not. I am only familiar with modulo PK ...
3
votes
2answers
174 views
Is it reasonable to prevent timing attacks by using fixed processing time
I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing.
Part 1
Is it a good idea to ...
8
votes
3answers
274 views
How practical/important is the Lucky Thirteen TLS attack?
I was reading this article which talks about a new attack against TLS being called Lucky Thirteen. It claims to allow repeatable MitM attacks against HTTPS connections.
It's described as being fairly ...
0
votes
0answers
80 views
Any idea what this has been encrypted with [closed]
The cipher text looks like this:-
dO+4ubRqxB801u3ZLZx2A5dvmHCbw3MnQYxDkhSRLoOJ7CFiPg7Xxhzf1T8g69iB
+JLEKvBlESQJTnSJkEEesgBnVAwrAz/v9MGgVp//gOV9xlyUca7UOI5kZglQq6WX ...
1
vote
1answer
370 views
is it possible to use smime in the webclient of gmail?
I could not find any options in the webinterface of Gmail.
all I could find was a Firefox plugin to use SMIME with Gmail, but it seems to be outdated
0
votes
1answer
80 views
Auto encrypt chunks of content for backup, best practice?
I'm just curious and it's more like a mind game, I'm not into cryptography.
How would one encrypt data that's constantly generated? Put the data automaticly into chunks encrypt the chunk and send it ...
1
vote
2answers
98 views
Need a time consuming symmetric encryption
I have a database with millions of entries, each entry encrypted with a (different) password. Normally, only one entry is needed at a time. If somebody steals the database, I want to make it hard for ...
9
votes
7answers
5k views
Which Instant Messaging services use or allow secure protocols, and what do those protocols cover?
We all know there's a myriad of Instant Messaging (IM) services out there. But, which of these services uses or permits protocols that actually secure your communications? For those that do, what ...
3
votes
2answers
87 views
Securing Time Sensitive Data
I have a number of time sensitive, embargoed pieces of information that I need to distribute over the Internet and have received at a precise time. I'm currently dealing with the problem by uploading ...
5
votes
4answers
127 views
How to avoid to lose data encrypted because it was encrypted by no longer supported software?
How can I avoid losing data that is encrypted using methods that may become obsolete? I have valuable family records I wish to secure, so I plan to encrypt them before putting them in long-term ...
2
votes
1answer
96 views
Credit card data - sharing and storage [duplicate]
What is the industry standard for sharing credit card data between client (thin & thick) and server?
7
votes
2answers
2k views
How secure is Intel SSD Encryption?
Are there any known flaws in the full disk encryption on Intel 520 series SSD drives?
Specifically, it seems these drives generate an internal AES key automatically, even when no password is set. But ...
3
votes
5answers
257 views
Does a binary executable have to have some critical plain-text components?
When companies package binary executables, they are often encrypted, compressed, scrambled, and otherwise made so that your lazy hacker can't simply open the program up in Notepad++ and see the code.
...
4
votes
1answer
151 views
Saved passwords (use case)
I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together.
Both the data and the password are encrypted ...
2
votes
2answers
140 views
Slow down symetric encryption
I'm developing a program in Java. In one step data should be encrypted and exported in a file.
As of now we are encrypting in AES-256
I want to slow down a possible brute force attack as much as ...
1
vote
3answers
110 views
RSS Feeds: restrict access
"We are a bunch of journalists and we share much of the information via e-mails. This has become tedious now. Hence we found out a way to share, by just having to share our private blog posts via ...
-4
votes
1answer
143 views
Secure Web application Password vault/manager [duplicate]
I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a ...
7
votes
1answer
366 views
How to study the packets sent by a keylogger
One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it.
I have a strong doubt that it is a key-logger. ...
0
votes
1answer
118 views
Determine hashing algorthim only with known input and output
Given the input:
test
A system generates the following output hash:
0x001F41B6A0534D3B851D69EFE6237F550100000010D5F4FC65E64BCFDBF2590212E4411C44942C6C734C00ACFE13B958DCAB3614
I do not know ...
5
votes
2answers
184 views
OMAC: multiplication in a finite field - how can I compute the correct polynomial
From The EAX Mode of Operation:
We explain the notation used in the definition of OMAC. The value of iL (line 40: i an integer in {2, 4} and L ∈ {0, 1}n) is the n-bit string that is obtained by ...
3
votes
1answer
267 views
How can I tell if a PPTP tunnel is secure?
PPTP has been demonstrated to be broken in many ways, and most installations are insecure. But it is also theoretically not broken if configured correctly.
As an end-user, is there a simple way for ...
2
votes
3answers
522 views
How can I share files with other individuals in the cloud in a secure way?
I would like to us a dropbox because it is easy and convenient.
But I want to encrypt the files with the public key of the intended recipient, so he will be the only one who can access the data in ...
2
votes
2answers
170 views
How to secure a truecrypt container allowing access with multiple SSH public keys?
I would like to create a TrueCrypt container which can be accessed by multiple people. The container itself can be stored anywhere, e.g. in a shared folder in Dropbox or Google Drive, ...
I would ...
