Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

0
votes
4answers
153 views

How does an encryption key work? [closed]

I'm having trouble understanding how an encryption key works. for example: if the word was 'hello' its encrypted value could be 'GHSSDgsd2', what would happen to the encrypted value if the key was ...
0
votes
1answer
131 views

Any issues with this security design for cloud storage? Server doesn't even need to know password to log someone in

I've created an algorithm I think I'm going to use for a cloud storage service I'm developing- if there are no issues or vulnerabilities with it. It's this along with TLS and forward secrecy ...
0
votes
2answers
236 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
0
votes
1answer
345 views

Enterprise Encryption Considerations

What are the different aspects to consider for Enterprise Encryption policy? So far the resources I have are: https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet ...
16
votes
2answers
5k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
31
votes
2answers
7k views

Web Application encryption key management

In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions: ...
19
votes
4answers
15k views

Multi-boot with full hard drive encryption and pre-boot authentication

How would I set up a multiboot system which supports full hard drive encryption and pre-boot authentication. I have a system with Ubuntu, Windows 7, Windows XP, and I would like to install Red Hat. ...
22
votes
9answers
4k views

Is encryption in HTTPS done by the browser or by the system?

This may be a common sense question, but I am not able to find any documentation on this after searching on google for a long time When browser makes a HTTPs request, does it encrypt the data then ...
14
votes
3answers
3k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
41
votes
12answers
6k views

Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data? [duplicate]

Lots of sites these days, that don't deal with sensitive data, enable encryption. I think it's mostly to make (paranoid?) users feel safer. In cases where there is a user's account being logged in, ...
25
votes
5answers
10k views

Why AES is not used for secure hashing, instead of SHA-x?

As far as I understand, AES is believed to be extremely secure. (I have read somewhere that it would certainly not be broken in the next 20 years, but I am still not sure if the author was serious.) ...
21
votes
6answers
33k views

How secure is a Windows password protected zip file?

I need to send some sensitive information to a client. I thought I would email a password protected zip file I created using Windows XP and then call them with the password. Presuming I pick a good ...
13
votes
7answers
7k views

What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?

I'm interested in updating this two pronged question for 2011: What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective? What cryptology is most ...
14
votes
1answer
19k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
19
votes
6answers
1k views

Backing up sensitive data - pitfalls and best practices

Obviously, securely backing up sensitive data is a challenge. A remote backup is important for surviving a variety of disasters. What are some of the "gotcha's" lurking out there, and what best ...
17
votes
5answers
3k views

Does using the same encryption algorithm multiple times make a difference?

In TrueCrypt I noticed the option to encrypt a volume with multiple encryption algorithms i.e. AES-Twofish-Serpent. Would it be useful to encrypt something with the same algorithm multiple times? For ...
9
votes
4answers
2k views

Truly deniable encryption

What tools can be used to make truly deniable encryption? Suppose, authorities can use any force to make you open your passwords. Truecrypt can have only one hidden container, which means that ...
5
votes
1answer
5k views

Encrypting data for Android mobile app

I am creating a mobile app for Android. This is my first mobile app by the way. I have decided to store data used in my app in a SQLite database in the target Android device. The data I am storing ...
19
votes
2answers
4k views

How does a crypter for bypassing antivirus detection work?

I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
5
votes
2answers
7k views

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
5
votes
3answers
2k views

How to roll my own security mechanism - avoid SSL

i'm looking at implementing my own security mechanism rather than using ssl due to ssl being 'hopelessly broken' http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysis/ and also because it is ...
30
votes
3answers
27k views

Is 7-Zip's AES encryption just as secure as TrueCrypt's version?

The main difference being TrueCrypt creates containers and 7-Zip encrypts the file itself, so file sizes can be guessed. Now let's just talk about the strength and breakability of the encryption. ...
21
votes
4answers
3k views

How would you store a 4 digit pin code securely in the database?

I'm familiar with password hashing, using salts, bcrypt etc. But it doesn't seem like this would work to store a 4 digit pin code since the attacker could try all 10,000 combinations quite quickly. ...
16
votes
2answers
29k views

Security comparsion of 3DES and AES

Which one is more secure and least possible to be broken through cryptanalysis AES or 3DES (no matter performance)? I need to use encryption for my projects to store and secure sensitive information ...
9
votes
4answers
4k views

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them. When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
4
votes
1answer
971 views

Whats the best custom compression method to use when I have SSL?

Suppose I have an application which does encryption using SSL and provided you cannot control what cipher suite is being negotiated, and assuming that I have some custom compression over the data ...
4
votes
5answers
14k views

Is there a simple example of an Asymmetric encryption/decryption routine?

I can understand Java, Perl and JavaScript code very well. The rest, I have not studied, but I guess I could figure out how to read/translate. I would like to know what the simplest of Asymmetric ...
23
votes
2answers
1k views

What is the attack tree to intercept traffic on Wimax?

My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
18
votes
2answers
1k views

Homomorphic encryption used for e-voting?

I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused: "The homomorphic property of various cryptosystems can be used to create secure voting systems, ..." ...
17
votes
3answers
2k views

Is SHA1 weak for SSL?

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
15
votes
2answers
3k views

How does non-ephemeral Diffie-Hellman key exchange become compromised in SSL when the RSA private key is leaked?

From my understanding, one of the major reasons we recommend Diffie-Hellman Ephemeral (e.g. DHE or ECDHE) over non-ephemeral DH, for SSL / TLS, is that compromise of the RSA private key (i.e. private ...
15
votes
2answers
3k views

What's wrong with storing private keys in the cloud?

I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
13
votes
3answers
6k views

How to encrypt database connection credentials on a web server?

OWASP advise against storing DB credentials in plain text: https://www.owasp.org/index.php/Password_in_Configuration_File However, they don't provide suggestions of how to encrypt the DB access ...
11
votes
3answers
2k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
11
votes
7answers
3k views

Why can an encrypted private key be brute forced?

When using SSH keys to authenticate to a server for remote access, why is it possible to devise the true key and therefore the passphrase from an encrypted private key, without checking each guess of ...
10
votes
5answers
3k views

Confusion: Why isn't a passhrase encrypted SSH key two factor auth?

I'm trying to figure out the best practices for accessing my devbox from a public terminal. Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
8
votes
4answers
460 views

What steps should one take to provide “reasonable” levels of privacy from a government?

I'm highly uncomfortable with the recent news surrounding government snooping in the UK. If we define a typical user to mean somebody who: Browses web sites such as BBC News and Stack Overflow Uses ...
8
votes
1answer
1k views

How to choose a stream cipher

Are there high-speed ciphers designed for things like internet streams without sacrificing security? There are so many options that operate in stream mode. How would one choose a cipher?
7
votes
1answer
2k views

SSL encryption and SSL certificates

I know for a fact that it's possible for for an SSL\TLS session to go on without an SSL certificate, meaning you pass encrypted data, but you don't have a solid foundation of who you are really ...
5
votes
1answer
3k views

Android / CyanogenMod encryption vs GNU/Linux

Hi I am trying to understand how encrypting an Android based phone works compared to a GNU/Linux host which relies on LUKS dm-crypt. Here is what I understand: Encrypted LVM on GNU/Linux is an ...
3
votes
3answers
317 views

Can a zero knowledge proof of voting be made using a trusted auth server (without client side crypto)?

Questions: Can one implement a secure voting system having all the features described below? e.g. without disclosing any individual's vote to the government server (or the third party), preserving ...
1
vote
1answer
1k views

Which is the Best Cipher Mode and Padding Mode for AES Encryption? [closed]

As per PCI-DSS 3.4 requirement: For storing Credit Card Data Strong Cryptography should be used. I decided to use AES Encryption which is a strong and mostly recommended crypto for encrypting ...
18
votes
4answers
1k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
13
votes
11answers
1k views

For users that does not use PGP, what would be the other channel to securely send them a document?

I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email. The real question is how to do that? ...
12
votes
2answers
892 views

Protection of Keys/Passwords on Virtual Hardware (XEN, KVM, VMWare, etc.)

Is there any reasonable way to secure data on virtual hardware? What I mean by "virtual hardware" is the various hosted systems that one can rent from various online hosters, that run on top of XEN, ...
12
votes
6answers
13k views

How secure is NTFS encryption?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? (The encryption option under file|folder -> properties -> advanced -> encrypt.) If the user uses a decent password, can this ...
11
votes
4answers
10k views

Is RedPhone a secure and secret way to communicate?

RedPhone provides end-to-end encryption for your calls, securing your conversations so that nobody can listen in. But really, how is the probability that a voice conversation is wiretapped still? ...
10
votes
4answers
2k views

Location to store an encryption key

I'm building a secure system which stores messages on a server in a Postgresql database. The messages are stored encrypted with PHP's openssl_encrypt() function with the AES-256-CBC method. At the ...
8
votes
3answers
2k views

Does Android encryption really prevent law enforcement access?

Google recently announced that in Android L encryption would be turned on by default: For over three years Android has offered encryption, and keys are not stored off of the device, so they ...
8
votes
1answer
498 views

Build a secure channel without SSL/TLS

I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service). 1. ...