Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

6
votes
2answers
2k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
5
votes
5answers
1k views

What's the State of the Art of Homomorphic Encryption?

I get the impression from some internet resources I have skimmed that homomorphic encryption is yet computationally very inefficient. However, an Infineon press release from 2010 says that the CPUs of ...
4
votes
4answers
3k views

Why do you need message authentication in addition to encryption?

I've been reading up on Authenticated Encryption with Associated Data. The linked RFC states: Authenticated encryption is a form of encryption that, in addition to providing confidentiality ...
3
votes
1answer
2k views

What are the Netscape Cert Type attributes? Why/when are they needed?

What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions? Example: There is the Client/Server Extended Key Usage (X.509) but there is ...
3
votes
4answers
5k views

What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase

(Note: originally posted in SO - advised to post on SSE) With regards to Rijndael encryption, what (if any) are the best practices (and consequences) regarding the periodic modification of one or ...
3
votes
3answers
2k views

Is encrypting data with a private key dangerous?

I have been reviewing code for various internal apps that handle secure transmission of data with external systems. These follow the following process: RSA encrypt data with 3rd party public key RSA ...
2
votes
3answers
3k views

Why different key exhange techniques for ssl key exchange?

During ssl key exchange, I have read that sending the symmetric key to the server encrypted with the server's public key is an old technique. Now for key echange Diffie hellman and other techniques ...
1
vote
1answer
277 views

In PSK TLS, how is the key used for encryption derived?

I'm trying to decrypt a message sent over a secure communication channel using TLS_PSK_WITH_3DES_EDE_CBC_SHA. I now have the client random number, server random number, PSK identity and PSK value. My ...
1
vote
2answers
2k views

What's the limit on the size of the data that public-key cryptos can handle?

Someone mentioned here that asymmetric encryption might not be appropriate for bulk data and gave an example of RSA with 100 bytes. Of course, I understand that it was a rough example. But it made me ...
1
vote
2answers
912 views

encryption method against man in the middle attack

Let's say there are 3 computers: Alice, Bob, Carol. Carol is network provider, so everything from Alice to Bob and vice versa passes through Carol. Carol can modify messages between Alice and Bob. Is ...
0
votes
1answer
66 views

Bridge mode question [closed]

İ have an outdoor in my shop and distributing my network to customers using mac filtering opition.. one of my neighboor got a weak signal....so, he bought a wirelss repeater to recieve a better ...
0
votes
1answer
391 views

Can eavesdropping be facilitated by injecting content that will be transmitted?

I was asked during a job interview the following question, to which I couldn't find an answer then, and this thing is still bothering me. I was hoping someone might know the answer here: Consider ...
0
votes
2answers
167 views

Monitoring user use VPN

If there is an employee uses the internet through an internal proxy in his company, and he use a paid VPN service to browse safely, can IT side be able to monitor his behavior?
11
votes
1answer
822 views

Any risk in using the same salt for several hashes on a user?

Right now I'm storing a salt and password_hash on the users table (pretty standard stuff). The need arose to get a secure hash of another field for a user. Is there any risk in reusing the same salt ...
8
votes
3answers
2k views

Is it safe to store a single symmetric key encrypted with several different RSA public keys?

For the field-based encryption of a database containing sensitive information, I was thinking of the following design: Every user has a smartcard used for client certificate login. After login the ...
7
votes
2answers
4k views

WPA2 Enterprise AES encryption key size?

I have recently set up a RADIUS server with EAP for my wireless router, however, I have some questions about the key size and how WPA2 enterprise (AES) works in general. I have read that in ...
7
votes
3answers
13k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
6
votes
1answer
1k views

How do I learn Cryptographic/Mathematical notation

I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation. How do I learn this notation and how to convey my approach? How can I annotate this ...
5
votes
1answer
611 views

Database encryption or filesystem encryption?

Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
5
votes
1answer
254 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
4
votes
2answers
232 views

Does adding a non-entropic part to a password makes it less secure?

Suppose I'm encrypting a file via AES using a password of my choice, or creating a TrueCrypt volume using a password and no keyfiles. Which of the following two passwords would be more secure: ...
4
votes
3answers
826 views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
3
votes
2answers
209 views

How does my bank knows my second and forth chars of my password [duplicate]

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
3
votes
2answers
4k views

How effectively can ISPs detect illegal file sharing?

Recently the USA passed a law requiring ISPs to spy on their customers' internet connections to check for illegal file sharing. I assume that they would do this by sniffing packets, but doesn't this ...
3
votes
2answers
190 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: ...
2
votes
2answers
289 views

What is the problem with multiple encryption and how do you know if you have decrypted a cipher?

I have 2 questions that are somewhat related: 1. When you try and guess the key in a program (in a brute force way), how does the program know if it got it right and it had deciphered the message (I'm ...
2
votes
2answers
373 views

Keepass Dictionary Attack Protection Strategy

Though pretty interested, I'm everything but an expert in Information Security, please redirect me to any helpful resources if my question is stupid or correct me if my assumptions are wrong. When ...
2
votes
1answer
393 views

Security Certificates - Tools to Generate Security Certificates

I want to create a self-signed certificate that will be installed as a trusted certificate authority. I then want to create another two certificates which are signed using the private key of the ...
2
votes
5answers
569 views

Does shuffling a hashed password increase its security?

I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example) and then I will reshuffle the ...
2
votes
2answers
862 views

Determine encoding/hashing methods used based on knowing the input and output only?

If I know the initial value of a string and the resulting hash but have no access to the system that produces the output, how can I determine what has actually occurred so I can reproduce the hashing ...
2
votes
1answer
858 views

Vulnerabilities in Host Proof Hosting

I've recently been doing some research on Host-Proof Hosting, specifically in a web app environment. It seems like a pretty rock solid method of security, but I'm certainly not a security expert and ...
1
vote
2answers
172 views

With RSA, can one ensure that two entities will not have the same private key?

With the RSA encryption algorithm, is there any guarantee that two different entities will not be given the same private keys?
1
vote
1answer
2k views

Symmetric Key Cryptography vs Public Key Cryptography [duplicate]

I understand what the two are so need to go into detail about that, however what I'm curious about is in what kind of situations would we use one over the other? It feels to me as if Public Key ...
1
vote
1answer
229 views

Implementation review - Independent key, admin side and user side

The admin of the website needs to read user data. So, if the key is derived from the user pass, then the admin has to know the user pass, not exactly a good idea. The following encryption scheme was ...
1
vote
2answers
332 views

Seeking lightweight encryption - shareable between Delphi & C

I want to encrypt a text file in Delphi & decrypt it, line by line, in C on an embedded system which does not have much RAM (so, only one line in RAM at a time). FOSS must be available for both ...
0
votes
2answers
411 views

Are SSL encrypted communications through a company network safe?

If I'm using Skype, Facebook, or another type of communication at my work, can the network administrator see my Skype and Facebook conversations, although its encrypted with SSL? I found this text: ...
0
votes
4answers
197 views

How does an encryption key work? [closed]

I'm having trouble understanding how an encryption key works. for example: if the word was 'hello' its encrypted value could be 'GHSSDgsd2', what would happen to the encrypted value if the key was ...
0
votes
1answer
166 views

Any issues with this security design for cloud storage? Server doesn't even need to know password to log someone in

I've created an algorithm I think I'm going to use for a cloud storage service I'm developing- if there are no issues or vulnerabilities with it. It's this along with TLS and forward secrecy ...
0
votes
2answers
267 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
0
votes
1answer
372 views

Enterprise Encryption Considerations

What are the different aspects to consider for Enterprise Encryption policy? So far the resources I have are: https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet ...
94
votes
9answers
56k views

Why can we still crack snapchat photos in 12 lines of Ruby?

Just came across this bit of ruby that can be used to decrypt snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked no problem, considering the ...
33
votes
2answers
9k views

Web Application encryption key management

In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions: ...
21
votes
4answers
18k views

Multi-boot with full hard drive encryption and pre-boot authentication

How would I set up a multiboot system which supports full hard drive encryption and pre-boot authentication. I have a system with Ubuntu, Windows 7, Windows XP, and I would like to install Red Hat. ...
30
votes
4answers
22k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
36
votes
6answers
4k views

Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?

Current setup We have a service that allows users to upload documents through a website and stores the uploaded documents encrypted on disk. The documents on disk are encrypted with a per-user key, ...
20
votes
2answers
30k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
34
votes
7answers
4k views

How dangerous might be publishing a public key?

Maybe this question sounds obvious, but I wonder how dangerous might be publishing a public key for an asymmetric encryption system? I know public keys are meant for encrypting messages by anyone ...
22
votes
9answers
6k views

Is encryption in HTTPS done by the browser or by the system?

This may be a common sense question, but I am not able to find any documentation on this after searching on google for a long time When browser makes a HTTPs request, does it encrypt the data then ...
14
votes
7answers
10k views

What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?

I'm interested in updating this two pronged question for 2011: What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective? What cryptology is most ...
9
votes
2answers
11k views

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...