Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
2
votes
4answers
732 views
CMS Uses http and so sends password in plain text
A well known CMS called Joomla allows users to register and the password appears hidden as you register with dots a normal experience online - at this point you think just you know it. But if the site ...
2
votes
4answers
1k views
Is multiple encryption a good idea?
I know that many encryption algorithms, while secure, have vulnerabilities.
To reduce risks, would multiple encryption like this
Blowfish_CbC ( Rc2_OFB ( AES128_CBC (myfilecontent)))
be a good ...
2
votes
3answers
398 views
What is the recomended algorithm to create a key from a password?
In my new secret document encryption utility, the key for symmetric encryption = the hash of a random salt and a user provided password.
It is necessary to have a slow hash function in order to ...
2
votes
3answers
175 views
Would a per-file encryption system any more or less secure than volume encryption?
Guessing they're the same, but not 100% sure.
UPDATE: My mistake for not clearly stating the it would be assumed the keys per-file, or for a whole volume, would be the exact same -- not to mention ...
2
votes
3answers
519 views
How can I share files with other individuals in the cloud in a secure way?
I would like to us a dropbox because it is easy and convenient.
But I want to encrypt the files with the public key of the intended recipient, so he will be the only one who can access the data in ...
2
votes
3answers
783 views
AES for key encryption
Is AES a good choice for protecting a key stored on the computer of a user of my application? I have seen threads on hashing passwords that suggest using slow algorithms for defending against brute ...
12
votes
6answers
742 views
Why not RSA-encrypt the entire document?
I have recently learned of a way for person B to verify that a document sent from person A is indeed from person A.
Person A gives Person B his public RSA key. This must be done reliably.
Person A ...
12
votes
3answers
1k views
When using AES and CBC, can the IV be a hash of the plaintext?
[Originally on programmers.stackexchange.com with title: Can you encrypt with AES+CBC and search the encrypted data]
Basically, I'm going to go with Advanced Encryption Standard with either ...
10
votes
3answers
539 views
Encryption-Laws in Iran
According to this article Iran has criminalized the usage of encryption and VPNs.
According to this blog post it is still possible to use SSH tunnels in Iran.
For me SSH is encryption and thus ...
8
votes
2answers
407 views
Protection of Keys/Passwords on Virtual Hardware (XEN, KVM, VMWare, etc.)
Is there any reasonable way to secure data on virtual hardware? What I mean by "virtual hardware" is the various hosted systems that one can rent from various online hosters, that run on top of XEN, ...
8
votes
4answers
599 views
Automated encryption detection
Is there any program that, given a cipher text, it would tell me what the encryption algorithm is?
What if I have the plain text? Is there something that can be done in that case?
8
votes
4answers
2k views
moving from MD5 to SHA-512
This question is more of a security policy than a technical security question.
Many years ago I developed an asp.net site, implemented Forms Authentication, and stored the user passwords as MD5 ...
7
votes
3answers
420 views
Secure PXE network OS installation
How can one make sure that when PXE is being used to boot a remote operating system, that the data being sent is encrypted (or at the very least that integrity is maintained)?
Would it be possible to ...
6
votes
3answers
425 views
Computer decryption algorithms and knowing the solution
This is a general question about using computers to decrypt information. It has puzzled me for a while.
The question is really two parts:
How does a computer check if a "guessed" key is the correct ...
6
votes
2answers
563 views
Do Flash memory (SSD) architecture impacts encryption techniques?
I'm working on encryption techniques on SSD's and my question is: does the erase before write architecture of SSD's has anything to do with the encryption technique?
What are the problems I might ...
6
votes
3answers
638 views
Is the OpenPGP private key inherently password-protected?
I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key?
Essentially, ...
6
votes
1answer
420 views
How do I learn Cryptographic/Mathematical notation
I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation.
How do I learn this notation and how to convey my approach?
How can I annotate this ...
6
votes
4answers
517 views
What is your process for wiping a lost Blackberry or similar device?
For all devices I know of, if a device is lost or stolen, it needs to be connected to the Cellular network to receive the wipe command. Considering that the end user often needs to regain mobile ...
6
votes
3answers
4k views
Why triple DES used in EDE mode?
Why is triple DES is calculated in encrypt decrypt encrypt mode? Why a decrypt in the middle? And isn't decrypt = encrypt since DES in a symmetric cipher?
5
votes
2answers
742 views
Pitfalls of SSD encryption
Encrypting an SSD is a process that is sometimes warned should be done with caution. E.g. http://en.gentoo-wiki.com/wiki/DM-Crypt_with_LUKS mentions how the SSD may keep hidden space used for wear ...
5
votes
3answers
237 views
Digital Signature and Verification?
AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it.
So public key is used to decrypt ...
5
votes
7answers
959 views
Verify the password of an encrypted file without waiting for complete decryption
I am currently working on an application that encrypts files with AES 256.
The problem is that I want the user to see whether the password is wrong before the file is decrypted.
For example if you ...
5
votes
2answers
826 views
Is a JavaScript implementation of AES any less secure than other language implementations?
There are a few JavaScript AES implementations available such as Gibberish-aes
So assuming the AES algorithm has been implemented correctly in this library then it should be as secure as any other ...
4
votes
1answer
131 views
What issues might exist with TLS-OBC's emulation of Browser Certificates?
TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
4
votes
2answers
625 views
Have anyone tried to extract the encryption key from a SSD?
After reading this forum thread it does not sound like encrypted SSDs provide much protection at all - specifically encryption only occurs between the controller chipset and the NAND storage.
Why is ...
4
votes
2answers
237 views
How are possible uses for X.509 (SSL) certificates denoted?
X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
4
votes
2answers
877 views
Can RSA (or any public/private key algorithm) be repeated for large amounts of data?
I'm working on a small security assignment and I was instructed to implement simple encryption/decryption of files using RSA in C#.
When attempting to encrypt/decrypt large files, I was informed by ...
3
votes
1answer
281 views
Does KASUMI (A5/3) Related Key attack apply to 3G or other mobile providers?
The KASUMI is a block cipher used to encrypt UMTS, GPRS, and GSM SMS messages. The references section in Wikipedia says that a related key attack is possible in 3G systems.
Q: Has it been proven ...
3
votes
1answer
487 views
Storage of 'secrets', keystores, HSMs and the rest
I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
3
votes
1answer
161 views
Can wildcard certificates hide/obscure the hostname in a TLS connection?
I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...
3
votes
1answer
576 views
Peer review of C# cryptography for Azure Table security
Edit: Update - I am researching how to implement AES with authentication in an efficient way for this project. If you have the time I'd appreciate your skill in finding the best implementation for ...
2
votes
1answer
86 views
Making undeterminable containers inside existing file system
Suppose, I have 1 disk partition (previously filled with random data) and create some file system on it (NTFS, FAT, EXT2, etc). I am going to keep some files here (i.e. visible files).
Then i create ...
2
votes
1answer
468 views
Security of bcrypt/sha256 key used with AES to encrypt a file
I'm looking to encrypt files using secure hashing and encryption algorithms in Python. Having used bcrypt in the past, I decided to use it for my passphrase calculator, then pass the output through ...
2
votes
1answer
118 views
Password checking in the context of symmetric encryption
It is my understanding that block ciphers like AES don't have any built-in mechanisms to verify data integrity upon decryption, although some modes of operation might provide that.
I played around ...
2
votes
2answers
445 views
How to use 'key material' so that multiple people can access protected files?
I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
2
votes
2answers
314 views
Do you require a special type of certificate for using Diffie Hellman as the key exchange protocol in SSL?
In Diffie Hellman key exchange technique both the parties aggree on a common parameter g then they generate their private parameters a and b . Then they exchange g^a and g^b. now they can calculate ...
2
votes
2answers
468 views
What should I know before configuring Perfect Forward Secrecy?
PFS has gained attention in our audit department because of its' innate ability to limit our exposure if someone steals our private key.
What pitfalls or common mistakes should I be aware of before ...
2
votes
1answer
249 views
Clarification needed for NIST's whitepaper “Recommendation for Password-Based Key Derivation”
What are some sample use-cases the NIST is supporting in this policy / whitepaper regarding PBKDF2?
This Recommendation specifies a family of password-based key
derivation functions (PBKDFs) ...
2
votes
2answers
157 views
Which private-key encryption should I use for server to server communication?
I am tempted to write my own which covers:
Checksum to ensure data is not tampered with.
Long and multiple rotating keys so that it is (practically) impossible to decrypt.
Will use /dev/random for ...
1
vote
3answers
245 views
Should I use a Firefox master password or NTFS encrypt my profile?
As a follow-up to another question, is the encryption via Firefox' master password more secure than simply NTFS encrypting the profile folder? I.e. is there a convincing reason to add the ...
1
vote
2answers
392 views
Can fully homomorphic encryption be practical?
Fully homomorphic encryption has been implemented by Craig Gentry using ideal lattices.
Can it be applied to data stored on a private cloud setup in practice?
I've seen references here and on other ...
1
vote
4answers
631 views
Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?
I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following ...
1
vote
1answer
165 views
About performance of Smart card for performing 3DES in a MD5 hash
Another question related to previous, unanswered A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
Another alternative is to store the keys in a Smart card permanently ...
1
vote
1answer
198 views
What are the requirements for a random number generator to a be safe to use in cryptography?
When I look at most RNG's (random number generators), I see a disclaimer that looks similar to this:
Caution: Mersenne Twister is basically for Monte-Carlo simulations - it is not ...
1
vote
1answer
185 views
How to check for a key *and* store encrypted data?
I wish to create a system wherein I store encrypted data.
Users can access this data if they have the key. If they give a wrong key, they don't get access at all. If they give the right key, they get ...
1
vote
2answers
2k views
How can I recover encrypted files after system reinstallation
I had a file which contains images and videos, I was using the windows 7 ultimate and I had encrypted the file. Now I have copied that file to my hard disk and format that operating system and again. ...
1
vote
2answers
417 views
Which encryption algorithms will be used to replace RSA when quantum computers become common? [duplicate]
Possible Duplicate:
Are the encryptions "broken" with great computing power?
I just wondered which algorithms will be used once quantum computers become common. Are there already ...
1
vote
2answers
2k views
What are private key cryptography and public key cryptography, and where are they useful?
I don't understand the real world usage scenarios of these cryptography methods. Can any one please explain how they work, with examples and also their usage in the real world?
1
vote
2answers
171 views
TCrypto - Comments about design decisions I made?
I have pushed some code to GitHub to demonstrate the usage of symmetric key encryption in PHP. It is a small key-value storage library and it (optionally) offers ability to encrypt the stored ...
0
votes
2answers
186 views
Where do I securely store application-specific symmetric key?
I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere.
From a similar ...
