Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

16
votes
9answers
6k views

Would an encryption scheme that generates an extra key to be securely stored offsite be a safe backdoor?

Let me be clear first and foremost: I do not think installing a backdoor in security algorithms is a good idea. They undermine the trust in the software and in the company that provides the service. ...
2
votes
2answers
237 views

How to tell if an email is encrypted, or just corrupted?

Ran a recovery program (Kroll Ontrack) on a Windows 7 PC and recovered many, many emails. Almost all of them open in my Windows 10 mail client (and Thunderbird), except for a handful from this March. ...
0
votes
2answers
164 views

store passwords as one-way-hash, or just use it as an AES key?

I want to store some data so the only one who'll be able to access it is the user itself. Here is my idea: when user registers, his password will be hashed in SHA256 (so it'll fit as an AES key), and ...
-1
votes
2answers
111 views

Are the websites I visit using Windows Remote Desktop connection secure from my ISP?

Are the websites I visit using Windows Remote Desktop connection secure from my ISP? I am ok if my ISP knows the IP address of the remote desktop I am connecting with but will they also be able to '...
-1
votes
2answers
26 views

Security fails in private key and xor

I've implemented a very short program to encrypt a file, and send it on a remote server. First, I build a key based on a pass-phrase and a subset of prime numbers (the length of the key is defined by ...
0
votes
0answers
59 views

Would encrypting a signed JWT prove viable to secure claims payload?

I am working on a server-client web application, and as an authentication scheme, I am issuing base64 encoded json web tokens. Consider the following token... eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9....
0
votes
2answers
97 views

What's the best place to hide long lived encryption keys

I am considering encryption options for a new Sybase project (internal facing only, sitting in our intranet) for a client that has a security policy that requires all sensitive data to use DB ...
1
vote
1answer
64 views

OpenSSL brute-force attacking and file size

I use OpenSSL with aes-256-cbc to encrypt a 30 GB tar file containing a recent backup of my hard drive. Now suppose somebody wants to run a brute-force attack on this file, trying out all possible ...
0
votes
1answer
49 views

Why is CBC-MAC insecure for variable length input?

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Like the highlighted parts in following pictures Slide 32: Slide 33:...
0
votes
1answer
86 views

Handling user login using asymmetric cryptography

Is it possible to implement a login protocol with asymmetric cryptography instead of the hashed password method? For example, while creating an account, the client generates a private/public key pair ...
0
votes
2answers
105 views

Is encrypting a CRC with the plaintext ok?

We're using encrypt-then-mac for authenticated encryption, and recently added a CRC32 to the plaintext. Are there any security problems with using a non-authenticated hash mechanism (for example, ...
0
votes
1answer
150 views

How secure is FaceTime by Apple

Apple says their messages and FaceTime calls are end-to-end encrypted and nobody can access them. As I'm unfamiliar with cryptology, I've found security white paper from Apple, where says: ...
1
vote
1answer
64 views

Making an encrypted SMS app (Android) [closed]

From my limited googling I've noticed that a lot of the mainstream encrypted messaging apps all are either (or a combination of!) closed-source, run through an uncontrolled third-party server, use a ...
0
votes
0answers
67 views

Is the QUIC protocol secure?

QUIC is a new protocol for video streaming, that can establish a secure connection in one round. It is used in Google's new Duo app for example. How does it work and is it secure (comparison with TCP ...
3
votes
0answers
80 views

Security of the shared secret key for a smart meter (Linky) [closed]

Reading the specs of a new electricity smart meter (called Linky in France), I was surprised about the chosen encryption method (128 bits symmetric key AES), based on a single secret key (called CCC ...
2
votes
2answers
83 views

Is there a difference between getting encryption key versus encrypted data from server in terms of security

Suppose we have web and application servers and trying to encrypt credit card information for our financial web application. Communication between web and app servers are secured through SSL/TLS. Lets ...
0
votes
1answer
57 views

Crypto++ RSA - Encrypt and sign with the same key pair

I have a program A which needs to send messages to several instances of program B (B1, B2, etc...). The messages must be encrypted, and also signed. Which means only Bn instances can decode, and they ...
3
votes
1answer
128 views

DES Decryption followed by Encryption, will it produce the original text?

This is regarding DES. My question is, if a plain text is first decrypted (with the decryption algorithm) using Key K1 and then encrypted using same K1, would the result still be the original plain ...
0
votes
1answer
89 views

Windows security & data protection

I work for a hotel. The hotel stores a MySQL database online. This database only contains a Reference ID, number of nights and so on, but no private data. No names, no personal information on guests. ...
2
votes
2answers
122 views

Known vulnerabilities of GOST

Are there any known vulnerabilities in the GOST block cipher (GOST 28147-89)? Spcifically, I'm thinking about i.e. "master keys" which intentionally exist and are used i.e. by the Russian government. ...
5
votes
1answer
134 views

How to protect TimeMachine backups from Ransomware?

According to Heise (German) Time Machine backups can be encrypted by Ransomware. Sorry I didn't find an English source, please use Google translate. KeRanger had an inactive module ...
2
votes
1answer
101 views

Who defined the term “end-to-end encryption”?

I am trying to find the origin of the term "end-to-end encryption", but have been unsuccessful until now.
1
vote
0answers
61 views

End-to-end encryption without user-keys interaction

Is it possible to have true end-to-end encryption even if the user is not involved in generating, selecting, transporting, or storing of the keys?
1
vote
0answers
45 views

VPN chain in one machine without VM natively

Is it any way to make VPN chain in one machine (MAC or WIN) without VM natively (L2TP/IPsec)? I need this for obtain an extra layer of security. For example - if one VPN turns off I still have ...
0
votes
0answers
38 views

Preventing a key from being found by analysis

Lets say Alice wants to send an encrypted message to Bob. They both know a secret key. Alice uses the key to encrypt the message and Bob uses the key to decrypt the message. Now, if the handshake ...
6
votes
0answers
51 views

Why would I use at-rest encryption over a DB's key-based encryption?

Goal I want to store encrypted data in a database. Constraints Application-level encryption (encrypting before sending to the DB) is not a reasonable option for my use case. The DB providers I'm ...
5
votes
1answer
138 views

How to share an encryption key between different PHP applications?

I'm working with the php-encryption library to provide integration between two different applications. On one side, I have a corporative application that holds all data from users. This application ...
2
votes
2answers
105 views

What information can my ISP see using squid proxy?

My ISP provides a transparent proxy to use and I can see that they are using the squid proxy for caching this. What I am wondering is what data can they see and what can they see further if they can ...
-1
votes
1answer
151 views

How can this encryption algorithm be improved?

I am currently developing an application to store my passwords safely. It will be a proof-of-concept at first, but I am planning to upgrade it later. Anyway, here is how the passwords are accessed: ...
0
votes
1answer
171 views

Is this a good scheme for storing encrypted user credentials?

We are building a service that manages multiple user accounts. For that reason, we need to store the credentials to a user's accounts using a symmetrical algorithm so they can be retrieved for the ...
20
votes
2answers
3k views

Why was DES with 112 bit keys (IBM) reduced to 56?

On the French wikipedia page about DES it says that the original DES algorithm from IBM used 112 bit keys. Why did they reduce this to 56 bits? Edit: ok NSA convinced IBM but today it seems like a ...
1
vote
1answer
227 views

Is this algorithm really end to end encrypted and secure?

I'm creating an anonymous chat where one of the premises is that the conversations are end to end encrypted. I'm using firebase so all the comunication between the clients and the server is SSL ...
15
votes
2answers
1k views

What's the difference between a hashed and an encrypted password?

Alright, so I know this may sound dumb, but I'm having a hard time understanding what an encryption would be since it's different from a hash. I've read up on it, but I'm still not quite sure. So, I ...
1
vote
1answer
261 views

How to use nmap through proxychains?

Iam running nmap through proxychains using this comand proxychains nmap -v scanme.namp.org This produced an error showing like this root@kali:~# proxychains nmap -v scanme.nmap.org ProxyChains-3....
0
votes
1answer
42 views

Do I need to use GPG subkeys for my backups?

I'm reading a lot about the need to separate the master key from additional encrypting or signing keys, like these links: GPG subkey layout. Separate keys for C, S and E? https://alexcabal.com/...
0
votes
0answers
58 views

Is it possible for an attacker to log keystrokes of a bluetooth or wireless keyboard [duplicate]

Bluetooth and wireless keyboards are sending keystrokes wirelessly. Could this mean that an attacker (or spy) can log the keystrokes by monitoring the wireless or Bluetooth radio waves (or whatever)? ...
0
votes
1answer
181 views

Is a password-protected excel file considered secure versus encrypted file or email

I understand that encryption is the highest form of security for document/data storage. While a password-protected document is more secure than one without password protection, if the document is ...
0
votes
1answer
32 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...
0
votes
2answers
97 views

How do data breaches of account login information end up in plaintext?

For example, see this story. Am I missing something here? Are the login details actually still encrypted? I don't understand how it is possible for a data breach of what I assume is encrypted ...
0
votes
1answer
40 views

Unsecure FTP with Encrypted file and Wireshark leakage

Hi i was wandering if it is possible to have a password leaked to an encrypted file on an anon ftp server with r-x-w permissions. So for example i have a file encrypted using gpg and when opened on ...
-1
votes
6answers
2k views

How to prevent illegal file transfer or copying of video files from a PC? [closed]

I have developed a windows desktop application using VB.NET. My applications main purpose is to play videos. I have some videos which has copyrights on them, that are not suppose to be distributed or ...
13
votes
5answers
2k views

Why does IV not need to be secret in AES CBC encryption?

According to Wikipedia, the initialization vector (IV) does not have to be secret, when using the CBC mode of operation. Here is the schema of CBC encryption (also from Wikipedia): What if I ...
3
votes
2answers
86 views

Does TLS rotate the shared secret periodically?

After the initial shared secret is agreed upon between the client an server through the TLS handshake does the shared secret get rotated periodically ?
1
vote
0answers
78 views

Android Rooting and Evil Maid Attacks

I'm trying to learn more about full disk encryption (in the context of a Linux based server) and what schemes offer true security and which only offer the illusion of security. As I understand it, ...
0
votes
2answers
60 views

Replacing files with infected files on anonymous ftp server

I am creating a new question as i now have another question which was raised from a previous answered question post. What im trying to figure out is would this scenario be possible. I have an ...
2
votes
1answer
83 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
8
votes
4answers
872 views

Can governments intercept end-to-end encrypted Whatsapp communication through lawful interception?

Since Whatapp started end-to-end encryption with an option for users to verify keys, many government security agencies, like the Indian one, red-flagged such use of encryption. Now, Yesterday the ...
1
vote
1answer
83 views

What is the best practice to secure an unattended Raspberry Pi?

I'm working on a project which involves mounting a Raspberry Pi on a self-moving vehicle. I'm looking for the best way to encrypt the Pi (entire file-system, swap, etc.), with the minimum possible ...
3
votes
1answer
124 views

Is there readily available encryption algorithms for current computers, that is safe from quantum computers?

Is there readily available encryption algorithms for current computers, that is safe from quantum computers? I know a bunch of currently popular encryption algorithms that are safe from current ...
0
votes
0answers
50 views

SQLCipher and PRAGMA key on iOS

I'm a bit confused as to how SQLCipher handles the PRAGMA key provided for encrypting the SQLite database For background: I'm looking at options for encrypting application data at rest. From the ...