Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

18
votes
3answers
15k views

How to encrypt database connection credentials on a web server?

OWASP advise against storing DB credentials in plain text: https://www.owasp.org/index.php/Password_in_Configuration_File However, they don't provide suggestions of how to encrypt the DB access ...
18
votes
3answers
2k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
17
votes
8answers
69k views

How can I determine the encryption strength of an SSL connection

If I've connected to a https url, how can I determine the cipher strength of the connection? My understanding is that after the asymmetric public-key handshake the information is encrypted using a ...
17
votes
8answers
4k views

Is it possible to construct a passively self-destructing message?

Is it possible to construct a message that passively degrades over time without requiring an external factor to destroy it? Things that are similar, but not what I mean: A hard drive that degrades ...
17
votes
2answers
6k views

How Does A Random Salt Work? [duplicate]

I don't understand how using a random salt for hashing passwords can work. Perhaps random salt refers to something other than hashing passwords? Here is my thought process: The salt is used to add ...
17
votes
2answers
3k views

Are Playstation 4 communications really harder to monitor?

I have read on the net that authorities are having troubles monitoring Playstation 4 communications. As usual the news are very non technical. What makes the Playstation 4 network harder to ...
17
votes
5answers
10k views

SQL field level encryption, how safe is it?

I am considering encrypting my database and/or encrypting only certain columns in a few tables. Is it worth the time? I mean, how much of a burden would it be on someone if they were to get a hold of ...
17
votes
8answers
6k views

Is TrueCrypt safe enough to store clear-text-passwords?

The reason: I want to be able to use a portable USB drive to access my passwords on any machine and OS. TrueCrypt seems to be the only program that has sufficient support on all major platforms. So I ...
17
votes
1answer
3k views

Why can't I use the same key for encryption and MAC?

I wrote a simple file encryption program as an example of how to do encryption correctly, but after reading a questions about encryption + MAC, I think I made a mistake by using the same key for both. ...
17
votes
10answers
6k views

Encrypting email for gmail

My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
16
votes
6answers
10k views

How do I prevent copying of my PDF files?

One time while I was printing my documents at a copy center, I saw they dragged-and-dropped my PDFs from my flash drive to their desktop. How do I protect my files without using password? Is there a ...
16
votes
4answers
3k views

Is it dangerous to publicly share ciphertext?

Alice wants to share a message with Bob, but Alice and Bob can never be in the same place at the same time. We can assume they both know each others public keys (or agreed on a shared key, if that ...
16
votes
7answers
15k views

What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?

I'm interested in updating this two pronged question for 2011: What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective? What cryptology is most ...
16
votes
3answers
2k views

Is it safe to write the salt AND/OR the IV at the beggining of an encrypted file?

I want to encrypt a file with AES in CBC mode (maybe another mode is better for file encryption...I don't know, but suggestions are welcome!). What I usually do is that I first write a few random ...
16
votes
3answers
17k views

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
16
votes
4answers
4k views

In what ways does Full or Partial Homomorphic Encryption benefit the cloud?

Can someone explain, in plain English, the practical ways FHE and PHE can be leveraged in the cloud? Some interesting (and confusing) links include this Microsoft Research PDF and this wiki entry. ...
16
votes
5answers
1k views

How should passwords be stored if they must be recoverable?

By "encrypting" passwords you are violating CWE-257: Storing Passwords in a Recoverable Format. But this is exactly what the French government wants. They want to be able to obtain the passwords of ...
16
votes
5answers
3k views

The AES Crypt implementation hashes a password 8192 times to generate the key. Is this necessary?

I'm considering encrypting some small files (hundreds of kb apiece) using the AES Crypt reference implementation. Looking at the source, it seems that the encryption key is derived from the IV and the ...
16
votes
3answers
1k views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
16
votes
3answers
6k views

Forced into using a static IV (AES)

We've had to extend our website to communicate user credentials to a suppliers website (in the query string) using AES with a 256-bit key, however they are using a static IV when decrypting the ...
16
votes
2answers
1k views

Encryption and the “security time decay” of prior encrypted data

This question is on the assumption that any data once encrypted, may (eventually) be decrypted through Brute force (compute power/time) Exploits in the cryptography used Theft of private keys ...
16
votes
6answers
2k views

How can the impact of cold boot attacks be minimized?

Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
16
votes
2answers
4k views

What's wrong with storing private keys in the cloud?

I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
16
votes
3answers
2k views

What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms?

Why can SHA-1 be considered a secure hash function? That's something I still wonder about. I understand the concepts of why modern asymmetric algorithms are deemed to be secure. They are founded on ...
16
votes
0answers
745 views

Understanding HTTPS: why use both symmetric and asymmetric key cryptography? [duplicate]

As a Web Developer I recently realised my understanding of HTTPS is poor and am currently endeavouring to better understand it. After some initial reading I'm left a bit puzzled as to why initially ...
15
votes
9answers
3k views

Hide the fact of e-mail communication

Bob has a mistress. Her name is Alice. Bob`s wife Eve knows Bob is unfaithful, but she does not know who the mistress is. Alice does not know Bob is married. Bob needs to communicate with Alice over ...
15
votes
5answers
9k views

SSL/TLS - Distinction between self-signed cert and self-signed CA, and other questions?

I have a small personal website which I wish to serve securely over HTTPS. At the moment I do not wish to use a third party CA to sign my certs. I was reading this document on generating a self-signed ...
15
votes
4answers
2k views

Future proof encryption possible in theory?

Let's say I have a message that I want to keep safe for the next 100 years. Is it theoretically possible? Let's say the message is unique (raw picture data, raw video video data, raw text data) and ...
15
votes
7answers
27k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
15
votes
8answers
21k views

Encrypting files on Google Drive

It's my understanding files kept on Google Drive are not protected. I would like to have them encrypted so that to be able to view or modify them one must enter a password. I foresee a potential ...
15
votes
5answers
2k views

Securing a laptop against attacks (article)

I came across this article when looking for ways of hardening my laptop, and this guide seemed extremely thorough. It is perhaps overly paranoid, but it will be good to have a guide I can trust should ...
15
votes
3answers
1k views

How secure is aSSL (javascript)? Does it effectively mimic SSL?

Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
15
votes
3answers
10k views

Is email encryption, as claimed by ProtonMail, possible?

Is it possible to create a Web service that encrypts all messages, such that only the writer, and the person to whom the mail is sent, can read it? In other words, is the theory behind ProtonMail ...
15
votes
2answers
1k views

Does the haystack theory work

The haystack theory is the recommendation to put repeated characters in your password in order to make it harder for brute force to reveal. Does this have any mathematical basis? Or is it snake oil?
15
votes
9answers
33k views

Techniques for Writing Encryption Algorithms (Exclusively For Personal Use)

I'd like to preface this question by stating that I fully understand the dangers of writing your own encryption algorithms, and I would never, ever, use homemade encryption to secure the data of ...
15
votes
6answers
20k views

How secure is NTFS encryption?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? (The encryption option under file|folder -> properties -> advanced -> encrypt.) If the user uses a decent password, can this ...
15
votes
2answers
3k views

Does AES-192 provide better encryption than AES-256?

this wikipedia article describing AES says: Related-key attacks can break AES-192 and AES-256 with complexities 2^176 and 2^99.5, respectively. Does this mean that AES-256 is actually a weaker ...
15
votes
4answers
1k views

Doubling up or cycling encryption algorithms

I've occasionally read the suggestion to enhance security by either doubling up on encryption algorithms (encrypt a message once with one algorithm, then encrypt the ciphertext again with a different ...
15
votes
2answers
10k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
15
votes
3answers
4k views

Is it truly possible to store passwords securely, but be able to see the password?

Every place I looked, people recommended that storing passwords via encryption is like storing passwords in plain text. But every place I've looked, everyone recommends using a password manager like ...
15
votes
3answers
3k views

What should I know before configuring Perfect Forward Secrecy?

PFS has gained attention in our audit department because of its innate ability to limit our exposure if someone steals our private key. What pitfalls or common mistakes should I be aware of before ...
15
votes
2answers
4k views

Encryption strategies for multi users access in production systems

I am pretty unknown to encryption strategies in production environments. So my concern is to find a solution how to strongly encrypt data, but make it available to multiple users with different keys. ...
15
votes
2answers
1k views

Protection of Keys/Passwords on Virtual Hardware (XEN, KVM, VMWare, etc.)

Is there any reasonable way to secure data on virtual hardware? What I mean by "virtual hardware" is the various hosted systems that one can rent from various online hosters, that run on top of XEN, ...
15
votes
2answers
3k views

Security of running openpgp.js in a browser with the private key in HTML5 localStorage

If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be ...
14
votes
3answers
9k views

Can Cryptolocker (Or Other Ransomware) Encrypt Files That Are Already Encrypted?

If you have already encrypted files, are they still vulnerable to being encrypted a second time by a program like Cryptolocker, or would this protect them?
14
votes
11answers
2k views

For users that does not use PGP, what would be the other channel to securely send them a document?

I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email. The real question is how to do that? ...
14
votes
8answers
5k views

Is Steganography a safe method to store secret data?

I want to put some parts of my secret data into specific file with Steganography method. Is this method as safe as other encryption methods like RSA or SHA?
14
votes
4answers
7k views

What are you doing when you move your mouse randomly during a truecrypt volume creation?

Is that called a 'round' every time you move your mouse when creating a new volume? I'm talking about the screen with the random numbers during the volume creation process. What is the purpose of ...
14
votes
6answers
9k views

How are ProtonMail keys distributed?

There is a service called ProtonMail. It encrypts email on the client side, stores encrypted message on their servers, and then the recipient decrypts it, also on the client side and the system ...
14
votes
4answers
8k views

Does symmetric encryption provide data integrity?

Let's say I have one server that encrypts a file with a symmetric key, e.g. AES-CBC, and sends it to clients that decrypt it. Does that provide data integrity when decrypted? Or is it possible for ...