Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
8
votes
2answers
407 views
Protection of Keys/Passwords on Virtual Hardware (XEN, KVM, VMWare, etc.)
Is there any reasonable way to secure data on virtual hardware? What I mean by "virtual hardware" is the various hosted systems that one can rent from various online hosters, that run on top of XEN, ...
8
votes
2answers
1k views
GPG File size with multiple recipients?
If I encrypt a file for multiple users how does the file size change?
Does the size of the output double for two users. How about 10 or 100 users?
8
votes
1answer
284 views
Any risk in using the same salt for several hashes on a user?
Right now I'm storing a salt and password_hash on the users table (pretty standard stuff).
The need arose to get a secure hash of another field for a user. Is there any risk in reusing the same salt ...
8
votes
2answers
2k views
How is 4G LTE encrypted?
After a few quick searches for 3G security I was able to learn that this standard uses the KASUMI block cipher, of which several weaknesses have been identified (although apparently none of practical ...
8
votes
1answer
2k views
Wheres the salt on the openssl aes encryption?
Im interested in knowing how and where openssl inserts the generated salt on an AES encrypted data. Why? Im encrypting data in Java classes and need to guarantee that i can use openssl to decrypt them
...
8
votes
1answer
259 views
When authenticating ciphertexts, what should be HMACed?
Some have argued for using AES-256-CTR with HMAC-SHA-256 for authenticated encryption over AEAD-specific modes like EAX and GCM.
However, when doing, this, what should be HMAC'd? And how? ...
8
votes
3answers
141 views
Is it preferable to perform encryption using database functions or code?
Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL.
Most of the commonly used ...
8
votes
5answers
234 views
How to support secure creation of a user account over an external API via a queued job?
So this question is delving into security and encryption and the problem potentially hasn't been encountered by many. Answers may be theoretical. Let me outline the scenario...
A website frontend is ...
7
votes
8answers
4k views
Techniques for Writing Encryption Algorithms (Exclusively For Personal Use)
I'd like to preface this question by stating that I fully understand the dangers of writing your own encryption algorithms, and I would never, ever, use homemade encryption to secure the data of ...
7
votes
6answers
12k views
How secure is a Windows password protected zip file?
I need to send some sensitive information to a client. I thought I would email a password protected zip file I created using Windows XP and then call them with the password. Presuming I pick a good ...
7
votes
4answers
741 views
Copyright issues with encryption algorithms
I'm developing application for Android/Java. Application is a kind of password manager, so I'm storing encrypted passwords under the hood of master password. There are number of encryption algorithms ...
7
votes
3answers
405 views
It is possible that brute force attempts are successful before the worst case, correct?
When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case?
What happens if the brute force method is successul in ...
7
votes
3answers
462 views
Securing a laptop against attacks (article)
I came across this article when looking for ways of hardening my laptop, and this guide seemed extremely thorough. It is perhaps overly paranoid, but it will be good to have a guide I can trust should ...
7
votes
2answers
1k views
Using RSA with 3DES instead of plain 3DES. Does it make sense?
I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And ...
7
votes
4answers
961 views
Is using HMAC to transmit a password OK?
I'm writing a small webapp and I don't want to transmit login passwords as cleartext. As I don't have SSL available I've written a one-time challenge system which sends a random string with the login ...
7
votes
4answers
1k views
What Partial Homomorphic Encryption implementations exist and how do I leverage them?
It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
7
votes
3answers
337 views
Why do so many embedded devices use shared keys?
Many commercially available embedded device manufactures use the same keys for all instances of their respective devices. This situation is so rampant, a project called littleblackbox has created a ...
7
votes
3answers
328 views
How Reliably do mail systems transmit Encrypted PDFs
We have an solution design that will be sending Encrypted PDF's to our many clients, who will all be using varied email providers.
We have tested the pdf's through the usual cast of internet mail ...
7
votes
3answers
407 views
Server to server encryption: Key rotation over the air. Can it improve security?
In my other question, I explored whether to write my own encryption or use an existing one. I was advised to use TLS or AES or something that is established.
This question is about key rotation. It ...
7
votes
3answers
176 views
Securing an E-commerce site
I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site.
I'm confused as to what the critical ...
7
votes
4answers
1k views
Where does SSL encryption take place?
I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
7
votes
3answers
261 views
Secure cleaning of deleted files
So I know how to secure delete files. But at our company, we have a laptop which had many important documents, which now have been deleted, but not in a secure way.
We can't perform a full format of ...
7
votes
3answers
495 views
What security settings are likely used in Obama's Blackberry?
It's widely publicised that Obama has a blackberry, but it isn't clear to me what security settings are employed by the NSA or what private businesses can learn from his configuration?
What is known, ...
7
votes
2answers
3k views
sniffing/recording GSM 3G signals
Is it possible to sniff or record and process GSM 3G signals (from some reciever) given that there is no other signals interrupting etc (the most comfortable conditions)
Update (with some supporting ...
7
votes
2answers
2k views
Encryption decryption time
Does the encryption / decryption time of rsa algorithm vary significantly with a change in key length? For example, is there a noticeable difference in encryption/decryption time between 512 bit and ...
7
votes
3answers
1k views
Encryption on mobile phone - myth?
Well, about six months ago I had pleasure to meet Harald Welte and when he talked about m-banking (banking via smartphones) he said that the most people thing it's safe while, in fact, mobile ...
7
votes
2answers
499 views
How does the padding scheme impact the security of encryption
After digging a little deeper into cryptography I am wondering what impact the different padding schemes do have an the security of an encryption algorithm. Lets take AES-128 in CBC mode as an ...
7
votes
1answer
365 views
How to study the packets sent by a keylogger
One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it.
I have a strong doubt that it is a key-logger. ...
7
votes
4answers
287 views
What steps should one take to provide “reasonable” levels of privacy from a government?
I'm highly uncomfortable with the recent news surrounding government snooping in the UK.
If we define a typical user to mean somebody who:
Browses web sites such as BBC News and Stack Overflow
Uses ...
7
votes
2answers
2k views
Simple way to encrypt files on Linux and decrypt on Windows?
We are in need of an encryption process for backups of very valuable data. This data will be stored on a distributed filesystem, so even with permissions set right, its not out of reach that this data ...
7
votes
1answer
359 views
Crack plain RSA given p, q and e
How would one find the secret key in a simple RSA encryption when given p, q and e?
7
votes
2answers
759 views
How do I encrypt the source and destination IP address, along with various parts of an email?
If the subject makes no sense to you, that's fine, it makes no sense to me.
I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
7
votes
2answers
1k views
For LUKS: The most preferable and safest cipher?
I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
7
votes
3answers
402 views
Database Encryption Security
I am encrypting and decrypting my database data from my web applications API. If my web server is compromised, what is to keep someone from using that same method to retrieve the data?
For example, ...
7
votes
2answers
2k views
How secure is Intel SSD Encryption?
Are there any known flaws in the full disk encryption on Intel 520 series SSD drives?
Specifically, it seems these drives generate an internal AES key automatically, even when no password is set. But ...
7
votes
1answer
221 views
Protecting emails in your database
It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database.
Not just from hacking, but from disgruntled employees or engineers ...
7
votes
2answers
1k views
3DES vs DES for VPN connections
I'm trying to get Android 2.1 phones to connect to our corporate VPN, but it would appear they only support DES rather than 3DES for encryption.
Is it safe to use DES, am I going to get hacked if I ...
7
votes
3answers
291 views
AES using derived keys / IVs. Does it introduce a weakness?
I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application.
Obviously in order to re-use this key, a unique ...
7
votes
1answer
124 views
GPG-encrypted mailing list and other approaches to safe communication
What is the best way to communicate privately on a mailing-list?
Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
7
votes
2answers
159 views
Sending data form registration forms
I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical.
So how do I encrypt 'userside' and send the data to the server in encrypted form?
Can ...
7
votes
2answers
432 views
Encryption Algorithms with an error code for wrong password
I am looking for an encryption algorithm that would allow me to know if the password supplied is the correct one or not.
This question can be considered as a follow-up for Q. In particular the answer ...
7
votes
2answers
253 views
How do you Secure VOIP in a large organization
As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
7
votes
3answers
420 views
Secure PXE network OS installation
How can one make sure that when PXE is being used to boot a remote operating system, that the data being sent is encrypted (or at the very least that integrity is maintained)?
Would it be possible to ...
7
votes
2answers
1k views
Data Encryption and Key Management in C#
Which route to take, what are the pros and cons, which is more secure..
Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
7
votes
1answer
1k views
Android Device Encryption
I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
6
votes
3answers
2k views
How can i find what hashing algorithm was used?
One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
6
votes
2answers
413 views
How can I prevent people from duplicating my barcodes [duplicate]
I would like to manage my inventory using a barcode system, but I am afraid that people will be able to scan or copy my barcode and make duplicates.
I would like to offer a discount card that has a ...
6
votes
6answers
2k views
Good file encryption tools
Could you please help me find a good file encryption tool? The target OS is Linux, but tools for Windows are welcome, too. FOSS tools are preferred. The tool must be reliable both for the recovery of ...
6
votes
3answers
575 views
How secure are self decrypting HTML files for data storage?
I recently came across a JavaScript self decrypting archive. Is it secure enough to be used as a portable password storage tool? The author has even challenged it to be cracked.
6
votes
6answers
909 views
Security of SHA256 and Bitcoins
The Bitcoin network use SHA256 as a core component to it's design. I'm no expert on cryptography, but it seems to me it usually is only a matter of time before security vulnerabilities are discovered ...
