Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

10
votes
5answers
2k views

Is it worth the effort to store FTP passwords encrypted?

I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
10
votes
5answers
2k views

Use RSA keypair for PGP encryption and decryption

Is there a way that I can use a RSA keypair with PGP? What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
10
votes
2answers
1k views

How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?

http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data http://rt.com/news/uk-privacy-internet-freedom-186/ 'Black boxes' will be installed by internet services providers ...
10
votes
1answer
1k views

Truecrypt compromised?

In light of recent developments in computer forensics and "password recovery" utilities, can encryption technologies such as TrueCrypt still be relied on for a high degree of protection? It would ...
10
votes
3answers
349 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...
10
votes
2answers
3k views

How secure is Intel SSD Encryption?

Are there any known flaws in the full disk encryption on Intel 520 series SSD drives? Specifically, it seems these drives generate an internal AES key automatically, even when no password is set. But ...
10
votes
2answers
2k views

GPG File size with multiple recipients?

If I encrypt a file for multiple users how does the file size change? Does the size of the output double for two users. How about 10 or 100 users?
10
votes
2answers
2k views

Which cipher suites with AES cipher provide forward secrecy?

Does standard AES with RSA (reported by Opera as TLS v1.0 256 bit AES (1024 bit RSA/SHA)) provide perfect forward secrecy? Which SSL3.0 and TLS1.0 ciphers do provide forward secrecy? Which ciphers ...
10
votes
4answers
6k views

What's the standard way to encrypt a file with a public key in Java?

I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the ...
10
votes
2answers
4k views

Are phone calls on a GSM network encrypted?

When I make a call on my cellphone (on a GSM network), is it encrypted?
10
votes
1answer
2k views

What changed between TLS and DTLS

What did the DTLS (TLS over UDP) authors have to change so that it could run without TCP? Bonus points: Do any of the protocol difference affect the way it should be used, both in terms of interface ...
10
votes
1answer
435 views

Any risk in using the same salt for several hashes on a user?

Right now I'm storing a salt and password_hash on the users table (pretty standard stuff). The need arose to get a secure hash of another field for a user. Is there any risk in reusing the same salt ...
10
votes
2answers
807 views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
10
votes
2answers
1k views

Security of running openpgp.js in a browser with the private key in HTML5 localStorage

If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be ...
10
votes
1answer
633 views

When authenticating ciphertexts, what should be HMACed?

Some have argued for using AES-256-CTR with HMAC-SHA-256 for authenticated encryption over AEAD-specific modes like EAX and GCM. However, when doing, this, what should be HMAC'd? And how? ...
10
votes
3answers
669 views

Encryption-Laws in Iran

According to this article Iran has criminalized the usage of encryption and VPNs. According to this blog post it is still possible to use SSH tunnels in Iran. For me SSH is encryption and thus ...
10
votes
1answer
739 views

TextSecure protocol

Is anyone aware of an analysis of the TextSecure protocol? https://whispersystems.org/blog/simplifying-otr-deniability/ https://github.com/WhisperSystems/TextSecure/wiki/Protocol It is a ...
9
votes
5answers
2k views

Can voice chat be spied?

I wonder if voice chat (via public services like yahoo, google talk, skype, etc) is practically secure? Is it possible for the ISP or any middle point? I do not consider hacking the computers, but ...
9
votes
6answers
2k views

Security of SHA256 and Bitcoins

The Bitcoin network use SHA256 as a core component to it's design. I'm no expert on cryptography, but it seems to me it usually is only a matter of time before security vulnerabilities are discovered ...
9
votes
8answers
10k views

Techniques for Writing Encryption Algorithms (Exclusively For Personal Use)

I'd like to preface this question by stating that I fully understand the dangers of writing your own encryption algorithms, and I would never, ever, use homemade encryption to secure the data of ...
9
votes
3answers
4k views

Storing Credit Card Numbers

I'll be making a website with a membership type of option for the website, and I'll be most likely using Authorize.Net to make the transactions, however, I need to know what kind of encryption I can ...
9
votes
4answers
1k views

Why does PGP use symmetric encryption and RSA?

Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
9
votes
3answers
3k views

Block chaining modes to avoid

Everyone knows that ECB operation mode with a block cipher should be avoided because of clear and obvious weaknesses. But little attention is given to comparison of the other modes in the context of ...
9
votes
5answers
6k views

What does “key with length of x bits” mean?

I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
9
votes
4answers
246 views

What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?

Also: Is it something that can be achieved with limited funds? I ask because I am intrigued by the obstacles that are in place.
9
votes
5answers
6k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
9
votes
3answers
1k views

How can I encrypt a file with .NET and have the same file size of the original file?

I'm using .NET and I've written an awesome routine (xD) that encrypts and decrypts a file using AES256 CBC. It works perfectly, but now they told me that the encrypted file must be of the same size of ...
9
votes
2answers
3k views

Encryption decryption time

Does the encryption / decryption time of rsa algorithm vary significantly with a change in key length? For example, is there a noticeable difference in encryption/decryption time between 512 bit and ...
9
votes
2answers
426 views

Forward secrecy for kids

In the Scouts, it is popular to use secret codes to write messages (which are simple ciphers). I want to introduce Forward secrecy to the kids so they can use it with these ciphers. So, if the ...
9
votes
7answers
3k views

Why can an encrypted private key be brute forced?

When using SSH keys to authenticate to a server for remote access, why is it possible to devise the true key and therefore the passphrase from an encrypted private key, without checking each guess of ...
9
votes
4answers
4k views

OS with encrypted RAM?

Are there any applications, JIT frameworks or operating systems that focus on encrypted virtual memory, or perhaps virtual machines that do something similar? I know there are processors (albeit old, ...
9
votes
2answers
998 views

How does the padding scheme impact the security of encryption

After digging a little deeper into cryptography I am wondering what impact the different padding schemes do have an the security of an encryption algorithm. Lets take AES-128 in CBC mode as an ...
9
votes
3answers
970 views

Is TDEA (TripleDES) invulnerable to the weak keys of DES?

The key space of DES includes some keys that are weak, which results in a ciphertext that is extra vulnerable to cryptanalysis. Is TDEA (also known as TripleDES) invulnerable to those weak keys? Or, ...
9
votes
2answers
3k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
9
votes
5answers
656 views

When brute-forcing DES, does knowing something about the plaintext help?

Data Encryption Standard (Wikipedia) I know that with brute force there are 2^56 possible keys to check (56 bits, each either a 1 or 0). But let's say I know the message itself is only made up of ...
9
votes
1answer
168 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...
9
votes
4answers
1k views

How would you analyze an image to find out if there are scripts embedded in it?

How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
9
votes
3answers
2k views

Question about dictionary attacks on GnuPG symmetric encryption

They say algorithms like AES can't practically be broken given a long enough key length (> 128 bits). If I use GnuPG to encrypt a file using AES: gpg -c --cipher-algo AES secretfile it asks me for a ...
9
votes
3answers
2k views

Suitable cipher for SMS encryption

I would like to create application for encrypting SMS messages. After long enough discussions I decided to use symmetric encryption, since handling public/private keys issue is too difficult for most ...
9
votes
3answers
634 views

AES using derived keys / IVs. Does it introduce a weakness?

I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application. Obviously in order to re-use this key, a unique ...
9
votes
3answers
495 views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
9
votes
1answer
5k views

Where is the salt on the OpenSSL AES encryption?

I'm interested in knowing how and where OpenSSL inserts the generated salt on an AES encrypted data. Why? Im encrypting data in Java classes and need to guarantee that I can use OpenSSL to decrypt ...
9
votes
2answers
709 views

Protection of Keys/Passwords on Virtual Hardware (XEN, KVM, VMWare, etc.)

Is there any reasonable way to secure data on virtual hardware? What I mean by "virtual hardware" is the various hosted systems that one can rent from various online hosters, that run on top of XEN, ...
9
votes
2answers
74 views

Do I need to password-protect an “Electronic Copy” of health information given to a patient on e-media?

I'm struggling to find good documentation regarding requirements around security and encryption of patient clinical information when delivered to a patient in electronic format. Patient portals, ...
9
votes
2answers
2k views

Data Encryption and Key Management in C#

Which route to take, what are the pros and cons, which is more secure.. Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
9
votes
1answer
428 views

Reversible, recoverable user data encryption scheme

From this earlier question, I have a general need to obfuscate a set of third-party credentials stored in a user account, which are then used in an internal Winforms software client. The scheme from ...
9
votes
1answer
303 views

Optimal variable sizes in the Secure Remote Password protocol

I am implementing the Secure Remote Password protocol: U = <username> --> <-- s = <salt from passwd file> a = random() A = g^a ...
9
votes
3answers
890 views

Best practices on securely storing access tokens

What would be the best practices for storing access tokens of another api for your users? In particular I'm developing an application with some friends that let's user log into Facebook to both ...
9
votes
2answers
500 views

Can I use hardware random number generation on my computer? Am I already using it?

A lot of computer security depends on encryption: SSL connections, TCP packet sequencing, encrypted files, etc. These depend on random number generation to ensure that attackers can't guess the ...
8
votes
3answers
4k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...