Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

4
votes
3answers
1k views

In the Diffie-Hellman key exchange, how is the shared base key 'p' known and how are A and B, protected from Eve?

I'm trying to wrap my head around Hellman, Diffie, and Merkle's key exchange design, but after reading the Wiki article about it, I can't figure out how the commonly known factor ('p', I think) comes ...
4
votes
2answers
7k views

What password-based encryption to use with standard Java 6?

Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
8
votes
5answers
424 views

Encrypting a disk that has stuff on it?

Ok, so a pretty big disk ~1-2TB (90% full, multiple partitions + 2 operating systems on it), needs to be encrypted and zeroed-out, and it's a bit too much data for backing it all up before encryption. ...
6
votes
3answers
679 views

What risks would exist in transmitting an encrypted PKCS12 via Https

I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate ...
7
votes
3answers
2k views

Does the endianness used with an encryption algorithm affect its security?

I'm implementing the AES block cipher, which reads/writes data in 16 byte blocks. The implementation I'm working with usually read data in the little endian format. But in my platform the endianness ...
4
votes
2answers
829 views

What is the purpose of using Youtube-style alphanumeric ids as URL slugs?

I asked a question on StackOverflow on how to generate the alphanumeric/base64 resource IDs that Youtube, Instragram, and others use to identify videos/pictures/etc. Discussion led to the question of ...
1
vote
2answers
199 views

Trusted device web application

I would like to build a web application which has a trusted device feature. What is required to store for recognizing the machine securely? Can I safely store an encryption key (private) on the ...
-1
votes
3answers
533 views

find password and iv of an encoded string knowing the decoded string

If I would know the clear and encoded versions of a string could I somehow find the password and.or iv that wore used to encode it? Encoding done with open_ssl aes-128-cbc.
1
vote
2answers
639 views

Can fully homomorphic encryption be practical?

Fully homomorphic encryption has been implemented by Craig Gentry using ideal lattices. Can it be applied to data stored on a private cloud setup in practice? I've seen references here and on other ...
5
votes
3answers
1k views

Is TLS flawless enough to prevent eavesdropping carried out by an ISP?

I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic. Will that prevent ISP and ...
2
votes
2answers
508 views

AES CBC over TCP - when is new IV needed

I am working on a project where two devices will be communicating with AES with CBC over TCP. We already have a secure mechanism for sharing the encryption/decryption key. I am not sure if we need to ...
12
votes
1answer
1k views

When authenticating ciphertexts, what should be HMACed?

Some have argued for using AES-256-CTR with HMAC-SHA-256 for authenticated encryption over AEAD-specific modes like EAX and GCM. However, when doing, this, what should be HMAC'd? And how? ...
2
votes
1answer
941 views

Encrypting configuration on shared IIS7 hosting that uses load balancing

When hosting a site on a cluster (or cloud configuration) we need to specify a Machine Key in the web.config file. This is needed to keep the machines in sync (often the first encounter with this is ...
3
votes
3answers
2k views

Is encrypting data with a private key dangerous?

I have been reviewing code for various internal apps that handle secure transmission of data with external systems. These follow the following process: RSA encrypt data with 3rd party public key RSA ...
0
votes
1answer
303 views

How key_derivation and key_verification functions are implemented of a 7-zip archive's encryption mechanism?

I am curious about how password recovery works for password protected files. And I want to know the exact flow of the 7-zip encryption mechanism :) !! 7-zip uses the AES-256 encryption algorithm in ...
3
votes
1answer
357 views

DPAPI offline attack by cracking windows password?

I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption ...
1
vote
3answers
553 views

Linux mcrypt security

I just installed 'mcrypt'. When I try to encrypt some file with DES using the command 'mcrypt -a des myfile', I am prompted for a passphrase with a maximum character count of 512. > mcrypt -a des ...
5
votes
1answer
249 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
5
votes
4answers
2k views

Is encrypting a salt value with a password/plaintext a viable alternative to straight up hashing?

The basic problem, as far as I can tell, is that hashing's flaw is that the password is in the hash. Asymmetric encryption's flaw is that the password is encrypted and can be reversed. The posts ...
6
votes
2answers
1k views

Does using both GPG encrypted files and encrypted filesystem make sense?

For a few years i stored my personal text files encrypted using an asymmetric key through GnuPG. Now i thought that it is a good idea to also encrypt my hard drive partition. Does it make sense to use ...
8
votes
3answers
2k views

Is it safe to store a single symmetric key encrypted with several different RSA public keys?

For the field-based encryption of a database containing sensitive information, I was thinking of the following design: Every user has a smartcard used for client certificate login. After login the ...
11
votes
5answers
3k views

Is it worth the effort to store FTP passwords encrypted?

I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
2
votes
1answer
2k views

Should WPA2-AES be presumed insecure? (What is the “Hole196” vulnerability?)

I saw it mentioned in an answer here about firesheep, but I've never heard of it -- Should WPA2 be presumed insecure?
2
votes
3answers
347 views

Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?

OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure. But basically, ...
18
votes
3answers
3k views

In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?

It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...
4
votes
2answers
527 views

Shibboleth user attribute encryption

How does Shibboleth guarantee that 3rd parties do not get access to user attributes contained in SAML 2.0 assertion exchanged between IdP and SP? Is it correct that all user attributes are encrypted ...
6
votes
2answers
4k views

Storing password in Java application

What is best secure way to store passwords in Java web application? I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
5
votes
2answers
2k views

MAC vs Encryption

I understand the difference between MAC (eg. hmac_sha256, etc.) and Symmetrical Encryption (eg. rc4, etc.), but my question is what advantage does MAC solve that using encryption doesn't? I know that ...
9
votes
3answers
10k views

What is the DUKPT Key Derivation Function?

I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
3
votes
2answers
536 views

Security concerns about my webapp

I read though OWASP very carefully, but I am not sure about some parts of my website. I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
3
votes
2answers
241 views

Unecrypted connection to server - safe?

I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL. Now I always need an heroku addon to add my SSL certificates which costs $20/month. Cloudflare ...
8
votes
4answers
1k views

Automated encryption detection

Is there any program that, given a cipher text, it would tell me what the encryption algorithm is? What if I have the plain text? Is there something that can be done in that case?
6
votes
4answers
472 views

What do you do to protect data on a Macbook in the event of theft/loss of the device?

What setup do you recommend to protect data on a MacBook in the event of theft/loss of the device? I'm specifically interested in Macs here, rather than laptops generally, and in concrete ...
20
votes
6answers
2k views

What are the good use cases for disk encryption?

I've been researching disk/file system encryption, and on the surface it seems like a good idea for a lot of things. But as I dig further, the security it offers seems more mirage like than real. ...
31
votes
3answers
69k views

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm What exactly is the difference here and why are two encryption bits ...
5
votes
1answer
311 views

SSL CipherSuite Choices

In SSL/TLS, is the CipherSuite chosen by the server or the client? Also, can the certificate in any way dictate or modify the CipherSuite?
11
votes
4answers
1k views

What kinds of SSL certificates are usable for encryption?

I know that Verizon SSL certificates cost close to $600. There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
12
votes
4answers
1k views

Encrypting IP addresses in a MySQL database

I'd like to encrypt IP addresses in my MySQL database, with the following constraints: Does not need to be resistant to attackers that can execute queries. Must be resistant to attackers that have ...
10
votes
3answers
849 views

Encryption-Laws in Iran

According to this article Iran has criminalized the usage of encryption and VPNs. According to this blog post it is still possible to use SSH tunnels in Iran. For me SSH is encryption and thus ...
5
votes
6answers
869 views

What is the use of password encryption?

Why do we encrypt passwords? Is it to protect the password from eavesdropping? to protect the password after saving it in database? both? or for some other reason?
23
votes
2answers
2k views

Digital Certificate deployment: using two certs for each user?

At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs: One for signing documents, emails, etc. that is ...
6
votes
5answers
14k views

SHA, RSA and the relation between them

SHA is the hashing mechanism. However, RSA is the encryption algorithm. So does RSA algorithm use SHA hashing mechanism to generate hashing keys which in turn is used to encrypt the message?? ...
8
votes
1answer
670 views

What role does cryptography play in anti-piracy?

As a follow-up to Cipher for Product Registration, are there secure yet usable cryptographic standards/protocols for protecting software and data used by software? I'm interested in hardware and ...
8
votes
4answers
2k views

Is using HMAC to transmit a password OK?

I'm writing a small webapp and I don't want to transmit login passwords as cleartext. As I don't have SSL available I've written a one-time challenge system which sends a random string with the login ...
2
votes
3answers
1k views

Is SSL Tamper Detectable?

I know how SSL provides security against people reading your messages - by encryting the message with a SYMMETRIC KEY, which was exchanged during SSL Handshake with the help of ASYMMETRIC KEYS. But I ...
4
votes
1answer
1k views

Encrypt Medicare card numer in C# in ASP.NET

I am giving a free consultation for a non profit organisation that wants a simple system to manage multiple groups with a schedule component, etc. and also manage the medical informations of the kids. ...
6
votes
3answers
418 views

Embedded System Communications Security

I am getting ready to start deploying an embedded sensor network that is internet connected (via the cell network) and reports private data on a regular basis back to a central server. Unfortunately, ...
15
votes
2answers
4k views

What's wrong with storing private keys in the cloud?

I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
7
votes
2answers
2k views

ssh public/private key pair

I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
5
votes
2answers
1k views

Have anyone tried to extract the encryption key from a SSD?

After reading this forum thread it does not sound like encrypted SSDs provide much protection at all - specifically encryption only occurs between the controller chipset and the NAND storage. Why is ...