Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

1
vote
2answers
479 views

Hash, encryption of file… key? Need help [closed]

So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an ...
1
vote
1answer
968 views

How do I securely store and retrieve a many-time use key?

I am performing some symmetric database encryption/decryption in .net. I am using a single 256 bit private key. (1) Where do I store this key when not in use? (2) How do I securely retrieve this ...
4
votes
3answers
172 views

I want to have the security of my crypto code checked, how should I go about doing so?

Specifically part of my system stores encrypted information in a database. I wrote the code that actually does the encrypting/decrypting using an existing cipher. How should I go about making sure ...
-1
votes
1answer
519 views

What encryption hash function I should use for password securing? [duplicate]

Possible Duplicate: How to securely hash passwords? What is the best encryption algorithm? MD5, SHA1, SHA2 or maybe something else? Can you explain me why?
3
votes
1answer
114 views

Is it a bad idea to let the user responsible for his own symmetric key?

I work for a company that provides a web app where we would like to give the user some sort of "digital safe". In this safe, the user can store and download whichever files he wants. The idea is that ...
2
votes
0answers
64 views

Using GPG or PGP for symmetric database encryption/decryption in c# [duplicate]

Possible Duplicate: Using GPG or PGP for symmetric database encryption/decryption in c# I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short ...
1
vote
0answers
210 views

OpenPGP CFB mode examples [closed]

Does anyone know where to get worked out examples of OpenPGP's CFB mode encryption? I know RFC 4880 explains it very precisely, but I managed to mess it up somehow. I got one example from asking on ...
23
votes
2answers
1k views

What is the attack tree to intercept traffic on Wimax?

My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
3
votes
1answer
410 views

Is there a way to store user files without being able to decrypt them?

I'd want to build a secure file storage web application. Currently ordinary password authentication is used for login. After login this password is used for encryption and decryption of user files at ...
1
vote
4answers
456 views

Are there vunerabilities with this authentication mechanism?

I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire. I was ...
2
votes
1answer
2k views

Brute-force a passphrase, generated by `pwgen 16 -s`, of a GPG CAST5 archive

A sad story: One of our hard drives failed. While it was failing, we managed to take a quick backup. As it is our standard practice, we encrypted the backup using GPG (by however method Duplicity uses ...
7
votes
2answers
5k views

How expensive is it to guess a 15 character password, and should I be worried?

I'm currently using AES encryption (at home) on GNU/Linux (one of LUKS AES-256 variants with xts) and on Windows 7 (Truecrypt) with a 15 characters password (alphanumeric lowercase only plus _). ...
1
vote
0answers
322 views

what is this hash type? [closed]

Actually I have this hash but I don't know what cryptographic hash function generated it. 4753305A7A673D7A5A442156 I know password is 12345678 I extracted this pass from PLC device Mitsubishi
0
votes
2answers
597 views

How to safely collect bank account from website?

I want to collect bank account information from my customers on my website. I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or ...
6
votes
4answers
1k views

Encrypt files on flash drive for easy decryption

I am looking to give some files to my accountant, who is not computer-savvy. I am going to put the files on a flash drive encrypted. I assume, accountant has no software other than standard Windows ...
2
votes
1answer
169 views

How are AV scanners protecting against encrypted (PGPd) malicious code?

As a user of PGP I worry about receiving a virus that was previous encrypted with my public key, which anybody can get by querying many PGP key servers. What prevents an attacker to target a PGP user ...
11
votes
3answers
8k views

What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase?

I'm looking at two comprable pieces of software which need to encrypt data on disk using a passphrase. One uses PBKDF2 to generate the encryption key from a passphrase, while the other uses two rounds ...
2
votes
1answer
62 views

Does SGC Support reduce HTTPS security?

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption. This article says SGC should never be ...
4
votes
3answers
2k views

What does it mean for a digital certificate to be “signed”?

When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
5
votes
2answers
4k views

How do I protect user data at rest?

I want to encrypt the username, email, and password fields in the database AND encrypt user files at rest. How can I do this? I am aware of software such as Gazzang and since there is not cost ...
2
votes
2answers
680 views

Using AES with a hex key/iv, what mode of operation is the “most secure”

I realize that is a loaded question, but it is not an unreasonable one. given a hex key/iv, what mode of operation is most secure from offline attacks. I defaulted to aes-128-cbc. Partly because of ...
8
votes
3answers
3k views

Encryption on mobile phone - myth?

Well, about six months ago I had pleasure to meet Harald Welte and when he talked about m-banking (banking via smartphones) he said that the most people thing it's safe while, in fact, mobile ...
8
votes
2answers
3k views

Using RSA with 3DES instead of plain 3DES. Does it make sense?

I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And ...
27
votes
1answer
7k views

iOS Encryption Details

Following on from this question Does anyone have any details/resources on the technical specifics of how apple implement encryption on their iOS 4.x series devices? The Apple marketing material here, ...
11
votes
2answers
3k views

Which cipher suites with AES cipher provide forward secrecy?

Does standard AES with RSA (reported by Opera as TLS v1.0 256 bit AES (1024 bit RSA/SHA)) provide perfect forward secrecy? Which SSL3.0 and TLS1.0 ciphers do provide forward secrecy? Which ciphers ...
2
votes
4answers
2k views

Bouncy Castle - document signed by sender and only readable by receiver?

I am building an application that requires secure data transfer. In particular, the sender has a data file that needs to be sent to the receiver. It is required that only the receiver be able to read ...
1
vote
2answers
576 views

Password entropy question

Is password entropy only mean that its long and look/or random, or there is something else, if the password 50 random numbers will it had high entropy or not
2
votes
2answers
154 views

Security of asymmetrical decrypting proxy

I'm thinking about the safest possible way to store secure data (eg. Credit Card numbers) with a requirement of sending them in clear text to third party API (so hashing doesn't come into play). I've ...
8
votes
1answer
3k views

How does adding a random serial number improve a certificates' security?

This article says: "Finding collisions is a tricky process, since it requires you to muck with the bits of the public key embedded in the certificate (see this paper for more details). Also, ...
3
votes
1answer
506 views

Is the Netscape SMIME extension still required in a certificate?

Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image) I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
1
vote
2answers
188 views

S/MIME and Dual-use certificates

My assumption is that S/MIME almost always utilizes certificates as follows: My certificate can be used to allow people to encrypt messages and send them to me. My certificate (the same ...
2
votes
2answers
6k views

How to improve performance of encrypted MySQL database on Linux backend server?

Is ezNcrypt's transparent encryption technology the only way to get a big boost in performance? Are there other good solutions out there we could be looking at for encrypting the entire database with ...
0
votes
1answer
893 views

When should one use RSACryptoServiceProvider vs AESCryptoServiceProvider

I am interested in storing certificates for various purposes on a SmartCard. Since this answer illustrates how there are confusing differences and similarities between RSA and AES When should one ...
4
votes
2answers
2k views

What is better salted hash or openssl encryption?

Im using php and I was looking to store passwords in a mysql database. I was wondering what would be safer to use a salted hash or openssl encryption? If i use a unique random generated salted hash ...
19
votes
6answers
1k views

Backing up sensitive data - pitfalls and best practices

Obviously, securely backing up sensitive data is a challenge. A remote backup is important for surviving a variety of disasters. What are some of the "gotcha's" lurking out there, and what best ...
4
votes
1answer
340 views

Has the wedge security flaw been fixed for credit cards?

According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed? Is it the same law as the one ...
2
votes
3answers
3k views

Understanding AirCrack output in Backtrack 5

First let me clarify that I was trying to crack WPA2 in my home for educational purposes. I followed some tutorials and the message I received was: key found! [ilovegod] I know that this is not ...
1
vote
1answer
184 views

What does Bluffdale mean for privacy?

I posted a question related to tracing webserver attacks over here and the responses got me google-ing. My understanding has always been that privacy is dead and that essentially there's always ...
2
votes
2answers
1k views

How to use 'key material' so that multiple people can access protected files?

I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
3
votes
2answers
499 views

Security of GPG encryption with AES and MD5 if MD5 is broken

I have a file encrypted with gpg, using AES256 and MD5. Suppose that the MD5 hash function is broken, but not the AES cipher. Does that make it easy to crack decrypt the file?
8
votes
3answers
644 views

Most widespread use of PGP after 20 years

Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP ...
5
votes
4answers
359 views

Voting System, is there a hole here?

I had this idea a few years ago and improved it today as I notice a hole or two. I believe I have the system down right but If there was a hole the first time there may be a hole this time. I believe ...
4
votes
4answers
1k views

Cloud computing: future security challenges and solutions

I am currently writing a paper on the future security challenges of Cloud Computing, and possible solutions to these problems. After many hours of reading articles on the internet (my nearby library ...
0
votes
1answer
106 views

symetric encryption and signature [closed]

asymetric key is normally used for signature for non repudiation. But what if one uses EMV CAP in TDS mode as described here http://en.wikipedia.org/wiki/Chip_Authentication_Program ? Is non ...
1
vote
2answers
567 views

What are best practices for implementing Remote Desktop within a corporation?

After the recent critical vulnerability: 'MS12-020: Vulnerabilities in Remote Desktop could allow remote code execution' I have been looking for a hardening checklist or in the scenario that I am an ...
2
votes
2answers
1k views

Is it true that encryption bit “strength”, although numerically identical, may actually be different depending on the algorithm?

I was reading recently that for AES, the encryption strength is actually the key size/length, so 128-, 192- or 256-bit. While, for SHA-2, the encryption strength is measured against the message digest ...
1
vote
1answer
136 views

Encryption of metadata files with the help of password based encryption

I have to use password-based encryption for dealing with metadata files in my application. While reading, I came across three options: bcrypt, scrypt, and PBKDF2. I read something about them, but I ...
0
votes
2answers
1k views

What risks do I have to consider when encrypting server side as opposed to client-side?

I am looking at encrypting user data however performed on the server as opposed as on the client. What risks do I have to consider and if so how do I limit such risks? The reason we are looking at ...
1
vote
2answers
789 views

How secure is using this (p3 Python) module to encrypt a file?

I've recently been looking for a good (enough) method to encrypt files, and I came across this thing. It says that it's a Simple p3 encryption "algorithm": it's just SHA used as a stream cipher ...
2
votes
1answer
590 views

How to download PHI PDF from a secure website to a secure, encrypted folder on Windows 7?

Objective: HIPAA compliance. Here is the process: Receive PDF File through secure website Open the PDF (Which involves downloading to some folder) No longer need PDF The Question: Is there any ...