Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

0
votes
1answer
370 views

MD5 Algorithms in web development

I am storing the passwords of my college website in our own server. I am storing the passwords using the MD5 encryptor. But the doubt I got is since the decrypter is there I can also decrypt the ...
0
votes
2answers
591 views

Difference between free ssl and non-free ssl? [duplicate]

I am making a choice between StartSSL and positiveSSL($4.99/yr). I want to know the difference between them. As I know, SSL is used to encrypted the connection between client and server so that data ...
2
votes
1answer
118 views

Layered email encryption with multiple private keys on separate media

I'd like to encrypt e-mail messages so that multiple physically separated keys are needed to decrypt them. For example, I'd like to have three private keys stored on different media, as in: key A ...
0
votes
3answers
342 views

How to store user credentials like Mint.com [duplicate]

If you have a website that need to store user's credentials for other sites, how do you store those credentials securely? An example is Mint.com where you give them your username/password for your ...
1
vote
2answers
283 views

Two-factor port-knocking via SMS (TXT)

It seems to me that a useful alternative or supplement to traditional port-knocking, fwknop, etc, for a system requiring only occasional access, would be to: Set up a one-time pad of keys, and a pre-...
1
vote
1answer
454 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
1
vote
2answers
400 views

Encryption method and other security concerns for a simple password manager [closed]

I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
-2
votes
1answer
438 views

What are the risks if a weak ciphers are accepted by a technology that uses SSL

The TLSSLed tool found that the host that I use has SSL connection that accepts 8 different TLSv1 and SSLv3 ciphers that are weak by their length (40 bits). How can an attacker exploit this fact?
0
votes
0answers
96 views

Does the ordering of encryption and hashing matter? [duplicate]

I am now learning keyed hash function, where A and B share a secret key k. I want to know if the ordering of encryption E and hashing H matters? i.e. Is there any difference between H ◦ Ek (m) and Ek ...
-1
votes
1answer
338 views

How to interpret these (en|de)cryption instructions? [closed]

I found this string on a forum HVrUyitih"fZnvWxbsQXrk6a61oxEWU0TvcagVKz1RvRTBbqpmuJ6zNWp5a5 ZO_ggA1ov6exdUTNREr"A5NthZt97Im60kBHn0sXUhwfN33ce5VvRfUItQyg yH4EeQx"pIH5I6oaaYT3"...
0
votes
2answers
505 views

Lost user password in Slackware 14.1, how to resolve encryption in /etc/shadow?

Usually I use my root account when working with my Linux server, however, I created a user account which I use far less frequently. However, I would like to use it for a task today, but I forgot the ...
1
vote
5answers
738 views

VPN Authentication over WiFi — Is it secure?

Count this question as part of my ignorance on how authentication scheme is done on your typical VPN session. But here goes: We often advise the security-conscious user that if one must use an ...
3
votes
2answers
640 views

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
2
votes
1answer
276 views

Evil maids in the server room [closed]

I am well aware of the fact that physical insecurity in principle means no security. But let´s say I own a root server with full disk encryption which is unlocked/booted via dropbear ssh. In which ...
1
vote
0answers
158 views

Is this good management of the Encryption Key

The site is to be hosted on a shared internet server, to store non-commercial data and it will be clearly labelled as not for sensitive information. I wish to offer a credible solution to the risks ...
0
votes
3answers
148 views

Does semi-sensitive information demand encryption / security? [closed]

Since it's been requested that this question be rewritten: Is SSL (or some other encryption equivalent) required in the below case? From a small local business website, is there any damage that an ...
5
votes
1answer
4k views

How do I verify exactly which cipher suite is in use for this Remote Desktop session?

You can configure Windows to use only certain cipher suites during things like Remote Desktop sessions. Cipher suites such as RC4 56 bit, RC4 128 bit, Triple DES 168 bit, etc. SSL/TLS is not in play ...
20
votes
4answers
20k views

Is “Why Should You Avoid AES In MySQL?” true?

From a 2012 Smashing Magazine article quite a bold statement is made to avoid AES in MySQL itself. Or as they put it "Why Should You Avoid AES In MySQL?". However, if you search for SQL encryption, ...
1
vote
3answers
285 views

S/MIME doesn't protect against a stolen password, right?

We're setting up S/MIME so that we can send encrypted emails. However, I have a bit of a stupid (and maybe obvious) question... If someone steals a password for either the sender or the receiver, ...
1
vote
1answer
85 views

Storing opened mail attachments unencrypted in /tmp is a normal thing?

So there is an E-mail client. I can encrypt its database with a few clicks in its menu. But it's storing the opened attachments unencrypted in /tmp/foo/bla.xls. The bla.xls has 644 UNIX permission (...
5
votes
3answers
2k views

How to Man in the Middle Internal AD Traffic

A coworker asked me why I thought encrypting internal AD Bind communication was important. I said because I follow a standard security practice, but couldn't actually articulate how an attacker would ...
3
votes
2answers
343 views

Secure storage/retrieval of data in a database

I'm doing some relatively amateur C# development for a small customer support team and working with the SalesForce API in my application. With SalesForce, login using the API requires you attach a ...
-1
votes
2answers
80 views

encrypted emails and keyservers

I read that encrypted emails are secure, cause only who has your public key can decrypt it. I also read that it's a common thing to upload your public key on a keyserver. But if my encrypted email ...
11
votes
1answer
14k views

Are there any known vulnerabilities in PPTP VPNs when configured properly?

PPTP is the only VPN protocol supported by some devices (for example, the Asus RT-AC66U WiFi router). If PPTP is configured to only use the most secure options, does its use present any security ...
0
votes
2answers
226 views

What was the Lavabit's backdoors to their customers' e-mails? [closed]

There has been some talk about the Lavabit's case. New info was published today, but not important. I'd like to know how Lavabit worked. First I thought they just did something with OpenPGP. Then I ...
6
votes
2answers
6k views

What is the difference between SSH and IPsec?

There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
1
vote
4answers
1k views

Achieving End to End encryption with TLS

The scenario is that a client browser (eg: a user trying to log in to a bank website) needs to be able to view certain sensitive information that resides in a mainframe sitting in the Internal network ...
3
votes
2answers
1k views

Using AES to encrypt user data

I know next to nothing about cryptography, and I'm basically just looking for someone to look over what I'm doing and tell me if I'm screwing up. I have the user entering in some sensitive ...
6
votes
2answers
8k views

How do I decrypt an Adobe Triple DES ECB-mode encrypted password?

So as you may have heard, the Adobe user database with 130 million records was leaked recently. I want to find out what password I used for the Adobe account I created to make sure that I'm not using ...
2
votes
1answer
957 views

How can I secure IP Multicast traffic?

I'm interested in securing IP Multicast traffic for content that will be sent globally with several low bandwidth receivers. I understand that simplified Broadcast encryption takes N public keys ...
3
votes
0answers
154 views

BSD encryption advantages [closed]

If someone who knows about the BSD project has a moment to answer this, I'm wondering a few things about the encryption used. It's more than what I'm finding in the docs and on Wiki/Google (even the ...
11
votes
6answers
2k views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
2
votes
2answers
158 views

How safe is Money Toolkit?

Money Toolkit is a smartphone app that can alert you to your balances and transactions across multiple accounts. I was reading their site and whether their practises are as secure as they claim to be....
-1
votes
3answers
13k views

How long (in letters) are encryption keys for AES? [closed]

How long is the encryption/decryption key for an assymetric algorithm, such as AES? If I use AES 128-bit, how many characters should I type in for my key? What about AES 256-bit? Edit: Here is why I ...
0
votes
4answers
239 views

Is it possible to digitally sign information with a password?

I'm creating a cloud storage service and need to have the ability to provide reliable security for clients. In my previous question, I used a different schematic and said I would post a new question. ...
4
votes
1answer
734 views

Are there any holes in this security design?

This design is for transport security between a client and a server. I'm planning on using it for a cloud storage system. I would like it to be secure against you-know-who. I'm trying to prevent the ...
1
vote
1answer
510 views

What is the best practice to save encryption and decryption method in an application?

Almost all the application regardless of their nature and purpose are using encryption to secure sensitive data to be saved to database, if the user using a method to encrypt a file (for instance an ...
0
votes
1answer
209 views

vsftp encryption algorithm

I want to configure VSFTP for ftps protocol and it has some choices to select the encryption type: tlsv1, sslv2, sslv3. I read that tls version 1 has some security issues but in the man page it says ...
3
votes
2answers
462 views

Lightweight block ciphers definition

I've read in many papers something that looks an specialisation of the block ciphers calling them with a lightweight tag, but I couldn't found a definition. If I understand correctly, those ...
-2
votes
1answer
3k views

How does DES provide confusion and diffusion? [closed]

I know that Data Encryption Standard (DES) provide strong security but I want to know how does it provides confusion and diffusion?
4
votes
3answers
2k views

symetric key encryption vs hashing

This is a fascinating document: top 100 passwords from adobe breach I have a question about one part of it: However, thanks to Adobe choosing symmetric key encryption over hashing, selecting ...
1
vote
0answers
210 views

Encrypted chat using any smartphone. Is it legal? [closed]

Here's my case. We have written app for Android smartphones which allows users to exchange secured cipher messages. For key-exchange we're using elliptic curve 112 bits, for messaging we're using DES ...
7
votes
2answers
1k views

An analysis of storing hints for passwords?

What are the security implications of asking users to provide password hints? What are best practices for storing user hints? What research has been done on using user-supplied password hints to ...
2
votes
1answer
3k views

Multi-key encryption algorithm [duplicate]

I am looking for a way to do multi-key encryption with the set number of decryption keys. The goal is to take a file, encrypt it and generate several decryption keys, in order to decrypt several (not ...
-1
votes
1answer
3k views

Is it possible to encrypt WiFi connection?

Is it possible to encrypt (encrypt traffic) WiFi connection from my laptop to my router? If anyone of you did it? How I can do this?
0
votes
2answers
72 views

Is there a way to safely exchange two different informations like a sliding door?

In real life it would be like putting two items at the opposite sides of a sliding door, you turn it and they can be exchanged safely. Not only that, if the door is made out of glass, you can pretty ...
3
votes
1answer
630 views

Symmetric encryption with different encryption and decryption keys

In the book, Applied Cryptography by Bruce Scheier, in the foundations chapter he defines symmetric encryption algorithms as algorithms where the encryption key can be calculated from the ...
4
votes
3answers
569 views

Fully encrypted social network theory

I have this idea about building a social network that stores all its data encrypted. The idea is that a member's data is stored on multiple 'base servers' (of the member's choice). Each member has 3 ...
0
votes
1answer
843 views

How do I determine S/MIME encryption used?

From what I understand it seems that S/MIME uses PKCS #7 which can handle various different types of encryption. How is the choice of encryption method made by the e-mail client and how do I know what ...
2
votes
2answers
3k views

What's the limit on the size of the data that public-key cryptos can handle?

Someone mentioned here that asymmetric encryption might not be appropriate for bulk data and gave an example of RSA with 100 bytes. Of course, I understand that it was a rough example. But it made me ...