Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

11
votes
2answers
3k views

How does a weakness in a random number generator lead to a compromise of the entire cryptographic process?

In the news, there are several articles (here, here, and the technical point of view) which have to do with a weakness in a random number generator. The question is somewhat twofold. What symptoms do ...
2
votes
1answer
4k views

What is a stub?

Would someone please explain in depth what a stub is? I understand it as a file created by a crypter to keep a program encrypted and undetectable by anti-virus software. It is attached to the ...
7
votes
3answers
692 views

What can a web application developer do to protect user information from powerful adversaries like the NSA or China

Some well funded intelligence services with potentially untrustworthy employees intercept and store encrypted data for years, in hopes of cracking it with future technology. What can I do to make this ...
5
votes
1answer
5k views

What block ciphers and algorithms are now safe? [closed]

I work for a large non-US based international organisation. Regarding the recent leaks about the NSA breaking most encryption on the internet, we now know the US and UK governments are actively ...
0
votes
3answers
145 views

Can a computer's contents be downloaded wirelessly?

So my calculus teacher, who also teaches computer science, claims that a computer's entire filesystem can be downloaded wirelessly by anyone on the same network? As a Ruby on Rails professional, ...
0
votes
3answers
163 views

Securely transferring data from service provider to client

Suppose a client C wants to transfer form a service provider P, who collected data on behave of C using a web-application. Additionally, suppose the amount of data is larger than 100 MByte and ...
2
votes
2answers
2k views

Explain real world symmetric key encryption

I'm new to cryptography. While reading about symmetric key encryption, it was mentioned that it requires secret key exchange so that 2 parties can decrypt the ciphertext. Now, using some encryption ...
0
votes
3answers
818 views

Protecting data through an XOR operation with sufficiently long keys

Suppose two parties S and D would like to protect a communication channel. Therefore, S and D exchange two sufficiently long key sequences SB und DB of random bits over a secure channel [e.g not over ...
5
votes
2answers
2k views

How much does unknown PBKDF2 iteration count improve security?

We are crackers who get our hand on an encrypted file. We know the whole file is AES-256 encryption of the original plaintext file. We also know that PBKDF2 was run 1000 times on the original plain ...
4
votes
3answers
306 views

How to interpret encryption round diagrams

I was thinking about implementing a symmetric cipher - just for the knowledge, no intent to use in my code in production. I often find diagrams like this: (From IDEA cipher wiki page) I can get ...
5
votes
1answer
4k views

PGP RSA key size - encryption/decryption time

From what I've read, PGP only uses the pub/priv keys for encrypting/decrypting a symmetric key used for actually encrypting/decrypting data. I'd reasonably assume that longer asymmetric keys wouldn't ...
1
vote
1answer
491 views

Does DUKPT support offline mode?

I have been working on the payment side with RSA and AES encryption which I got a fairly well technical understanding of encrypting credit card details. Recently, We adopted a new chip and pin device ...
24
votes
5answers
4k views

Why is Bruce Schneier recommending symmetric crypto over public key crypto

I just read the article written by Bruce Schneier, the crypto guru. In the article, he says : Prefer symmetric cryptography over public-key cryptography. But, he doesn't shed any light as to ...
1
vote
2answers
404 views

Which public-domain encryption framework to use with .NET

Which public-domain encryption would you prefere to use with .Net? I found http://www.bouncycastle.org/csharp/, but I don't how trustworthily The Legion of the Bouncy Castle is. I want to use DH Key ...
0
votes
0answers
96 views

SSL is cracked. What is the alternative? [duplicate]

According to Der Spiegel: SSL should be cracked Exactly how much the two intelligence agencies can actually read along from the encrypted traffic in the network, is not entirely clear. But ...
5
votes
1answer
517 views

Properly implemented strong crypto systems [closed]

I have read this article about the revelation that in 2010 major encryption mechanisms including big four (hotmail, facebook, google, yahoo) and other encryption mechanisms were broken by NSA and ...
9
votes
2answers
576 views

If we can no longer trust NIST, what are viable alternatives? [closed]

Regarding the Guardian article about NSA control over encryption, there was this gem deep inside: Independent security experts have long suspected that the NSA has been introducing weaknesses into ...
25
votes
2answers
43k views

Is it possible to decrypt a satellite TV signal without using a smart card?

And if it is possible, why has it been decided to keep using a smart card for this task? I will be grateful if you can provide some practical examples on how to bypass the use of a smart card (if ...
14
votes
3answers
8k views

Best practices on securely storing access tokens

What would be the best practices for storing access tokens of another api for your users? In particular I'm developing an application with some friends that let's user log into Facebook to both ...
8
votes
3answers
908 views

How do poor-quality initialization vectors affect the security of CBC mode?

(If the consensus is that this question belongs on crypto, rather than here, please feel free to [tell me to] migrate it.) From what I have read (looking specifically at AES in Cipher Block Chaining ...
-1
votes
1answer
3k views

Is Opera spying on its users when traffic conpression is enabled?

Correct me if I misunderstand the following quoted paragraphs, but basically to compress something it must be decrypted first. This seems to be the claim of the article but I don't see this as true. ...
8
votes
2answers
672 views

Ideal way to store unhashed passwords

I'm dealing with a 3rd party vendor that clearly does not understand security - to access their API from my back-end I have to supply the end user's ID/user/password for the 3rd party service with ...
3
votes
2answers
1k views

How to store an encryption key on shared hosting?

I am designing a simple online patient management system that is running on shared hosting. According to national regulation sensitive data should be encrypted when used online, so I have encrypted ...
1
vote
1answer
466 views

Reason for using Asymmetric encryption along with SHA256

I got a document with integration with another application. They mentioned I need to hash and then encrypt data with my private key before sending it over HTTPS. By doing this, they are making sure ...
0
votes
3answers
210 views

Devising encryption schemes and protocols

I am wondering how encryption schemes are developed and why certain decisions are made. For example. I have seen a company hash a string with SHA1 and then RSA encrypt it. Why? I've also seen the ...
1
vote
1answer
442 views

How can I implement DVD copy protection?

I want to make a DVD movie which will be playable on a standard DVD player, but I want to make it copy restricted. I know it is practically impossible, but I just want security to protect it from ...
3
votes
2answers
336 views

Multiple encrypted messages known to have matching (unknown) content

A recent discussion regarding ways to keep data secure through multiple iterations of a program's execution (with repeated read/write operations) raised a question regarding known-plaintext attacks ...
-1
votes
1answer
243 views

Credential (et al) storage on Android - And general application credential storage inquiry [closed]

Please read before assuming this should go in another forum (like an android forum) - this is a Security question. Here is the scenario: Developing an health care based android application that has ...
5
votes
2answers
1k views

Are there any dangers in exposing git sha1 commit hashes?

For a non-public repository, are there any potential security concerns in sharing git commit hashes? For example, when I post a git-related stackoverflow question that involves git commits from ...
2
votes
3answers
114 views

Temp file deletion / encryption

I'm working on an .net app within aws. Basically our app pulls "generic" data from another organization for the purpose of building customized reports. The data is sent to us via ssl/tls and sent back ...
5
votes
2answers
841 views

How to implement client side encryption for CalDav & CardDav content?

I'm looking for a client-side encryption implementation that would be able to secure CardDav & CalDav data so that they couldn't be compromised even by the hosting provider. Server side: PHP or ...
3
votes
1answer
258 views

How signature validation would be checked on server side?

Sorry, It may be possible that few things are repeated in my question. I have gone through some documentation/discussion signing an API request and twitter signature documentation As per the ...
3
votes
1answer
739 views

Store hash password and encrypted data with this password in db?

I'm currently developping a django application. I need to store user data. This data must be unavailable to any other user or admin I've created a dedicated user account system (no using dj auth). ...
4
votes
1answer
988 views

What's a trustworthy S/MIME Certificate Provider that generates my private key in my browser?

I read this question on the process of generating a private S/Mime key. I looked at Comodo - which offer free e-mail certificates. I'm trying to find out whether Comodo generates the private ...
7
votes
2answers
2k views

ECC based Client Certificate import in Chrome/Mozilla in windows

I have deployed a PKI server and successfully able to generate the ECC based user or client certificates. but non of the web browser support ECC as public key. I have tried different tools and also ...
4
votes
2answers
807 views

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually). I'm trying to navigate the labyrinth of US export regualtions - something I ...
7
votes
2answers
2k views

How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?

So imagine the next situation: Alice wants to initiate OTR instant messaging session with Bob but Joe is Man In The Middle. Alice negotiates a shared secret 'X' with Joe (thinking he is Bob) using ...
0
votes
2answers
147 views

pgp decryption on public pc

When I want to decrypt mails on a public PC (café), encrypted with GPG, in e.g. gmail with the extension "Mailvelope" or equal - how would that be possible? I found tools to run from an USB stick ...
4
votes
2answers
2k views

What are the security implications of the POLi Internet Payments technique?

POLi Payments is an Australian based online payment provider which has begun trading in New Zealand. They are supported as a payment option on some large eCommerce websites in New Zealand, including ...
10
votes
7answers
8k views

Who tells that TrueCrypt is secure?

Assuming you're not running on a compromised machine and you're following common recommendations (long random passwords, etc.), who specifically (name and affiliation) asserts that TrueCrypt is ...
4
votes
2answers
8k views

How do you bruteforce decrypt data if you don't know what you are looking for?

If I wanted to brute-force decrypt data, I would try decrypting it with a key and see if the decryption returned nonsense. If the decryption returned meaningful data (ex. something that a natural ...
0
votes
1answer
765 views

How long would it take to brute force the AES encryption?

I'm trying to write a secure code that can keep my site users passwords as safe as possible. Now I'm fairly new to encryption and would like some professional opinions and suggestions. As well as a ...
0
votes
2answers
872 views

Using a Common Private Key for Digital Signatures

I have a mobile application and a server. The mobile application communicates with the server through a web services framework via SSL. The mobile application allows customers to pay for ...
0
votes
1answer
466 views

Is it safe not to encrypt ping packets?

I am running encrypted communication with ping tacked on after decryption and deserialization is complete. I.e. incoming data -> split into packets -> decrypt -> deserializer -> actual message or ...
1
vote
1answer
1k views

Is the connection between Gmail server and Apple server encrypted? [duplicate]

When I send an email from my gmail account to another mail server (apple, microsoft, yahoo...), is the connection encrypted in the path between the two servers?
5
votes
1answer
630 views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ? (I was told ...
1
vote
1answer
792 views

Is server-side cryptography with user-only access possible for email services?

I came across the Lavabit High Scalability Writeup and got curious. Do you use any particularly cool technologies or algorithms? The way we encrypt messages before storing them is relatively ...
7
votes
3answers
636 views

Is it possible to determine if some given data is not encrypted?

Let's say I'm running a BitMessage node. One possible attack against me would be to upload illegal content to my node, and once someone knows it's there, to tip off the authorities, who would then ...
3
votes
2answers
382 views

Is splitting up an AES Key a problem?

I'm wondering if it would be a problem to split up a 256 bit AES-Key into two 16-Byte blocks and distribute it, to implement some kind of a four-eyes-principle (you need two persons to decrypt a ...
5
votes
2answers
1k views

What risks are there with a Bluetooth based door lock, and are there any mitigations?

There are a few interesting Bluetooth door locks on the market that use version Bluetooth 4.0 however there seems to be a few issues with this E0 Encryption flaws Risks during pairing Attacks ...