Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

5
votes
2answers
4k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
0
votes
1answer
167 views

Is this a secure method for authenticating clients?

I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy. Client sends a ...
2
votes
2answers
906 views

Does it make any difference of the order Hashing and Encrypting in terms of security?

I am implementing a password vault program with java. I have programmed a triple DES for encryption and a SHA256 for hashing. My question is would it make any difference if I first hash the raw data ...
7
votes
5answers
395 views

How to support secure creation of a user account over an external API via a queued job?

So this question is delving into security and encryption and the problem potentially hasn't been encountered by many. Answers may be theoretical. Let me outline the scenario... A website frontend is ...
1
vote
3answers
199 views

Cryptography key gathering tool [closed]

I am wondering if there exist a tools which can return the value of the one of the private key if the following are known: 1) Encryption Algorithm 2) Public key 3) Plain text 4) Cipher text Or may be ...
2
votes
3answers
375 views

Should private messages be encrypted?

I want to implement a private messaging system to my website, but I'm wondering if the content of the -supposedly private- message between Alice and Bob should be stored in plain text in the database ...
0
votes
1answer
551 views

Is it secure to use a custom written Php extension for handling + hashing (db) keys?

I'm designing the security of a new application and try to figure out what the best way is to store the keys of the mysql AES encryption in the file system. I've seen several options like store it ...
11
votes
1answer
3k views

Truecrypt compromised? (Coldboot attack)

In light of recent developments in computer forensics and "password recovery" utilities, can encryption technologies such as TrueCrypt still be relied on for a high degree of protection? It would ...
16
votes
3answers
4k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
1
vote
3answers
1k views

will google detects tor browser?

Usually while we browse Google through our i.p we will be redirected to respective countries,i normally use tor browser for anonymity,today while i browse google i got redirected to ...
135
votes
2answers
86k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
2
votes
2answers
223 views

Many-time pad on image data, how to proceed?

I have raw image data that is XOR-encrypted with a fixed-size one-time pad repeated over the length of the image. I know what the format of the image data container is so I can successfully retrieve ...
2
votes
1answer
344 views

Security on dedicated lines

Is it safe for a company not to use any encryption on customer's data when it is transferred between data centers on dedicated lines? By customer data I don't mean passowrds/credit card info. Just ...
5
votes
1answer
300 views

Security and authentication problem

We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes. First of all, lets imagine a real world scenario: Imagine that a user ...
1
vote
1answer
313 views

Dual Linux System with Whole Disk Encryption

(This is a continuation of my question on Ask Ubuntu.) My goal is I want to have a Xubuntu/Ubuntu dual boot, with a catch - I want the disk to be fully encrypted with the dm-crypt (native supplied) ...
7
votes
1answer
7k views

Will double encryption increase the security of cipher vs bruteforce?

Assume I have a function encrypt(mes,key) where mes is the message, and key is the key. The length of key is 64 bits. Last but not least: assume the only way to crack my cipher is a brute-force ...
2
votes
1answer
335 views

How do I get my Encryption Certificate back?

I was using Windows 7 Professional. I encrypted a few personal pics and videos on my hard drive. Unfortunately someone deleted the encryption certificate. Now I have installed Windows 8 and have ...
5
votes
1answer
3k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
1
vote
4answers
1k views

certificate usage for signing and encryption

I have a question for basic operating with certificates in emails and pdfs. Im familiar with public key cryptography. The scenario: In my scenario I want to send a confidential email to a person A ...
4
votes
3answers
490 views

How do I transfer the HMAC?

I have a file I'd like to encrypt with a symmetric key using AES-256 and then use an HMAC for integrity. So I don't "roll my own" scheme which I know is a big mistake, what are the standards for using ...
2
votes
1answer
297 views

Can we reverse engineer binlog with row format to make MySQL AES_ENCRYPT visible?

Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual ...
1
vote
2answers
503 views

Is it bad practice to send decryptable data?

If I'm authenticating an action, is it a bad practice to authorize the connection using a decryptable hash that does have a specific algorithm, but only the remote machine knows? Is sending ...
1
vote
3answers
744 views

Use Authentication using 2 encrypted strings

So, basically I am trying to log a user in with a cookie and do not query DB to improve performance. Here is a brief idea: Transmit everything via SSL Set a Global secret key A and secret key B ...
3
votes
2answers
664 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
2
votes
1answer
514 views

Does SQL Server CE 4 decrypt data securely?

I am going to store data in an encrypted SQL Server CE 4 database, where the database is doing the encryption. (Note that SQL CE is the embedded version, not the fully installed server.) When the ...
4
votes
2answers
314 views

Evernote hacked - precautions?

On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software. ...
4
votes
3answers
485 views

Can encryption twice with two keys in different sequences lead to the same result?

I am looking for an encryption algorithm for one of my current papers. The basic requirement is that, suppose I have two keys k1 and k2, and the E(k1,t) means encrypt t with key k1. Are there any ...
10
votes
1answer
21k views

Why so long to break 128-bit encryption?

I read that 128-bit encryption takes millions of years to break. But if I encrypt a file using say winzip that uses 128-bit encryption but the password I use is only one character long (for example ...
3
votes
1answer
1k views

Can active attacks really decrypt a particular AES-256, CBC, PKCS#7 encrypted file?

I recently found out that active attacks are a threat against AES-256, CBC mode, padded with PKCS#7 (the CBC mode in particular. I should supposedly change to EAX to guard against these attacks). ...
6
votes
2answers
546 views

How less secure is an encryption if we know something about the original data?

I have a number of files encrypted with a key derived from a password. In line with standard practice, I use a random salt and password and do many PBKDF2 iterations to obtain an encryption key and ...
2
votes
3answers
30k views

Recovering encrypted SD card after Android Factory Reset

I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card. Phone did a factory resync and now data on SD card is still encrypted. Is there a way ...
7
votes
1answer
2k views

Encrypting sensitive data in software and storing/decrypting it on a server

I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing. I'm developing software which has 2 parts - a C# program run ...
1
vote
1answer
618 views

PKCS#7 message constructed by our code, any weaknesses in the output?

We have this as the PKCS#7 encrypted message. We would like to open this up for review and analysis here, for people to poke holes. This sample is generated via test certificates and keys. The concern ...
0
votes
1answer
5k views

How does PKCS#7 padding work with AES-256, CBC mode?

I'm a bit confused with AES-256, CBC, and how it works with padding (PKCS#7). Whenever I encrypt data of multiples of 16 bytes (the block size), extra 16 bytes are always padded at the end. For ...
4
votes
6answers
2k views

How to “demonstrate” man-in-the-middle attack?

I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project). Over the years a bunch ...
5
votes
3answers
1k views

Are private keys generated by different software packages compatible?

I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
6
votes
5answers
46k views

Cracking CISCO ASA Passwords

I've got a copy of a Cisco ASA config and i want to crack the following example passwords I've got the following lines in the config ASA Version 8.4(2) ! hostname ciscoasa enable ...
3
votes
4answers
795 views

Is it safe to have the salt equal to IV?

If I'm using AES-256 CBC to encrypt, getting the 32 byte key using multiple iterations of the PBKDF2 function with a 16 byte salt, is it safe for me to let IV be equal to the salt? (Edit: The salt is ...
4
votes
2answers
4k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
1
vote
2answers
406 views

What is a better practice - RSA Encryption vs Windows authentication

I have two machines running windows OS with IIS and window OS with MS SQL. In the production web.config file I configure the IIS to use a user name and password when connecting to the DB and then I ...
0
votes
2answers
169 views

How can I encrypt something user provided without risk of the key being exposed?

So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must ...
1
vote
2answers
104 views

How can I set up signed downloads?

Scenario I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
1
vote
4answers
436 views

Strategies to store/remember very long password?

If future proof encryption is - in theory - possible it will require long password. What are some of the strategies for storing or remembering very long - in this case rarely used - password? For ...
6
votes
1answer
2k views

Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?

Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects. I need to store (or use an existing) private key on a ...
9
votes
3answers
15k views

Encrypt data within mobile app and send to web service

I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service? Basically I will ...
3
votes
3answers
184 views

Is it safe to mix authentication methods?

Is it a good idea to "combine" authentication methods? Example we can use username/password method to authenticate a user from a server. What if we used this as a first authentication step to get ...
6
votes
1answer
4k views

Android / CyanogenMod encryption vs GNU/Linux

Hi I am trying to understand how encrypting an Android based phone works compared to a GNU/Linux host which relies on LUKS dm-crypt. Here is what I understand: Encrypted LVM on GNU/Linux is an ...
1
vote
1answer
383 views

AES encrypt secret key with plaintext

We need to be able to retrieve password. Hashing is one-way, we can't do that. So we ended up using AES. We want to know if the following schema is safe or not. I am only familiar with modulo PK ...
6
votes
2answers
1k views

Is it reasonable to prevent timing attacks by using fixed processing time

I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing. Part 1 Is it a good idea to ...
12
votes
2answers
13k views

Is it possible to use S/MIME in the web client of Gmail?

I could not find any options in the web interface of Gmail. All I could find was a Firefox plugin to use S/MIME with Gmail, but it seems to be outdated.