Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

2
votes
1answer
4k views

How can I decrypt traffic on a WEP encrypted network?

Let's say that I am connected to a WEP Access Point and I want to sniff all wireless traffic inside that network. How can I decrypt the traffic even though I don't have the cryptographic key? I found ...
3
votes
4answers
985 views

Can we prevent a man-in-the-middle attack with symmetric-key cryptography?

Suppose that Alice signs the message M = "I love security" and then encrypts it with Bob's public key before sending it to Bob. As well known, Bob can decrypt this to obtain the signed message and ...
4
votes
3answers
404 views

Why don't more services offer encryption for email notifications?

I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not ...
6
votes
4answers
370 views

Voting System, is there a hole here?

I had this idea a few years ago and improved it today as I notice a hole or two. I believe I have the system down right but If there was a hole the first time there may be a hole this time. I believe ...
5
votes
2answers
4k views

How to make an iPhone app HIPAA compliant?

How do we make a iPhone app HIPAA compliant. Our website is HIPAA compliant since we use encryption at rest, we use SSL, and other security provisions. Will using a SSL connection give us the ...
2
votes
4answers
323 views

Is e-mail sent from a Gmail address to another Gmail address encrypted?

Gmail provides an SSL connection and also encrypts the entire session by default. But if you send a mail, once it leaves gmails servers, it can be read at any point on the internet. But what about ...
2
votes
2answers
1k views

How secure is static key encryption?

I was looking at using the encrypt option in an application but I've read some comments saying it is not so secure because it uses static keys. How easy is it to break static key encryption? Does it ...
0
votes
2answers
2k views

What risks do I have to consider when encrypting server side as opposed to client-side?

I am looking at encrypting user data however performed on the server as opposed as on the client. What risks do I have to consider and if so how do I limit such risks? The reason we are looking at ...
7
votes
3answers
7k views

When is it appropriate to SSL Encrypt Database connections?

Let's say I have a web server I setup, and then a database server. However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right? The only time to use ...
4
votes
2answers
5k views

Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?

If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data? If the latter, then if someone had access ...
3
votes
2answers
726 views

Can key files be brute-forced like passwords?

Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
21
votes
4answers
18k views

Multi-boot with full hard drive encryption and pre-boot authentication

How would I set up a multiboot system which supports full hard drive encryption and pre-boot authentication. I have a system with Ubuntu, Windows 7, Windows XP, and I would like to install Red Hat. ...
1
vote
3answers
250 views

will all instrusion dectection will become host-based? [closed]

Will all intrusion detection become host-based once all network packets have been encrypted?
5
votes
3answers
1k views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
4
votes
2answers
1k views

Do you require a special type of certificate for using Diffie Hellman as the key exchange protocol in SSL?

In Diffie Hellman key exchange technique both the parties aggree on a common parameter g then they generate their private parameters a and b . Then they exchange g^a and g^b. now they can calculate ...
4
votes
1answer
1k views

Encrypt Medicare card numer in C# in ASP.NET

I am giving a free consultation for a non profit organisation that wants a simple system to manage multiple groups with a schedule component, etc. and also manage the medical informations of the kids. ...
2
votes
1answer
3k views

encryption key rotation

I am creating an web application which processes user information. As a part of application we are storing this input user information and generated output on server. Since this input and output is ...
41
votes
5answers
79k views

Why most people use 256 bit encryption instead of 128 bit?

Isn't 128 bit security enough for most practical applications?
7
votes
3answers
13k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
3
votes
1answer
915 views

Is SSL session based only? Is there a (formal) definition of an SSL connection?

In various docs on SSL there is a mention of connection. But from the context I am not sure if this means the underlying TCP connection or the SSL connection. I am thinking that there is no SSL ...
2
votes
3answers
3k views

Why different key exhange techniques for ssl key exchange?

During ssl key exchange, I have read that sending the symmetric key to the server encrypted with the server's public key is an old technique. Now for key echange Diffie hellman and other techniques ...
1
vote
1answer
383 views

What are the requirements for a random number generator to a be safe to use in cryptography?

When I look at most RNG's (random number generators), I see a disclaimer that looks similar to this: Caution: Mersenne Twister is basically for Monte-Carlo simulations - it is not ...
2
votes
1answer
4k views

Convert RSA public key to the right format

I need to send a public key to my bank. I'm using CoreFTP which allows the generation of keys using RSA. It says that it generates "OpenSSH compatible certificates [sic]" when you press the generate ...
12
votes
4answers
1k views

Encrypting IP addresses in a MySQL database

I'd like to encrypt IP addresses in my MySQL database, with the following constraints: Does not need to be resistant to attackers that can execute queries. Must be resistant to attackers that have ...
0
votes
1answer
2k views

Deep packet inspection of VOIP packets

Some telecommunication companies in Europe and maybe in other parts of the world now want to charge their customers for the VOIP traffic (maybe some already are doing it), e.g. the use of Viber, Skype ...
6
votes
2answers
4k views

Full disk encryption and multi-factor authentication

All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
2
votes
1answer
209 views

Browsers and export regs. Is SGC still valid?

I was reading a rather "dated" book on SSL/TLS, which mentions about International Step Up certificates and Microsoft's Server Gated Certificates which were the way arround the US export rules for ...
1
vote
1answer
382 views

How to check for a key *and* store encrypted data?

I wish to create a system wherein I store encrypted data. Users can access this data if they have the key. If they give a wrong key, they don't get access at all. If they give the right key, they get ...
4
votes
2answers
4k views

Can I determine the cipher used to encrypt a file with OpenSSL?

I have two files which were encrypted using OpenSSL. I know that that first one was encrypted using bf-cbc, and I also know the password to decrypt it. The second file is likely to use the same ...
9
votes
2answers
2k views

Authenticated Encryption vs. contained and encrypted checksum/hash?

So I read through http://en.wikipedia.org/wiki/Authenticated_encryption and http://www.cryptopp.com/wiki/Authenticated_Encryption and I don't seem to be following the concept. From the simple ...
4
votes
4answers
33k views

how safe is the 256 bit encryption used in bank transactions

Most of the banks use a 128 bit or 256 bit encryption. What does this mean? Does it mean that the keys used in ssl are 128 bit long or what? If they are the ssl key lengths then 128 bit rsa keys are ...
7
votes
3answers
2k views

Does the endianness used with an encryption algorithm affect its security?

I'm implementing the AES block cipher, which reads/writes data in 16 byte blocks. The implementation I'm working with usually read data in the little endian format. But in my platform the endianness ...
1
vote
3answers
303 views

If the encryption algorithm broken or analysed, can an attacker find my password?

If the encryption algorithm broken or analysed, can the attacker know what my password was?
15
votes
5answers
8k views

SQL field level encryption, how safe is it?

I am considering encrypting my database and/or encrypting only certain columns in a few tables. Is it worth the time? I mean, how much of a burden would it be on someone if they were to get a hold of ...
8
votes
4answers
482 views

What steps should one take to provide “reasonable” levels of privacy from a government?

I'm highly uncomfortable with the recent news surrounding government snooping in the UK. If we define a typical user to mean somebody who: Browses web sites such as BBC News and Stack Overflow Uses ...
3
votes
1answer
410 views

Hybrid key management doing it wrong?

I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
7
votes
4answers
13k views

How do software keygens work?

I have seen them plenty of times, with many different types of software, but the one thing I have always wondered, is how software keygens know what key to generate. I know the basic principle of it: ...
10
votes
3answers
10k views

What is the DUKPT Key Derivation Function?

I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
0
votes
3answers
476 views

Where can we learn more about recursive encryption schemes?

I've been wondering about recursed encryption. The idea I'm trying to convey here is an encryption scheme where a message is encypted, then somehow encrypted again, and again, etc. The encryption ...
4
votes
3answers
3k views

Nested Truecrypt containers

Which is more secure: use one container encrypted with AES > Twofish > Serpent = 768bits key size make an AES container, and inside it make another Twofish container then inside it make a third ...
19
votes
5answers
1k views

Is it alright to tell everyone your encryption information?

I have an account in an online banking system and they have the FAQ with something like this: How secure is the <Online Banking System Name>? Each page you view and any information ...
4
votes
1answer
1k views

How secure is TOTP key on phones?

Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
2
votes
1answer
484 views

How can wireless router password encrypts data using WEP and WPA

How does the password that we enter (to connect to a wireless network) encrypt the data on the wireless network? Through my reading I am not sure if the password that we enter is the same as the ...
4
votes
4answers
9k views

Is diskcryptor really secure?

Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, ...
5
votes
5answers
2k views

Most Efficient way of Encrypted Chat

I'm creating a server where people can come and talk to each other. I'm mostly doing it for a fun project, here's my question. I'm using RSA for encryption/decryption, so only the clients will know ...
3
votes
2answers
1k views

What encryption schemes require two or 3 private keys to read a message?

I would like to encrypt some data so that it can only be read if two or three people use a private secret to decrypt the data. What is the best / most modern way to accomplish multi-person ...
6
votes
2answers
2k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
1
vote
1answer
767 views

How does Freenet maintain access to 'freesites' while retaining plausible deniability about content?

On Freenet you can host websites deemed 'freesites' which are publicly accessible by everyone. As I understand, Freenet can serve a variety of content, some which is illegal, which is why content is ...
3
votes
2answers
871 views

Why is using a pseudo-random key considered more practical than a one-time pad?

I am experiencing confusion regarding one-time pads. I have read that a one-time pad generates a key that has the same length as the plaintext. This is considered to be an overhead in sharing such a ...
0
votes
2answers
130 views

How to find whether a site uses SET

How could I know whether the eCommerce site I use uses SET (Secure Electronic Transaction). I know SET is a standard. But I see only an SSL connection