Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

1
vote
1answer
304 views

End to end cryptographic methods/solutions

I want to implement secure communication for my application. The A sends a message/data and B receives it. The message should be encrypted so the internet provider would not be able to read it even if ...
3
votes
2answers
427 views

Is it possible to automate use of passphrase-encrypted private keys?

Suppose I have a public/private keypair, which I would like to use to serve HTTPS from a webserver. The part I'm worried about is this: the private key is encrypted with a passphrase, so that if an ...
-3
votes
1answer
198 views

US Export Laws (Encryption Cloud Service) [closed]

Okay - so I have been extensively looking into US export/import laws relating to encryption software (5D992), however I have a few questions about the laws and their applicability. So, the laws ...
10
votes
4answers
615 views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
15
votes
5answers
9k views

SSL/TLS - Distinction between self-signed cert and self-signed CA, and other questions?

I have a small personal website which I wish to serve securely over HTTPS. At the moment I do not wish to use a third party CA to sign my certs. I was reading this document on generating a self-signed ...
7
votes
5answers
11k views

Encrypting All Network Traffic

For a corporate network, is there a way to possibly encrypt all network traffic on the local network? I would like to ensure that there is nothing left for chance to be packet sniffed. Not even ...
2
votes
1answer
5k views

How to encrypt a short string to a short ciphertext using an asymmetric encryption?

I am using RSA to encrypt some text, so my system has already generated private and public keys. These keys I would like to use to encrypt/decrypt a short text (16 chars). The main condition is: ...
1
vote
1answer
1k views

Using Apple NSKeyedArchiver class without encryption to save score data locally

first of all I'm sorry for my bad English! I have a question about the security of NSKeyedArchiver, a subclass of NSCoder of Apple Foundation.framework ...
8
votes
3answers
1k views

Is it possible to prove which public key was used to encrypt a message?

Pretty much the title: If Alice sends a message to Bob that she encrypts with Bob's public key, is it possible for Eve to prove that the ciphertext was encrypted with Bob's public key, that the ...
3
votes
4answers
876 views

Would a predefined shared secret key be good here

I'm a software developer working with hardware devices that are deployed on the field. Every now and then, I would need to update the hardware's firmware (upgrades, patches, etc) I'm thinking of now, ...
5
votes
2answers
141 views

Serving data from an encrypted database over an encrypted connection

There is encrypted data in the database (asymmetric FYI). It is to be viewed as decrypted on the website. The data can be sent to the client as encrypted to be decrypted on the client's computer, or ...
4
votes
1answer
935 views

BitLocker with Windows DPAPI Encryption Key Management

Disclaimer: I realize that I posted this question on ServerFault, but I have not received any response there. I am hoping that this forum might be a more appropriate place to post this for a ...
3
votes
1answer
209 views

Certificate Hostname Mismatches - Why do they matter?

So, I am implementing some X509 certificates in a backend service where we have our own self-signing process to allow different nodes (out of our control) to receive our blessing (as a CA of sorts). ...
-1
votes
1answer
797 views

Encrypton method that would encrypt alphanumeric data to alphanumeric data [closed]

I need efficient way(possibly as strong as AES or AES itself) to enrypt (only) aplhanumeric data and get out only alphanumeric data, using some known library (i don't want and intend to implement AES ...
-3
votes
1answer
340 views

Development of asymmetric encryption algorithm? [closed]

I am planning to develop (make some minor changes) to asymmetric encryption (i.e. RSA). Any suggestions please?
-5
votes
1answer
381 views

Can I develop an SSH client for iPad in Sweden and sell it in Apple App Store? [closed]

I wonder, if I am allowed to develop an SSH client for distribution through Apple App Store without breaking any export regulations? I don't really know much about the encryption algorithm. Below is a ...
3
votes
3answers
2k views

SSL vs Encryption

I am working on creating an android mobile application which needs to connect to a server from time to time. The application makes use of sensitive data which I would not like to get into the wrong ...
9
votes
1answer
2k views

HKDF and key stretching

I thought that all key derivation functions would do a key stretching phase, by iterating some kind of process. But I can't see that process in HKDF. HKDF doesn't do key strengthening? If I have a ...
3
votes
3answers
764 views

Encrypting Backups on Linux

I'm working on an automated backup solution to protect my files on my Linux servers. However, I'm not sure about how to securely encrypt the resulting archives. I am using 64bit linux, and I am ...
6
votes
2answers
231 views

Should I test my SSL certificate for “RSA Shared Primes” before using it?

There are several papers from 2012 that say it's possible to factor several moduli by factoring shared primes. The link above includes python sourcecode to verify and test for this fact. Given this ...
15
votes
2answers
3k views

Security of running openpgp.js in a browser with the private key in HTML5 localStorage

If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be ...
3
votes
1answer
447 views

Why should I pay for an email S/MIME certificate?

There are quite a few SSL certificate companies out there that offer free email S/MIME certificates. There are also paid versions as well. I need about 6 email certificates for some company email ...
18
votes
3answers
959 views

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
2
votes
1answer
253 views

AES + CBC to encrypt individual local files, fixed IV?

I am using AES and CBC to encrypt a local files separately. I don't plan to transmit them over any network. What are the risks of using a fixed IV for my encrypting application? The only problem I ...
6
votes
2answers
15k views

Decrypt cipher texts encypted with the same one time pad key

I have two pieces of ciphertext encrypted with a stream cipher using the same key. How do I recover the plaintext of both ciphertext messages without knowing the key used?
2
votes
0answers
64 views

What flexibility does a “Third party gamma” offer to U-Prove deployment?

The U-Prove SDK has the following comment: (link) // 1: CA-RA split (a party trusted by the issuer provides the gamma value) Given that the Gamma value (if provided) overrides the Attributes value, ...
33
votes
1answer
7k views

Why does AES encryption take more time than decryption?

While I was studying the time consumed by some methods I found that encryption take more time than decryption. Is this right? I am using AES (the same steps will be taken during the enc and dec)
5
votes
2answers
1k views

Is XML encryption actually broken?

I recently stumbled on this post: XML Encryption Broken, Need To Fix W3C Standard I was expecting to find lots of information online about it, but there isn't actually all that much detail. Since I'm ...
1
vote
5answers
2k views

Encrypt-function inside PHP code that you have to publish

If you write a PHP application, where you have to deliver the compiled code to the customer, how could you include a functionality to send encrypted data from that application to others, and include ...
4
votes
3answers
7k views

How secure is ionCube compiled code?

I use ionCube to keep the code I write concealed for my customers. If I would store a password inside the code and compile (not encrypt) it with ionCube encoder, would it be possible for a potential ...
1
vote
0answers
94 views

Is this any recognizable encoding or cipher? [closed]

I've been watching the Marble Hornets videos on YouTube (basically, an independent film series about a group of kids chased by the "Slender Man"), and in this video I saw something interesting. ...
1
vote
2answers
289 views

IPTable Security between two servers

Is using IPTables to only allow traffic between two servers considered an acceptable practice? For example TCP traffic on a defined port. I realize this is referred to as an ACL but how secure is ...
3
votes
2answers
849 views

How safe is a PGP private key that has “escaped”, but without its password?

Assuming your PGP private key is protected with a password, and it "escapes", but the password does not, how worried should you be? Obviously in the real world, you would immediately revoke the key ...
0
votes
1answer
83 views

Performance issues while applying encryption at host or guest level?

One of the security expert here suggested me to apply encryption at guest(virtual machine) level rather than applying at host level with good reason. Before applying that I want to know what can be ...
0
votes
1answer
194 views

Which one is best, host or guest encryption?

Can anyone please tell me which option is better, I mean whether I should encrypt my data at virtual machine level or guest level in cloud? I tried to investigate it but did not find best solution so ...
3
votes
2answers
748 views

Store private key on server, then use k1 to log in, k2 to verify HMAC and k3 to decrypt private key

I'm working on a proof-of-concept program to encrypt email with less difficulty for end-users with a process like: To create an account: Generate a random salt and IV, and get a password from the ...
17
votes
1answer
3k views

Why can't I use the same key for encryption and MAC?

I wrote a simple file encryption program as an example of how to do encryption correctly, but after reading a questions about encryption + MAC, I think I made a mistake by using the same key for both. ...
3
votes
2answers
115 views

How to ensure two messages are from the same party

I need to verify that two messages, that came over distinct channels, come from the same origin: without knowing anything about the origin beforehand the channels are one-way, only one message may ...
22
votes
2answers
6k views

How does non-ephemeral Diffie-Hellman key exchange become compromised in SSL when the RSA private key is leaked?

From my understanding, one of the major reasons we recommend Diffie-Hellman Ephemeral (e.g. DHE or ECDHE) over non-ephemeral DH, for SSL / TLS, is that compromise of the RSA private key (i.e. private ...
4
votes
1answer
3k views

Credit card data security - hashing, truncation and encryption

A question with a similar title has been asked before, but it doesn't answer my specific question here. PCI DSS permits storage of truncated and encrypted data, or hashed and encrypted data. It ...
2
votes
1answer
600 views

How to manage passwords in a multi-tenant surrounding?

I am building a multi-tenant application in a shared database model. I would like to encrypt sensitive data so that only a particular tenant could have access to his data. What is the best mode to ...
1
vote
1answer
2k views

Man-in-the-middle attack over an encrypted channel

I learned recently about man-in-the-middle attacks and came up with this question. Let's say we have two computers who try to communicate over the network. Each computer has an encryptor and a ...
24
votes
9answers
9k views

Is encryption in HTTPS done by the browser or by the system?

This may be a common sense question, but I am not able to find any documentation on this after searching on google for a long time When browser makes a HTTPs request, does it encrypt the data then ...
7
votes
1answer
1k views

Working out how to decrypt encrypted string when knowing the plain text

I have access to a system which I have been asked to create a data export routine for. However, the address details are encrypted and the original sourcecode/password are lost. However, I am able to ...
8
votes
1answer
2k views

Build a secure channel without SSL/TLS

I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service). 1. ...
7
votes
3answers
884 views

How to fuzz proprietary protocol over SSL?

I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
7
votes
3answers
3k views

RSA key length vs. Shor's algorithm

I have just read a passage in Zeilinger's book about quantum world. My question is: Suppose there exist quantum computers. Given that a quantum computer can use Shor's algorithm, what key length ...
13
votes
4answers
6k views

Why does PGP use symmetric encryption and RSA?

Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
-2
votes
2answers
2k views

Can the U.S. goverment crack encryption? [closed]

Does USA government have the sufficient processing power to crack keys in matter of seconds? Let say 2048-bit RSA, for example. Since the RSA algorithm was developed by USA government (NSA?), I ...
2
votes
1answer
2k views

Are very short messages secure using Public Key Encryption? [duplicate]

Say Alice publishes her public key and then disappears from public view. Bob then needs to send a message to her that's either "OK" or ":(" so he takes her public key, encrypts his message and then ...