Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

1
vote
1answer
262 views

Getting multiple key matches on plaintext/ciphertext pairs in double DES

I'm trying to implement a Meet-in-the-Middle attack and just to test it out I've done some hardcoding of values, which is simply this block of simple code: byte[] key1 = new byte[] { 0x20, 0x00, 0x00,...
1
vote
1answer
369 views

Is DNS secure when using DNS crypt?

Is it the same security level like a VPN DNS wise when using Open DNS crypt servers plus DNS crypt proxy? I installed both packages in Ubuntu and now unless I have the right IP entry in the network ...
1
vote
2answers
14k views

Bitlocker without TPM with both a startup USB and password?

On a Windows 8.1 Pro PC without TPM, how can I use Bitlocker with both a startup USB drive and password? I don't have the option to use both of them, is this possible via command line? Currently, ...
1
vote
1answer
46 views

Search Engine security for searches associated with the same searcher [closed]

A number of years ago AOL leaked potentially identifiable information, because all of the searches leaked were associated with the same 'user', and as such they could be put together to identify the ...
1
vote
1answer
67 views

What are the risks of file server access over wireless? [closed]

In our office, all computers connect to the network over wireless. The wireless is protected by a pass phrase and communication is AES encrypted. On the same network is a file server that is used ...
1
vote
1answer
83 views

Is there any College, State or Government ID that transmits a offline verifiably encryptable data blob?

I'm looking for any way to digitally verify a user, ideally with a photo and link PII to that user. My use case is that a user will extract and send an encrypted data blob (say from a passport) to my ...
1
vote
1answer
67 views

Using scrypt to encrypt data in a session variable

Let's say I want to store some data in the node's session, for example, like an authenticity token. Obviously I want to store it in an encrypted way if it's going in a cookie, then decrypt it on a ...
1
vote
1answer
252 views

How to keep a reasonable level of entropy in an encrypted file?

Encrypted (or random) data, by nature exhibit a high entropy value and non unencrypted data will exhibit a low entropy value. From an attacker point of view the precense of this high entropy value in ...
1
vote
1answer
244 views

How strong is the performance impact of signing when using RSA_AES_256_ECDH

To encrypt web communication, I use SSL with a RSA key with a length of 2048 bit, AES key's with a length of 256 bit and the ECDH-algorithm for the negotiation of the AES key's (or to exchange the DH-...
1
vote
1answer
75 views

Retrieve anonymous credentials

Background A registration process to acquire an anonymous, verified account goes like this: Registrant provides proof of individuality to a Registrar. Registrar verifies proof, ensures no prior ...
1
vote
1answer
504 views

Looking for advice on storing sensitive information - Rails, Postgres, https, pg_crypto, Digital Ocean

A potential contract requires the following sensitive information to be persisted in a postgres database: Bank Account type (Uk/Int) Bank Account Number Bank Sort Code Passport Number Passport ...
1
vote
1answer
335 views

Microsoft Bitlocker - Using my own encryption/decryption key

Is it possible for me to use my own encryption or decryption key and update it whenever is possible?
1
vote
2answers
278 views

Overkill or appropriate?

I have come across a web application that a company has asked me to rebuild. After all the implementation is said and done I will deploy on a private server, and the database will be on its own ...
1
vote
1answer
127 views

Hiding existing windows 7 and loading decoy windows 7 instead [closed]

I have windows 7 64bit installed on my computer (NTFS). I wish to hide this installation and create a "decoy" windows 7: When the computer boots up, it will boot to this new "decoy" win 7. If, on the ...
1
vote
3answers
141 views

Read encrypted hard-drive after extraction from running computer

If someone unplugs the hard-drive of my laptop while it's running, what contents would they be able to extract from it? I understand that on login, the image of my hard-drive is mounted, but I'm ...
1
vote
1answer
409 views

How are Cloud based HSMs used for Encryption by an application that is on premise (behind the enterprise firewall)?

Amazon CloudHSM (It is Safenet in the backend), Safenet Luna HSM SaaS version and other cloud HSM providers provide Key Management and encryption services on device in the cloud. From my research, I ...
1
vote
3answers
232 views

Potential risks when sending plain text E-Mails with encrypted attachments?

To ensure privacy in communication I encrypt and sign E-Mails using gpg4win. However, sometimes the communication does not work as expeceted (GPGTools and Outlook/gpg4win seem to be incompatible). In ...
1
vote
1answer
150 views

Problem with common factor in RSA [duplicate]

In the RSA key generation steps, what if two entities select a common factor to generate n (i.e. p*q1=n1 and p*q2=n2) resulting in gcd(n1,n2) <> 1 ? This will lead to a problem that everyone ...
1
vote
1answer
344 views

Securing an OAuth / OpenID Connect identity in a cookie for easy login

I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity service....
1
vote
1answer
85 views

The most trusted hard problem [closed]

Is there a mathematical formalism to rank the hardness of the hard problems? In particular I am referring to the sort of hard problems that are typically used in cypher system; such as factorization ...
1
vote
2answers
1k views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
1
vote
2answers
128 views

Is there a secret-sharing public-key-encryption-based service? [closed]

I need to share some sensitive information with someone else who can only communicate via E-mail. I don't love the idea of sharing this information freely over email in plain text, so I was ...
1
vote
1answer
117 views

Importance of password strength with secure element?

Greetings SE security community. Background: I have a number of items like certificates, databases, and encrypted file systems that require private keys. In order to avoid having duplicates of these ...
1
vote
2answers
174 views

pci compliance and temporary files

Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)
1
vote
2answers
185 views

This protocol is vulnerable, but why?

I know that the following authentication protocol is vulnerable, but I can't understand why. A and B share a secret key K (64 bits) R1 and R2 are two 64 bit numbers A-->B: I am A B-->A: R1 ...
1
vote
2answers
87 views

Public e-mail Encryption Certificate

I'm quite new to this, so don't be too hard on me. I'm currently using the CipherMail MTA to generate e-mail encryption certificates. I created an own CA and public and private keys for our contact ...
1
vote
1answer
218 views

Hipaa Compliant Server

I have an instance in Amazon EC2 and need to be HIPAA compliant. I have two questions, Should I need to do a block level encryption of the database storage. Should I need to encrypt sensitive data ...
1
vote
1answer
227 views

Should HMAC key be changed regularly? Should it be kept secret at all times?

I am doing an HMAC of some cipher-text, IV and encryption algorithm. Right now I am using a hard-coded key that is known to both sender and receiver. I was wondering if the key should be changed once ...
1
vote
2answers
69 views

Secure process threads

I was pondering my computer theory and this question has been bugging me for a while . Is it possible in some way to have a running process with its memory "encrypted" on an insecure system ? If ...
1
vote
2answers
108 views

What cryptographic protocol is appropriate for the case where user needs access to a binary and encrypted configuration files?

This is a very newbie IT security question... I have to quickly implement a solution for our application that works like this... We have a binary executable that is given a configuration file. I need ...
1
vote
2answers
255 views

How could police identify digital contraband and charge someone if it's encrypted with keys?

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an ...
1
vote
1answer
357 views

My WCF application uses 2 way certificate message encryption - does it still need SSL?

I have a WCF service configured to use two-way certificate authentication on the messages. The server is also locked down through a firewall to only allow traffic from a single IP:Port that the ...
1
vote
3answers
2k views

How does encryption/decryption work when one generate random key?

I am new to this and want to ask a basic question. Suppose I used my password (say "ABC123") to generate a key using the PBKDF2 algorithm (or any such algorithm). For encrypting a file I'll input my ...
1
vote
2answers
1k views

How do you protect strings in code from users decompiling them and seeing them [duplicate]

For an example say we have an application such as a client based application which connects to an API using an api key. We are saying for this purpose there is no OAuth. How would a string or in this ...
1
vote
1answer
501 views

MySQL encryption without knowing key

I am currently struggling with how to correctly implement storage of encrypted fields in a MySQL db, without knowing the encryption key. The result I am trying to achieve is to encrypt certain pieces ...
1
vote
2answers
388 views

What are the security risks associated with storing passwords on the internet?

With products such as LastPass that store encrypted passwords on remote servers, what are the associated risks that aren't applicable to locally stored and encrypted passwords? If something is ...
1
vote
2answers
800 views

Idea for hiding your mobile phones' location, and still be able to place and receive calls. Any suggestions?

The diagram below is a thought experiment that could provide a certain level of privacy to mobile (smart)phone users, beyond what they currently have. Some of it is purely theoretical, but it should ...
1
vote
2answers
341 views

Nested encryption for multiple users

I've developed a web application (developed in .NET MVC 4) which have multiple users with personal login credentials. The web application holds a lot of content uploaded by the users. My client would ...
1
vote
1answer
347 views

What is the strength of the key derivation function on Android device encryption?

What is is strength of the key derivation? Specifically, how many milliseconds or microseconds would it take a desktop computer to check a guessed password to see if it is a match? I am aware this ...
1
vote
2answers
281 views

Two-factor port-knocking via SMS (TXT)

It seems to me that a useful alternative or supplement to traditional port-knocking, fwknop, etc, for a system requiring only occasional access, would be to: Set up a one-time pad of keys, and a pre-...
1
vote
2answers
398 views

Encryption method and other security concerns for a simple password manager [closed]

I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
1
vote
3answers
282 views

S/MIME doesn't protect against a stolen password, right?

We're setting up S/MIME so that we can send encrypted emails. However, I have a bit of a stupid (and maybe obvious) question... If someone steals a password for either the sender or the receiver, ...
1
vote
1answer
2k views

ECC Brainpool Standard Curves and Curve Generation with Bouncy Castle which seed to use?

I want to implement a ECC Key Agreement with a Brainpool curve brainpoolP512r1 or brainpoolP512t1. I'm not clear about whichseed value to use (and how). In this document http://www.ecc-brainpool.org/...
1
vote
1answer
456 views

How can I implement DVD copy protection?

I want to make a DVD movie which will be playable on a standard DVD player, but I want to make it copy restricted. I know it is practically impossible, but I just want security to protect it from ...
1
vote
1answer
668 views

Is decryption using Java+JSF safer than using JavaScript?

First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see ...
1
vote
1answer
1k views

What is the difference between an HTTPS traffic setup with Stunnel and a SSL-VPN

We have a scenario where we cannot connect to our stunnel server running on port 443 on our network, which only allows access to Internet via a proxy server. On the contrary, when we tried a SSL VPN ...
1
vote
1answer
138 views

SSL Communication and Proxy

Let us say that I have a client and a server communicating using SSL. If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
1
vote
2answers
1k views

How to increase VoIP call security?

I am using VoIP for my office because I can use the same number whether I am in USA or anywhere else. I am using it on my laptop and I have to visit India in the next few days. My friends say rules ...
1
vote
1answer
2k views

Picking an encryption algorithm for auth tokens passed via AJAX

I'm looking for a low CPU intensive encryption algorithm, to pass around session authentication tokens. As an example: The user will login in to the website (via OAuth, whether by the site as ...
1
vote
3answers
533 views

RSS Feeds: restrict access

"We are a bunch of journalists and we share much of the information via e-mails. This has become tedious now. Hence we found out a way to share, by just having to share our private blog posts via RSS(...