Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

2
votes
1answer
2k views

Are very short messages secure using Public Key Encryption? [duplicate]

Say Alice publishes her public key and then disappears from public view. Bob then needs to send a message to her that's either "OK" or ":(" so he takes her public key, encrypts his message and then ...
5
votes
4answers
585 views

A Secure Email Host Architecture

How would one go about creating a secure email architecture? I'm thinking specifically about protecting email from routine surveillance from oppressive regimes and corporations. I had a think about ...
13
votes
3answers
597 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...
2
votes
1answer
727 views

Protect an application that uses internet from packet sniffing

I developed a stand alone application such a way that, application use a remote service (using SOAP/REST) which available WWW. I am using HTTPS though out the application calls. It was perfectly ...
3
votes
1answer
121 views

Online only encryption

I understand that one can use for example PGP (or GnuPG) to encrypt emails and files. (And I understand that there are other programs out there that will do "similar things") This, though, requires ...
38
votes
5answers
3k views

Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?

I've been worried about this password manager, PasswordBox that seems to be gathering quite a bit of steam lately. They seem to have raised VC funding and are offering a free password management and ...
-1
votes
2answers
784 views

How to minimize your fingerprint, or become invisible on the web? [duplicate]

With all of these news stories about the government reading emails and snooping information from other sources, what are ways to minimize or eliminate an organization's ability to actually track and ...
-1
votes
2answers
199 views

Security and privacy in email and other communications [closed]

In the light of newly discovered events like the NSA's PRISM program, I'm really concerned about the privacy & security of my personal emails. Chances are governments already have backdoor access ...
10
votes
4answers
4k views

How likely/possible is it that the NSA have broken common encryption techniques such as SSL/TLS?

Jumping on the NSA/Prism questions bandwagon - There's been a lot more attention drawn to facilities such as Room 641A which indicate that the NSA has been, amongst other things, applying mass ...
2
votes
2answers
2k views

Login system using authenticated encryption without storing user password

I'm not a security expert, so I might be asking a silly question, but let me describe what I am thinking about. First, I know that a lot of web sites store hashed/encrypted passwords which could be ...
8
votes
2answers
458 views

Encrypting an empty database field versus leaving it empty

In a system where personal information stored in a database is encrypted, but one of the fields only contains data in a minority of cases, would it make more sense to leave the field empty, rather ...
27
votes
8answers
3k views

Share certain information only after death

After your death, you want to make sure that a special someone gets a vital piece of information (like the password to your bank account), but: You don't want anyone else to be able to get that ...
1
vote
1answer
1k views

What is the difference between an HTTPS traffic setup with Stunnel and a SSL-VPN

We have a scenario where we cannot connect to our stunnel server running on port 443 on our network, which only allows access to Internet via a proxy server. On the contrary, when we tried a SSL VPN ...
-4
votes
2answers
248 views

Problem with Encryption Protocol

I have a question about a encryption protocol, if it is good or not. Bob and Alice communicate over an insecure channel( a possible attacker can listen). An expert suggests the following protocol to ...
-1
votes
1answer
843 views

Properties for cryptographic hash functions (preimage, second preimage and collision resistant)

While studying computer security at university I have been asked this question: There are three desirable properties for cryptographic hash functions: Preimage resistant, Second preimage resistant, ...
2
votes
2answers
200 views

What are the vulnerabilities of reusing passwords for generation of keys and encrypted files?

The main reason why reusing a password for different accounts is not recommended is that if the password is compromised, all accounts are compromised. This question is about vulnerabilities other ...
9
votes
2answers
2k views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
28
votes
3answers
6k views

Why can a Tor exit node decrypt data, but not the entry node?

Me -> Node A -> Node B -> Node C -> destination The documentation on Tor always states that only the exit node C can see plain text data. How is this possible without me talking to Node C ...
0
votes
0answers
37 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
-6
votes
2answers
503 views

the Informix password crack

I get some hash like: username sowainformix salt 7307821250330563328 hashed_password HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs hash_type SHA-256 updated flags ...
-1
votes
1answer
1k views

Is AES more secure than Rijndael? [closed]

Which algorithm is generally considered to be more secure, and is AES-192/AES-256 still considered to be secure? After reading this it's lead me to belive that the Rijndael algorithm would be a more ...
2
votes
1answer
802 views

AES in CTR mode with same random IV to create same ciphertext

I am currently working on a little project. I am trying to generate an AES key with that I would like to encrypt a private RSA key. I have to do it this way. However, I do not want to save the AES ...
11
votes
3answers
1k views

Reason for writing Self-Decrypting Virus

What is the rationale behind writing a self-decrypting virus? By this I mean a virus that has it's payload encrypted, decrypts at runtime and runs it. How does this protect the virus from antivirus ...
-6
votes
2answers
9k views

Is it possible to encrypt a virtual machine using virtualbox? [closed]

Is it possible to encrypt a virtual machine using virtualbox, and not leave accessible to the users of the machine where it hosted, and not allow any file to be extracted it with some program ? The ...
7
votes
2answers
15k views

Decrypt from cipher text encrypted using RSA

I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is Public Key: ...
7
votes
2answers
360 views

Why standards organizations give so short protection times for 128 bit encryption?

According to this and this, seems even 128 bit encryption should remain secure for a much longer time than what security organizations say. I saw the standards with this: ...
5
votes
3answers
408 views

Storing config securely in a semi trusted shared hosting environment

I'm looking for a pattern to store a config file containing sensitive information in a semi trusted hosting environment. Semi trusted in this case meaning I trust them in general, but not with this ...
5
votes
1answer
547 views

Known plaintext; What cipher is being used here? [closed]

plaintext: CANDY VERY CRANBERRY ciphertext: TXOtWjYhVk 8&O$4AmSA plaintext: http ciphertext: cZf. plaintext: http ciphertext: r5Hz This is definitely somehow decodable from ...
5
votes
1answer
6k views

What is the difference between Key Escrow and a Recovery Agent?

From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later. But in the context of PKI, a Recovery Agent can also recover private keys. How ...
-1
votes
3answers
267 views

Salting in encryption (rather than hashing)

I am aware of the benefits of adding a salt to values that are hashed using a one-way function. Is adding a salt to a value that is being encrypted (using symmetric encryption) considered to be good ...
42
votes
7answers
11k views

Why isn't open WiFi encrypted?

As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
-2
votes
1answer
1k views

Cascading Encryption Algorithm using mcrypt or GnuGP

I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
27
votes
2answers
1k views

Does versioning an encrypted file make it less secure?

Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices. The kdb file in itself would be encrypted, but ...
2
votes
1answer
220 views

Making undeterminable containers inside existing file system

Suppose, I have 1 disk partition (previously filled with random data) and create some file system on it (NTFS, FAT, EXT2, etc). I am going to keep some files here (i.e. visible files). Then i create ...
19
votes
2answers
2k views

Homomorphic encryption used for e-voting?

I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused: "The homomorphic property of various cryptosystems can be used to create secure voting systems, ..." ...
7
votes
2answers
3k views

Is this Data Encryption/Storage Method Secure?

Let me first say that I know it is a bad idea to store sensitive information in a mysql database, so please don't respond by saying "DON'T DO IT" or something to that effect. I am building a website ...
12
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
19
votes
2answers
22k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
9
votes
4answers
872 views

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that ...
1
vote
1answer
1k views

Do the Owncloud clients use encryption when transferring files to and from the server?

Do the Owncloud clients use encryption when transferring files to and from the server? I understand that files are stored un-encrypted on the server, but I’m wondering if they are secured during ...
29
votes
5answers
15k views

Are phone calls on a GSM network encrypted?

When I make a call on my cellphone (on a GSM network), is it encrypted?
4
votes
1answer
342 views

Confidentiality without Encryption - A way to circumvent Internet censorship

Nowadays we see that countries like China and Iran detect and block all encrypted connections as a way to prevent their citizens from communicating over the Internet freely. Although encryption ...
6
votes
1answer
830 views

Database encryption or filesystem encryption?

Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
6
votes
1answer
915 views

How to interpret specific NIST 800-57 cryptoperiod advice?

We are uncertain how to interpret a specific piece of NIST 800-57 - to wit, how long a symmetric key cryptoperiod should be when originator usage and recipient usage begin concurrently. The short ...
0
votes
1answer
147 views

Can anyone determine what kind of encryption this is? [closed]

Here are some examples of the encryption: J01A062YLMP1 J01A06OEPMP1 J08A07GSVMP1 J08A0625YMP1 K01A06IE2MP1 K01A06GRKMP1 W08A06ZTYMP1 I know the first letter corresponds to a brand, the last 3 ...
4
votes
1answer
385 views

Security of Javascript in mobile browsers

Is Javascript on a mobile browser more secure than Javascript on other types of systems? For instance, if I have a site that includes some client-side (Javascript) encryption code, with the intention ...
2
votes
1answer
495 views

How to Verify the Identity of the Caller of a Web Service

I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself. Now, my question is, how do I ...
3
votes
1answer
125 views

Windows Phone and Hardcoding Values

Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows ...
10
votes
1answer
6k views

Is an encrypted connection to MS-SQL Server really safe?

Quick intro: Small company, VERY limited resources. I pretty much do everything including coffe. I am a programmer, not a security guy. That's why i ask you... We have an MS-SQL 2008 Database ...
1
vote
1answer
137 views

SSL Communication and Proxy

Let us say that I have a client and a server communicating using SSL. If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?