Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

25
votes
4answers
15k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
3
votes
5answers
538 views

What should one do when he/she wants to protect him/her home--computer--?

As you know, deleting a file by pressing shift-delete or by using the Trash doesn't mean that the file is unrecoverable. It's data persists on your computer. In day to day life, adversaries use ...
1
vote
2answers
882 views

Which encryption algorithms will be used to replace RSA when quantum computers become common? [duplicate]

Possible Duplicate: Are the encryptions "broken" with great computing power? I just wondered which algorithms will be used once quantum computers become common. Are there already ...
238
votes
13answers
27k views

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
11
votes
1answer
795 views

Any risk in using the same salt for several hashes on a user?

Right now I'm storing a salt and password_hash on the users table (pretty standard stuff). The need arose to get a secure hash of another field for a user. Is there any risk in reusing the same salt ...
8
votes
7answers
2k views

Is there any asymmetrically encrypted file system?

Is there a file system providing a directory where everybody can write, but only the directory owner can read the files? In theory it could be done by encrypting using the public key while writing, ...
8
votes
3answers
3k views

Encryption on mobile phone - myth?

Well, about six months ago I had pleasure to meet Harald Welte and when he talked about m-banking (banking via smartphones) he said that the most people thing it's safe while, in fact, mobile ...
4
votes
1answer
2k views

How can I store downloaded video securely to device's sd card?

I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices. So for this what can I do? I think about ...
23
votes
2answers
1k views

What is the attack tree to intercept traffic on Wimax?

My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
6
votes
2answers
764 views

Do Flash memory (SSD) architecture impacts encryption techniques?

I'm working on encryption techniques on SSD's and my question is: does the erase before write architecture of SSD's has anything to do with the encryption technique? What are the problems I might ...
21
votes
2answers
4k views

Is “real salt” the same as “initialization vectors”?

In the question about real vs. fake salt, the answers describe how real salt 'perturbs the encryption algorithm.' I know roughly how initialization vectors work; is this the same concept, or something ...
7
votes
2answers
5k views

How large blocks does AES-cbc use with a 128 bit key and with a 192-bit key?

I read on wikipedia that the AES with cipher block chaining and a 128-bit key uses blocks of size 128 bit to encrypt the data. However, it also said that with a 192-bit key, there were still 128-bit ...
7
votes
3answers
947 views

Server to server encryption: Key rotation over the air. Can it improve security?

In my other question, I explored whether to write my own encryption or use an existing one. I was advised to use TLS or AES or something that is established. This question is about key rotation. It ...
14
votes
3answers
5k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
4
votes
1answer
897 views

Which encryption algo should be best for an Android application [duplicate]

Possible Duplicate: Which type of encryption algorithms android supports, and which would be better? I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
11
votes
2answers
1k views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
11
votes
1answer
1k views

Native rsync protocol security

Is the native rsync protocol (port 873) secure? Does it encrypt data or credentials? I'm planning on using rsync to store encrypted files in the cloud, I'm wondering whatever the password is ...
35
votes
3answers
2k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
13
votes
8answers
4k views

Is Steganography a safe method to store secret data?

I want to put some parts of my secret data into specific file with Steganography method. Is this method as safe as other encryption methods like RSA or SHA?
3
votes
3answers
1k views

AES for key encryption

Is AES a good choice for protecting a key stored on the computer of a user of my application? I have seen threads on hashing passwords that suggest using slow algorithms for defending against brute ...
3
votes
3answers
1k views

RSA Key Pair generation with Javascript

I need to generate a RSA key pair with Javascript. This key pair will be used for encrypting a one time blob of data (20-100kb), then discarded. This data can be reduced to a couple of hundred kb or ...
6
votes
2answers
501 views

NSA crypto Suite B - historical

I'm looking for information on what NSA suggested for use in commercial systems in past times. 90's and early 2000's. I'm mainly interested in PKI and symmetric cyphers for SSL and file/disk ...
4
votes
2answers
7k views

What password-based encryption to use with standard Java 6?

Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
12
votes
8answers
50k views

How can I determine the encryption strength of an SSL connection

If I've connected to a https url, how can I determine the cipher strength of the connection? My understanding is that after the asymmetric public-key handshake the information is encrypted using a ...
4
votes
1answer
583 views

Is this security/encryption scheme secure?

I'm rolling my own, personal threetags.com-style 'encrypted data in the cloud' webapp (I didn't like the UI, and lack of non-browser client). However, I have absolutely no experience with security ...
7
votes
2answers
2k views

SSL Session resumption and IDs

Some sites, as seen in the report for www.mbank.com.pl [ssllabs.com] or report for aliorbank.pl [ssllabs.com] do not support "Session resumption", either because IDs are assigned but not accepted ...
9
votes
2answers
5k views

Is 1024bit Diffie Hellman key exchange secure?

My system uses AES-256, 4096bit RSA CA key and 2048bit RSA keys for servers together with SHA-256 signing. Does using 1024bit DH key exchange lower its security? I read on one mailing list that ...
11
votes
2answers
3k views

Which cipher suites with AES cipher provide forward secrecy?

Does standard AES with RSA (reported by Opera as TLS v1.0 256 bit AES (1024 bit RSA/SHA)) provide perfect forward secrecy? Which SSL3.0 and TLS1.0 ciphers do provide forward secrecy? Which ciphers ...
13
votes
2answers
1k views

Storing sensitive information securely

I know there have been a few questions about this already, but I just wanted to know if anyone can take a look at my design plans to see if there are any gaping security holes. I am in the process of ...
2
votes
4answers
501 views

Hash/Digest of string; multiple clients and reverse lookup must be impossible

Ok so i need a technique (could be a system or just an algorithm) to generate a hash/digest of a string on a client app without me (admin of a server app) being able to determine what the original ...
23
votes
7answers
39k views

How secure is a Windows password protected zip file?

I need to send some sensitive information to a client. I thought I would email a password protected zip file I created using Windows XP and then call them with the password. Presuming I pick a good ...
6
votes
3answers
12k views

Which type of encryption algorithms android supports, and which would be better?

I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports. Regarding DES and AES (As wiki documentation) ...
1
vote
2answers
10k views

What are private key cryptography and public key cryptography, and where are they useful?

I don't understand the real world usage scenarios of these cryptography methods. Can any one please explain how they work, with examples and also their usage in the real world?
12
votes
4answers
582 views

Encrypting data by parts vs encrypting the whole data

Suppose I have a file with records, and I have two options to encrypt it: encrypt the file as a whole encrypt each record separately and store them together. Which way is generally preferable and ...
7
votes
2answers
790 views

Encryption Algorithms with an error code for wrong password

I am looking for an encryption algorithm that would allow me to know if the password supplied is the correct one or not. This question can be considered as a follow-up for Q. In particular the answer ...
7
votes
2answers
2k views

Export laws on the cloud (key size)

Do the U.S. export laws around AES-256 apply to applications hosted in the cloud?
6
votes
2answers
753 views

How do I use Skein's Stream Cipher?

I understand the NIST hash function competition candidate Skein comes with a built-in block cipher, Threefish, that is turned into a stream cipher by using Unique Block Iteration chaining (is that ...
11
votes
5answers
649 views

Security of using passwords or even passphrases to encrypt files

Is it ever appropriate to use real-world passwords to encrypt files to be sent via unsecure means. By real world, I mean a password that is memorable and memorisable by a mere person? I am implying ...
4
votes
4answers
336 views

Data categorization: Critical or not

I need to provide two means for securing data within my application. First is using the Operating System sandboxing model (I am talking about Mobile Phones OS) and the second using the OpenSSL AES ...
8
votes
3answers
2k views

Is this prime number large enough / too large for a Diffie-Hellman for AES-256?

I'm using a Diffie-Hellman key exchange to encrypt data using AES-256. The prime number I'm using is the one from the 8192bit group specified in RFC 3526 (page 6). Page 7 suggests that, with a 620 ...
15
votes
6answers
2k views

How can the impact of cold boot attacks be minimized?

Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
2
votes
2answers
218 views

Which private-key encryption should I use for server to server communication?

I am tempted to write my own which covers: Checksum to ensure data is not tampered with. Long and multiple rotating keys so that it is (practically) impossible to decrypt. Will use /dev/random for ...
11
votes
2answers
6k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
1
vote
1answer
121 views

Challenge Response across several hops

This is a follow-up question to "When should I use Message layer encryption vs transport layer encryption". I need to send a certificate from the mobile phone to the server. Regardless of all the ...
1
vote
1answer
658 views

Nonce construction for CTR mode (Mcrypt)

Edit: I'll put up this more clearly. By the most simplest form, I'm asking that if I AES encrypt in CTR more with Mcrypt (using PHP), can I create the "IV" by just simply reading 16 bytes from ...
15
votes
3answers
2k views

What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms?

Why can SHA-1 be considered a secure hash function? That's something I still wonder about. I understand the concepts of why modern asymmetric algorithms are deemed to be secure. They are founded on ...
251
votes
7answers
199k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
1
vote
2answers
204 views

TCrypto - Comments about design decisions I made?

I have pushed some code to GitHub to demonstrate the usage of symmetric key encryption in PHP. It is a small key-value storage library and it (optionally) offers ability to encrypt the stored ...
5
votes
1answer
442 views

Asynchonous Linear Feedback Shift Register : test vectors

Well I've been working on coding LFSR structures for my research projects. Being able to find sources on the subject, I've been able to test a single LFSR with different initialisation and TAP ...
5
votes
1answer
1k views

Is the DES “mangler” function invertible?

The DES symmetric cipher is based on a Feistel network operating repeated on 32-bit halves of the 64-bit block. The usage of Feistel means that the "mangler" function used does not need to be ...