Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

12
votes
2answers
734 views

Is it possible to have a key for encryption, that cannot be used for decryption?

For example, a server might have some encrypted logs or storage or whatnot, that would only be used for reference later. This way even if the server is hacked, everything is still OK until the hacker ...
1
vote
5answers
11k views

How to properly encrypt a communication channel between a client and a server (without SSL)?

I have a poor knowledge in the world of cryptography, I'm just starting to learn it so I'm a newbie :) As a project for getting into the field of cryptography I want to write a client\server program ...
2
votes
2answers
1k views

How effective have statistical methods been at breaking encryption?

If we look at how statistical engines run on-line translators, and how they are built, we see that they look at a new language and run a statistical model over it searching for what's probably the ...
2
votes
0answers
279 views

Server side data de-duplication + client-side encryption with private key. Possible with “convergent encryption”? [duplicate]

Possible Duplicate: Online backup : how could encryption and de-duplication be compatible? I just saw an article on Techcrunch wherein a startup company was describing their new cloud ...
7
votes
3answers
863 views

It is possible that brute force attempts are successful before the worst case, correct?

When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case? What happens if the brute force method is successul in ...
33
votes
6answers
34k views

Asymmetric vs Symmetric Encryption

I am currently taking a principles of information security class. While talking about different encryption methods a large number of my classmates seem to believe that Asymmetric Encryption is better ...
4
votes
2answers
671 views

Protecting data on a laptop with linux

I'd like to keep some private data (photos, notes, ...) and my browsing data hidden. The rest is not so important. Most of the time I just put the laptop to sleep and don't shut it down often, making ...
2
votes
2answers
970 views

C# Encrypting string in DES 3 CBC mode

Is it normal that when I use Double DES secret key to encrypt a string in DES3 CBC mode then I always get the same cipher text? For testing I'm using IVC=0.
49
votes
8answers
5k views

Online backup : how could encryption and de-duplication be compatible?

A "soon to enter beta" online backup service, Bitcasa, claims to have both de-duplication (you don't backup something already in the cloud) and client side encryption. ...
5
votes
3answers
2k views

What is the difference between encrypted data and data sent through an encrypted tunnel

I am looking at different VPN protocols. [1] L2TP does not provide encryption so require IPSec to encrypt the data [2] IPSec tunnel provide encryption to the tunnel What is the difference in terms ...
1
vote
1answer
604 views

Android application level encryption cracking

We come across Android applications which use the custom encryption. When we proxy the Android phone or emulator, the proxy captures traffic which is unreadable. Is there a known technique to read ...
5
votes
3answers
1k views

Is it safe to use different derived keys but from the same passphrase for AES CBC encryption followed by HMAC SHA256 hashing?

I am working on a cross platform (JS/iOS/Android) list manager application that persists data through a REST API and I want to ensure that any textual data is properly encrypted on the client side so ...
5
votes
3answers
1k views

US export control on open source libraries

I want to ask, is the US export control applicable only to US citizens? E.g. I think Bouncy Castle are Australians. Do use of their library fall into export control regulations? I do not understand ...
4
votes
3answers
890 views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
8
votes
4answers
2k views

Is using HMAC to transmit a password OK?

I'm writing a small webapp and I don't want to transmit login passwords as cleartext. As I don't have SSL available I've written a one-time challenge system which sends a random string with the login ...
7
votes
3answers
497 views

How Reliably do mail systems transmit Encrypted PDFs

We have an solution design that will be sending Encrypted PDF's to our many clients, who will all be using varied email providers. We have tested the pdf's through the usual cast of internet mail ...
17
votes
2answers
2k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
22
votes
4answers
4k views

How would you store a 4 digit pin code securely in the database?

I'm familiar with password hashing, using salts, bcrypt etc. But it doesn't seem like this would work to store a 4 digit pin code since the attacker could try all 10,000 combinations quite quickly. ...
8
votes
3answers
818 views

Does the SSL encryption strength or validation level of a website really matter?

When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart. Immediately there seems to be 4 major ...
6
votes
3answers
468 views

Embedded System Communications Security

I am getting ready to start deploying an embedded sensor network that is internet connected (via the cell network) and reports private data on a regular basis back to a central server. Unfortunately, ...
7
votes
2answers
2k views

What encryption (if any) is used on electronic credit cards?

Out of curiosity: how do electronic Visa/Master Card debit/credit cards with microchips authenticate a transaction? Are they stupid storage for a key which is simply read by a reader or do they ...
1
vote
2answers
1k views

Is it possible to encrypt your Java source code and still have it readable & writable in Eclipse?

I have some Java source code on my laptop that would cause me a great deal of suffering if I were to lose possession of the laptop and the source code were to fall into someone else's hands. Is there ...
12
votes
5answers
6k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
9
votes
3answers
1k views

Is TDEA (TripleDES) invulnerable to the weak keys of DES?

The key space of DES includes some keys that are weak, which results in a ciphertext that is extra vulnerable to cryptanalysis. Is TDEA (also known as TripleDES) invulnerable to those weak keys? Or, ...
4
votes
4answers
2k views

AES ECB Mode for single block/random data encryption

I need to save random 16 byte keys to a database. To encrypt these keys I currently use AES 128 with ECB Mode (because of smaller data to store, no IV needed), but now I read a lot about ECB being ...
25
votes
4answers
16k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
3
votes
5answers
585 views

What should one do when he/she wants to protect him/her home--computer--?

As you know, deleting a file by pressing shift-delete or by using the Trash doesn't mean that the file is unrecoverable. It's data persists on your computer. In day to day life, adversaries use ...
1
vote
2answers
918 views

Which encryption algorithms will be used to replace RSA when quantum computers become common? [duplicate]

Possible Duplicate: Are the encryptions "broken" with great computing power? I just wondered which algorithms will be used once quantum computers become common. Are there already ...
250
votes
13answers
29k views

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
11
votes
1answer
903 views

Any risk in using the same salt for several hashes on a user?

Right now I'm storing a salt and password_hash on the users table (pretty standard stuff). The need arose to get a secure hash of another field for a user. Is there any risk in reusing the same salt ...
8
votes
7answers
2k views

Is there any asymmetrically encrypted file system?

Is there a file system providing a directory where everybody can write, but only the directory owner can read the files? In theory it could be done by encrypting using the public key while writing, ...
8
votes
3answers
3k views

Encryption on mobile phone - myth?

Well, about six months ago I had pleasure to meet Harald Welte and when he talked about m-banking (banking via smartphones) he said that the most people thing it's safe while, in fact, mobile ...
4
votes
1answer
2k views

How can I store downloaded video securely to device's sd card?

I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices. So for this what can I do? I think about ...
23
votes
2answers
1k views

What is the attack tree to intercept traffic on Wimax?

My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
6
votes
2answers
826 views

Do Flash memory (SSD) architecture impacts encryption techniques?

I'm working on encryption techniques on SSD's and my question is: does the erase before write architecture of SSD's has anything to do with the encryption technique? What are the problems I might ...
21
votes
2answers
5k views

Is “real salt” the same as “initialization vectors”?

In the question about real vs. fake salt, the answers describe how real salt 'perturbs the encryption algorithm.' I know roughly how initialization vectors work; is this the same concept, or something ...
8
votes
2answers
6k views

How large blocks does AES-cbc use with a 128 bit key and with a 192-bit key?

I read on wikipedia that the AES with cipher block chaining and a 128-bit key uses blocks of size 128 bit to encrypt the data. However, it also said that with a 192-bit key, there were still 128-bit ...
7
votes
3answers
1k views

Server to server encryption: Key rotation over the air. Can it improve security?

In my other question, I explored whether to write my own encryption or use an existing one. I was advised to use TLS or AES or something that is established. This question is about key rotation. It ...
14
votes
3answers
5k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
4
votes
1answer
914 views

Which encryption algo should be best for an Android application [duplicate]

Possible Duplicate: Which type of encryption algorithms android supports, and which would be better? I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
12
votes
2answers
1k views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
11
votes
1answer
1k views

Native rsync protocol security

Is the native rsync protocol (port 873) secure? Does it encrypt data or credentials? I'm planning on using rsync to store encrypted files in the cloud, I'm wondering whatever the password is ...
35
votes
3answers
2k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
13
votes
8answers
4k views

Is Steganography a safe method to store secret data?

I want to put some parts of my secret data into specific file with Steganography method. Is this method as safe as other encryption methods like RSA or SHA?
3
votes
3answers
1k views

AES for key encryption

Is AES a good choice for protecting a key stored on the computer of a user of my application? I have seen threads on hashing passwords that suggest using slow algorithms for defending against brute ...
3
votes
3answers
2k views

RSA Key Pair generation with Javascript

I need to generate a RSA key pair with Javascript. This key pair will be used for encrypting a one time blob of data (20-100kb), then discarded. This data can be reduced to a couple of hundred kb or ...
6
votes
2answers
533 views

NSA crypto Suite B - historical

I'm looking for information on what NSA suggested for use in commercial systems in past times. 90's and early 2000's. I'm mainly interested in PKI and symmetric cyphers for SSL and file/disk ...
4
votes
2answers
7k views

What password-based encryption to use with standard Java 6?

Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
15
votes
8answers
55k views

How can I determine the encryption strength of an SSL connection

If I've connected to a https url, how can I determine the cipher strength of the connection? My understanding is that after the asymmetric public-key handshake the information is encrypted using a ...
4
votes
1answer
610 views

Is this security/encryption scheme secure?

I'm rolling my own, personal threetags.com-style 'encrypted data in the cloud' webapp (I didn't like the UI, and lack of non-browser client). However, I have absolutely no experience with security ...