Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

48
votes
9answers
12k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
1
vote
1answer
180 views

Crack 512-bit RSA encrypted messages without a private key?

I was wondering if it would be possible to crack a message that was encrypted with 512-bit PCKS1 encryption with the public key. I am doing a project for our science fair type thing at school and have ...
3
votes
1answer
26 views

RC4 encrypt many messages with same password

I would like to ask if it's insecure to encrypt many different messages sent over the Internet encrypted by RC4 with the same password. If it is insecure, then if I encrypt the first message with the ...
1
vote
2answers
115 views

Encrypting unique fields in a Database

I'm still a beginner to cryptography and want to know what the best practice is for solving the following problem: I'm creating an application with the requirement that a user's email address must be ...
2
votes
1answer
473 views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
3
votes
2answers
92 views

Encrypt DB Fields preserving search functionality

I would like to protect sensitive information stored on a Postgresql database, but I would not like to encrypt it all. The idea is to encrypt only those fields which hold sensitive information. I was ...
0
votes
0answers
34 views

How many bits of security is in a n-bit modulus?

In a paper that I read, "A riddle wrapped in an enigma" by N. Koblitz and A.J. Menezes, there are several statements like this one(at page 4, section 2.3): ..., the NSA updated to Suite B [40] so ...
4
votes
1answer
75 views

Can a FIDO U2F device be used for symmetric encryption?

As I understand, U2F is mainly used for authentication. It uses challenge-response scheme to check if the device used for logging in is the same device which was used during registration based on ...
21
votes
3answers
5k views

Why does an encrypted message sometimes end in “==”

As a programming exercise I need to decrypt a message. The only clues that I have is that it seems are: The encoded message contains only Base64 Characters a n letter sequence (n in 1,4,7,10) times ...
0
votes
2answers
93 views

Internet browsing encryption

I have a shared wifi point with a person who might be interested in knowing what I am browsing, writing and downloading in the internet. This person is the master of this wifi network, only he has an ...
1
vote
0answers
36 views

Is there a point in cascade encryption? [duplicate]

I was reading the other day about some programs (ex: DiskCryptor), and with my limited knowledge of cryptography.. I started wondering about cascading encryptions (ex: AES-Twofish-Blowfish). Assuming ...
4
votes
0answers
21 views

How to securely send your user and hashed password to a server? [duplicate]

I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
1
vote
2answers
109 views

Snoopers Charter VPN advice needed

With the Snoopers Charter coming soon in the UK, I intend to start using a VPN service. Disregarding issues of the VPN logging user details or leaving my IP address discoverable, what other potential ...
3
votes
1answer
153 views

How Does Telegram's Identity Verification Work?

Note: please refrain from commenting on Telegram's design of OTHER parts, as it will distract from the stem of the question. Background: Signal (Previously, TextSecure) is the de facto standard of ...
1
vote
2answers
66 views

How to forge custom IEEE 802.11 packets?

I read about 802.11 networks and found out that all the frames from client are directed to the AP. How can I forge IEEE 802.11 packets so that I can send them directly to the clients using the group ...
1
vote
3answers
239 views

Using a stolen certificate on a server

Yesterday I asked the following question regarding what would happen if you placed a stolen certificate on your own server and edited the 'host' file so that the DNS name matched: Could a stolen ...
0
votes
1answer
79 views

Add SSL on top of existing TCP connection

This may sound as basic question for some but I have never done such thing. Imagine I basically have simple TCP client implemented on C# (e.g. TCPClient class) and simple TCP server implemented using ...
4
votes
2answers
84 views

Should I worry if I have tried to ssh into a 'fake' dyndns.org site? (with ssh keys)

I often ssh into servers for work and play using dynamic dns with ssh keys that are password protected. Twice now (shame on me!) I have mistyped the dyndns.org part of the address and been greeted ...
0
votes
2answers
64 views

Public key - private key question

I have a query about public/private key encryption that I hope someone can answer. So as I understand it: Client connects to server and server responds with certificate Client pulls the public key ...
2
votes
1answer
131 views

How do programs like keepass protect their data even when it's loaded into RAM?

After noticing the feature in Keeppass having the option to "Enable in memory protection" I began wondering, how can memory be encrypted and still be useful? Without going into homomorphic ...
3
votes
0answers
60 views

Is ECB secure if I can guarantee that I never encrypt the same block twice?

After reading about modes of operation for block ciphers, I've found that basically all discussions about ECB end with: "never use ECB". For example this security stachexchange answer. However my ...
1
vote
1answer
62 views

Encryption that service provider themselves cannot decrypt?

I recently saw the following message verbatim on an online application I use. The login is simply a login/password combination. There is no oauth, no two factor authentication, etc... This sounds ...
3
votes
1answer
146 views

How do Cloud Encryption Gateways and CASB work?

Cloud Encryption Gateways (CEG) and Cloud Access Security Brokers(CASB) are becoming popular to ensure the security and confidentiality of the data leaving to Cloud Service Providers. How do they ...
2
votes
1answer
343 views

How is an ODBC connection encrypted?

Most conversations about ODBC are Microsoft centric, but the protocol is often used in heterogeneous environements, such as a Windows client connecting to a database on an *nix server. While my ...
5
votes
1answer
59 views

Dynamically decrypting files

Is it possible to store (video) files encrypted (using AES or similar) in the cloud and have clients' browsers download those files and dynamically decrypt them to start viewing them whilst they are ...
1
vote
3answers
339 views

Prevent or detect key copy

This question can be classified as somewhat two interrelated questions - or two goals. Main aim is basically to authenticate client to server, but remain secure even if someone steals the key from ...
0
votes
2answers
114 views

RSA: Do private keys have to be private?

I was thinking about using RSA, but in reverse. Where everyone has the private key, and only the server has the public key, so that all the clients can decrypt a message from the server, and the only ...
0
votes
1answer
55 views

Passcode and encryption

Does a passcode encrypt data on a device? Do additional steps need to be taken in order to encrypt the device, even when a passcode is already set? Or does having a passcode mean the data is ...
1
vote
1answer
74 views

Safe to store encrypted data with (password protected) pfx file

I have created a self signed certificate using Powershell's New-SelfSignedCertificate, with the intention of encrypting and storing a username / password in public. Specifically using - ...
1
vote
0answers
20 views

E2E Encrypted group calls and messaging (plug'n'play solution) [closed]

I'm looking for something similar to Skype I guess. Here are the important main features that I need: Easy "plug'n'play"-like solution (like Skype for example) Safe end to end encryption for calls ...
3
votes
1answer
42 views

User password as offline encryption key

I want to store a file encrypted on the user's device for offline access. Since they don't have an internet connection, they can't sign in with their username/password and receive a secret key, so my ...
2
votes
1answer
103 views

Properly generating RSA+AES keys

For learning purposes, I'm creating a chat application where the connections are done via SSL/TLS, and the messages are encrypted using AES-CBC-256 and the AES keys are encrypted with RSA-2048. The ...
2
votes
1answer
43 views

Why aren't mixed-content connections allowed on localhost?

Recently I had to redo something at work. It involved a servlet on Tomcat that accepted requests from external users (Connection A), which in turn connected via SOAP to a Web Service on the same box ...
1
vote
0answers
44 views

How to decrypt RSA cipher text? [closed]

How can I decrypt an RSA cipher text in which I am only provided with a public key and the cipher text. The person who encrypted it made a mistake in taking the exponent.
2
votes
1answer
102 views

iOS encryption and performance

iOS file encryption deploys many layers of encryption; There is the AES-256 accelerator encrypting general flash memory with the per-file-, UID-, and GID keys. There is Data Protection on the software ...
2
votes
1answer
82 views

How does SSL inspection work on personal devices without deploying a trusted custom certificate?

My (limited) understanding of SSL inspection is that the process involves deploying a certificate to each host that SSL inspection will be monitoring. In an enterprise environment, I can understand ...
4
votes
4answers
155 views

Must an encrypted hash value be bigger than the password it was generated from?

I was reading a book called Introduction to network security theory and practice, and I found the following paragraph: Rainbow Tables A rainbow table is a table of two columns constructed as ...
3
votes
4answers
59 views

Retrieving passcodes through forensic discovery

If you encrypt a device using a passcode, the data stored on the device cannot be retrieved using forensic discovery. What about the passcode itself? Is that encrypted too? Can forensic analysts ...
1
vote
1answer
41 views

Application vs Device - Data encrypted at rest

I have a mobile device that does not have the device's encryption settings enabled. Therefore, data stored on the device is not encrypted at rest. I have installed an MDM containerised application ...
2
votes
1answer
38 views

Use asymmetric encryption once to exchange symmetric key

I'm developing a json API that should be able to handle a huge amount of clients. To make this work I need to reduce the overhead as far as possible. One of the ideas I have is to use https only in ...
1
vote
0answers
23 views

LZO compression of OpenVPN insecure? [duplicate]

I read about the CRIME attack against TLS, that it's avoidable by turning off the TLS compression in the browser. Does this also apply to OpenVPNs comp-lzo option, so that it should get turned off?
3
votes
1answer
52 views

What CryptoPP APIs Output Round By Round Results for AES Encryption/Decryption?

I created a program using CryptoPP APIs to implement AES ECB mode with a 128 bit key for encryption/decryption of user input plaintext. I know that ECB is the least secure AES mode but it is ...
3
votes
1answer
58 views

FileVault and Sleeping mode

I have FileVault activated on 10.10. (Mid 2012 MacBook Pro - MPB) I relaized already that there are different sleep modes. autopoweroff and normal Standby. Whenever the MBP goes into Hypernate mode, I ...
5
votes
3answers
179 views

How do Windows services access folders encrypted with NTFS EFS

If I understood correctly, when I enable NTFS encryption (EFS) for a specific folder in Windows, it uses specific account's user name/password (salted) to create asymmetric keys for data encryption ...
3
votes
2answers
118 views

Most secure way to deliver web app for offline access [closed]

Having built a web app based on a PHP stack which is deployed on a server, I would like to have a way to provide access to it offline. There's a database of patients and appointments that needs to be ...
3
votes
2answers
73 views

Managing the public keys and certifications of S/MIME protocol

I don’t have any experience in the security field, and I want your help. I want to ensure if the following suggestion is applicable and secure, if it’s not, please give me your suggestion to solve the ...
1
vote
1answer
115 views

Is it possible to recover a Diskcryptor volume password?

Must admit to being dumb: I have encrypted one partition from my external hard drive with the AES-Twofish-Serpent algorithm and used a key file with a password. My PC ran into a problem and now the ...
1
vote
1answer
71 views

Can you do a client and server side encryption [duplicate]

I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use ...
4
votes
2answers
145 views

SSLStrip still HTTPS

I did all the configuration right. IPtables, port forwarding, ARPspoof, everything. However, in the browser websites like Facebook and Twitter are still HTTPS. What am I doing wrong?
2
votes
3answers
55 views

Stacking Encryptions (Stream over Block)

I am reviewing the code for a product our team developed where credit card information is stored in a local database in the event of no internet connection and came across the encryption methods. The ...