Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
6
votes
4answers
686 views
What kinds of SSL certificates are usable for encryption?
I know that Verizon SSL certificates cost close to $600.
There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
6
votes
3answers
208 views
How much added security do I really get with a longer key size?
Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and ...
6
votes
3answers
2k views
Storing Credit Card Numbers
I'll be making a website with a membership type of option for the website, and I'll be most likely using Authorize.Net to make the transactions, however, I need to know what kind of encryption I can ...
6
votes
3answers
450 views
Block chaining modes to avoid
Everyone knows that ECB operation mode with a block cipher should be avoided because of clear and obvious weaknesses. But little attention is given to comparison of the other modes in the context of ...
6
votes
4answers
187 views
Is it possible for a third party to sniff data off the line to an ISP and determine what the user is doing?
Can somebody hack the line between my router and service provider and monitor what I'm doing online and what sites I'm visiting?
6
votes
5answers
3k views
What does “key with length of x bits” mean?
I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
6
votes
3answers
378 views
Is TLS flawless enough to prevent eavesdropping carried out by an ISP?
I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic.
Will that prevent ISP and ...
6
votes
2answers
2k views
Is 1024bit Diffie Hellman key exchange secure?
My system uses AES-256, 4096bit RSA CA key and 2048bit RSA keys for servers together with SHA-256 signing.
Does using 1024bit DH key exchange lower its security?
I read on one mailing list that ...
6
votes
4answers
2k views
How effective is iPhone 3GS and 4 encryption?
My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device.
In that context how effective is iPhone 3GS and 4 encryption?
6
votes
5answers
657 views
How can I decode a message that was encrypted with a one-time pad?
How can I decrypt a message that was encrypted with a one-time pad? Would I need to get that pad, and then reverse the process? I'm confused here.
6
votes
3answers
307 views
How secure is HTTPS with weak ciphersuites?
Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
6
votes
3answers
637 views
Is the OpenPGP private key inherently password-protected?
I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key?
Essentially, ...
6
votes
2answers
203 views
Is ECDSA breakable by quantum computers?
Is ECDSA secure from quantum computers? Will quantum computers be able to calculate it's private keys from the knowledge of the public key once there are working quantum computers?
6
votes
4answers
2k views
What do key size and block size mean in cryptography?
Can some one simply explain the meanings and the difference between symmetric key and block size.
Edit
Why 64 block size not safe any more and they increase it to 128 (AES,...,Serpent)
And ...
6
votes
2answers
349 views
What encryption (if any) is used on electronic credit cards?
Out of curiosity: how do electronic Visa/Master Card debit/credit cards with microchips authenticate a transaction?
Are they stupid storage for a key which is simply read by a reader or do they ...
6
votes
2answers
482 views
How do I use Skein's Stream Cipher?
I understand the NIST hash function competition candidate Skein comes with a built-in block cipher, Threefish, that is turned into a stream cipher by using Unique Block Iteration chaining (is that ...
6
votes
3answers
666 views
Safe implementation of sharing encryption secrets (username, password) in the cloud
I'm building a multi-tenant (cloud) environment that needs to push out (or make available for download) configuration files for agents (background services) that receive this information. One of the ...
6
votes
2answers
282 views
Does anyone use XML Encryption?
The XML standard defines a mechanism for encrypting the data in a XML document. It's part of the standard.
Does anyone use this XML encryption format? Are there any significant deployed systems ...
6
votes
2answers
562 views
Do Flash memory (SSD) architecture impacts encryption techniques?
I'm working on encryption techniques on SSD's and my question is: does the erase before write architecture of SSD's has anything to do with the encryption technique?
What are the problems I might ...
6
votes
2answers
4k views
The new CCMP attack against WPA/WPA2 PSK
The use of Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) for WPA/WPA2 PSK is being attacked. This is a trivial attack (offline brute force) against the initial ...
6
votes
1answer
779 views
Feistel Block Cipher
Can anybody explain, in simple terms, how Feistal Block Ciphers work. I am not a math student so I do not understand the math behind it, just would like the principles.
6
votes
4answers
517 views
What is your process for wiping a lost Blackberry or similar device?
For all devices I know of, if a device is lost or stolen, it needs to be connected to the Cellular network to receive the wipe command. Considering that the end user often needs to regain mobile ...
6
votes
3answers
4k views
Why triple DES used in EDE mode?
Why is triple DES is calculated in encrypt decrypt encrypt mode? Why a decrypt in the middle? And isn't decrypt = encrypt since DES in a symmetric cipher?
6
votes
2answers
245 views
Filling the disk with random data prior to encryption?
Filling the disk with random data prior to encrypting it will supposedly make it harder for the attacker to perform any cryptanalysis. Most sources seem to state this is because it will be harder for ...
6
votes
3answers
173 views
What risks would exist in transmitting an encrypted PKCS12 via Https
I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate ...
6
votes
2answers
298 views
With Google's new Privacy Policies going into effect soon, how can I better protect myself using their services?
From what I can tell, the gist of the new Privacy Policy from Google is that they're making a blanket policy to allow using your data between all their services, however they see fit. So now one ...
6
votes
4answers
451 views
Encrypt files on flash drive for easy decryption
I am looking to give some files to my accountant, who is not computer-savvy. I am going to put the files on a flash drive encrypted. I assume, accountant has no software other than standard Windows ...
6
votes
1answer
418 views
How to choose a stream cipher
Are there high-speed ciphers designed for things like internet streams without sacrificing security? There are so many options that operate in stream mode. How would one choose a cipher?
6
votes
2answers
286 views
What risks does WPA carry?
A family member of mine would like to be able to play old PSP games online. Unfortunately the device does not support WPA2, and my network is strictly WPA2 AES secured. What are the risks involved in ...
6
votes
1answer
1k views
How does adding a random serial number improve a certificates' security?
This article says:
"Finding collisions is a tricky process, since it requires you to muck
with the bits of the public key embedded in the certificate (see this
paper for more details). Also, ...
6
votes
3answers
615 views
Using Secure Remote Password without sending the username in the clear
To initiate a key exchange using the SRP protocol the client sends the username so the server can look up the salt and password verifier. Is there a simple way to change this so that an evesdropper ...
6
votes
5answers
2k views
Encrypting files in a windows environment
We have certain client data which must be encrypted at all times. The part we have been struggling with is encrypting files on network shares.
Currently we have network folders encrypted using PGP ...
6
votes
3answers
1k views
Initialization vector with cipher block
Is the initialization vector used to encrypt a block of data always static or dynamic? If it is dynamic then I should send the IV along with the key to the recipient right? This normally doesn't ...
6
votes
3answers
425 views
Computer decryption algorithms and knowing the solution
This is a general question about using computers to decrypt information. It has puzzled me for a while.
The question is really two parts:
How does a computer check if a "guessed" key is the correct ...
6
votes
2answers
262 views
Does using both GPG encrypted files and encrypted filesystem make sense?
For a few years i stored my personal text files encrypted using an asymmetric key through GnuPG. Now i thought that it is a good idea to also encrypt my hard drive partition. Does it make sense to use ...
6
votes
1answer
192 views
Collision attacks on OCB?
I've been looking into the OCB cipher mode and everything I hear sounds good. I was planning on implementing it.
Everything except for this lone voice, that is: Collision attacks on OCB:
We ...
6
votes
1answer
365 views
Secure query string parameters
I have an application which use the Thick box jQuery component to open a popup page .
And I pass my parameters in query string like this :
<a id="btnShowPopup6" runat="server" class="thickbox" ...
6
votes
1answer
131 views
Encryption in an embeddded system
After accepting an answer to my previous question, I am beginning to have doubts.
I want to updating pricing information in vending machines by inserting an SD card with new pricing.
I have to ...
6
votes
1answer
477 views
OpenSSL fails NIST AES-128-ECB test vectors?
I'm having trouble getting OpenSSL's ciphertext to match the NIST test vectors.
Example : in "ecb_e_m.txt" from http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip, the first test is (in hex) ...
6
votes
1answer
464 views
Select a TripleDES key so that it effectively behaves as regular DES
I'm working with a smartcard (DESFire) that supports both TripleDES and DES. In the specs it is stated that both modes of operation use 16 bytes keys. When the first 8 bytes in the key are identical ...
6
votes
1answer
1k views
SSL Session resumption and IDs
Some sites, as seen in the report for www.mbank.com.pl [ssllabs.com] or report for aliorbank.pl [ssllabs.com] do not support "Session resumption", either because IDs are assigned but not accepted ...
6
votes
3answers
427 views
Patent free symmetric-only key exchange protocols?
I am working with a networked embedded device with AES-128 and no public key cryptography (1KB RAM, 8KB flash). At install, the device is pre-loaded with a longterm AES-128 key known also to the ...
6
votes
1answer
101 views
Encrypting short identifiers?
I am developing a webapp that does not reveal record count, because it hides the primary key. I am looking for a better way to do this.
My favorite idea is to encrypt the ID itself with a block ...
6
votes
1answer
70 views
What is the best way to manage package signing keys?
I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment.
I have initially created a signing ...
6
votes
1answer
571 views
WPA2 Enterprise AES encryption key size?
I have recently set up a RADIUS server with EAP for my wireless router, however, I have some questions about the key size and how WPA2 enterprise (AES) works in general.
I have read that in ...
6
votes
2answers
531 views
Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?
Going deeper into the previous question on Firefox plugins and add-ons malaware risks: Could they potentially decode and capture the encrypted websites passwords saved in the browser?
6
votes
1answer
284 views
Encrypting sensitive data in software and storing/decrypting it on a server
I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing.
I'm developing software which has 2 parts - a C# program run ...
6
votes
1answer
292 views
Android and AES side channel attacks
I am working on a project that will involve symmetric AES 128 bit encrypted communication between an Android application and a bluetooth device. Are there any public AES libraries available for ...
6
votes
1answer
419 views
How do I learn Cryptographic/Mathematical notation
I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation.
How do I learn this notation and how to convey my approach?
How can I annotate this ...
5
votes
6answers
354 views
What is the use of password encryption?
Why do we encrypt passwords? Is it to protect the password from eavesdropping? to protect the password after saving it in database? both? or for some other reason?
