Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

13
votes
3answers
4k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
13
votes
4answers
14k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
13
votes
3answers
4k views

Is it truly possible to store passwords securely, but be able to see the password?

Every place I looked, people recommended that storing passwords via encryption is like storing passwords in plain text. But every place I've looked, everyone recommends using a password manager like ...
13
votes
3answers
574 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...
13
votes
1answer
12k views

Where is the salt on the OpenSSL AES encryption?

I'm interested in knowing how and where OpenSSL inserts the generated salt on an AES encrypted data. Why? Im encrypting data in Java classes and need to guarantee that I can use OpenSSL to decrypt ...
13
votes
1answer
2k views

When authenticating ciphertexts, what should be HMACed?

Some have argued for using AES-256-CTR with HMAC-SHA-256 for authenticated encryption over AEAD-specific modes like EAX and GCM. However, when doing, this, what should be HMAC'd? And how? ...
13
votes
2answers
1k views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
13
votes
3answers
25k views

How can I decrypt my files from “Cryptowall” encryption? [duplicate]

I just got infected with "Crypt0L0cker" malware,virus or whatever that might be. They gave me a link (http://bica3zjnvl6fxkqf.tor-area.org/jrrk14.php?%20user_code=94aya99&user_pass=2616, the ...
13
votes
9answers
32k views

Is Windows BitLocker secure?

Naturally I feel that I have to ask this question, since it's a built-in feature in Windows. Let's say someone has physical access to my PC, is there an easy way for them to access a BitLocker ...
13
votes
1answer
2k views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
13
votes
2answers
1k views

Protection of Keys/Passwords on Virtual Hardware (XEN, KVM, VMWare, etc.)

Is there any reasonable way to secure data on virtual hardware? What I mean by "virtual hardware" is the various hosted systems that one can rent from various online hosters, that run on top of XEN, ...
13
votes
3answers
7k views

Best practices on securely storing access tokens

What would be the best practices for storing access tokens of another api for your users? In particular I'm developing an application with some friends that let's user log into Facebook to both ...
13
votes
2answers
345 views

What does banking etc. server room protection look like? What happens if it fails?

Given that information security is derived from physical security, as evidenced by this theft, I'm curious as to what protection surrounds my bank account? There are two main avenues I'm interested ...
12
votes
6answers
5k views

Is (safe) encryption over compromised line impossible?

I realize something like this would be the holy grail of communications security and have never heard anything to suggest it has been done. Am just wondering. A lot of mathematicians and computer ...
12
votes
4answers
5k views

Why does PGP use symmetric encryption and RSA?

Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
12
votes
2answers
4k views

Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?

I've noticed that websites start to use 256-bit symmetric encryption, but often still end up using 2048-bit RSA keys. http://www.keylength.com/en/3/ The link above displays the ECRYPT II ...
12
votes
2answers
1k views

Timing attack against HMAC in authenticated encryption?

In an answer to another question of mine, it was noted that a class using standard string comparison functions when checking the HMAC in authenticated encryption would make the class vulnerable to ...
12
votes
6answers
3k views

Identity-Based Encryption - how secure is it?

I was always taught never to invent my own crypto algorithm, and never to trust someone who has a proprietary algorithm. I'm looking at Voltage SecureMail, which uses IBE (identity-based encryption) ...
12
votes
3answers
8k views

Is multiple encryption a good idea?

I know that many encryption algorithms, while secure, have vulnerabilities. To reduce risks, would multiple encryption like this Blowfish_CbC ( Rc2_OFB ( AES128_CBC (myfilecontent))) be a good ...
12
votes
2answers
8k views

Is email encryption, as claimed by ProtonMail, possible?

Is it possible to create a Web service that encrypts all messages, such that only the writer, and the person to whom the mail is sent, can read it? In other words, is the theory behind ProtonMail ...
12
votes
5answers
7k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
12
votes
4answers
3k views

What kinds of SSL certificates are usable for encryption?

I know that Verizon SSL certificates cost close to $600. There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
12
votes
3answers
76k views

CryptoWall 3 - how to prevent and how to decrypt?

My father's computer is now infected with CryptoWall 3, according to the link below. http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#CryptoWall Is there a way to ...
12
votes
3answers
12k views

What is the DUKPT Key Derivation Function?

I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
12
votes
4answers
2k views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
12
votes
2answers
764 views

Is it possible to have a key for encryption, that cannot be used for decryption?

For example, a server might have some encrypted logs or storage or whatnot, that would only be used for reference later. This way even if the server is hacked, everything is still OK until the hacker ...
12
votes
4answers
659 views

Encrypting data by parts vs encrypting the whole data

Suppose I have a file with records, and I have two options to encrypt it: encrypt the file as a whole encrypt each record separately and store them together. Which way is generally preferable and ...
12
votes
2answers
318 views

How difficult it was to crack Navajo's language during WW2?

It is well known that during the WW2 America employed native American, namely Navajo people, to "encrypt" their radio communications. I read some time ago (I don't remember where) that their language ...
12
votes
5answers
5k views

Use RSA keypair for PGP encryption and decryption

Is there a way that I can use a RSA keypair with PGP? What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
12
votes
7answers
4k views

Why can an encrypted private key be brute forced?

When using SSH keys to authenticate to a server for remote access, why is it possible to devise the true key and therefore the passphrase from an encrypted private key, without checking each guess of ...
12
votes
5answers
18k views

Can Skype chat be protected from snooping? Are there safe alternatives?

I use Skype a lot. With all of my clients, staff, contractors and friends, however, the acquisition by Microsoft worries me, as two of my clients are direct MS competitors, and I often work on long ...
12
votes
3answers
3k views

When using AES and CBC, can the IV be a hash of the plaintext?

[Originally on programmers.stackexchange.com with title: Can you encrypt with AES+CBC and search the encrypted data] Basically, I'm going to go with Advanced Encryption Standard with either ...
12
votes
1answer
478 views

What are the problems with encrypted but unsigned data?

In another question's answer, D.W. wrote: Make sure there is authenticity protection for the encrypted data (e.g., encrypt and then sign/MAC): you will need both confidentiality and authenticity ...
12
votes
1answer
2k views

How to study the packets sent by a keylogger

One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it. I have a strong doubt that it is a key-logger. ...
12
votes
3answers
19k views

How is 4G LTE encrypted?

After a few quick searches for 3G security I was able to learn that this standard uses the KASUMI block cipher, of which several weaknesses have been identified (although apparently none of practical ...
12
votes
4answers
1k views

Encrypting IP addresses in a MySQL database

I'd like to encrypt IP addresses in my MySQL database, with the following constraints: Does not need to be resistant to attackers that can execute queries. Must be resistant to attackers that have ...
12
votes
3answers
1k views

How secure is “Firefox Hello”?

The new "Firefox Hello" feature promises easy and safe video conversation. It is not nescessary to create an account, you simply share a link with your partner to start the conversation. The ...
12
votes
1answer
284 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...
12
votes
3answers
3k views

Question about dictionary attacks on GnuPG symmetric encryption

They say algorithms like AES can't practically be broken given a long enough key length (> 128 bits). If I use GnuPG to encrypt a file using AES: gpg -c --cipher-algo AES secretfile it asks me for a ...
12
votes
2answers
2k views

What role does clock synchronization play in SSL communcation

We've recently implemented WS Trust security over SSL for our client / server communications. Our application is used by thousands of our customers, spread out all over the world. One of the ...
12
votes
3answers
16k views

How do I ensure data encryption on Samba transmission on *NIX systems?

I have a heterogeneous system (both MS and *nix) that communicates with CIFS/SMB. How can I ensure proper data encryption at the application layer?
12
votes
5answers
9k views

Encrypting files in a windows environment

We have certain client data which must be encrypted at all times. The part we have been struggling with is encrypting files on network shares. Currently we have network folders encrypted using PGP ...
12
votes
2answers
21k views

Do VPNs provide sufficient protection over public wireless networks?

I know that VPNs are the standard way to secure communication between a remote user and their primary network, but I've never felt entirely comfortable relying on them when using an open wireless ...
12
votes
2answers
3k views

Security of running openpgp.js in a browser with the private key in HTML5 localStorage

If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be ...
12
votes
2answers
13k views

Is it possible to use S/MIME in the web client of Gmail?

I could not find any options in the web interface of Gmail. All I could find was a Firefox plugin to use S/MIME with Gmail, but it seems to be outdated.
12
votes
1answer
2k views

TextSecure protocol

Is anyone aware of an analysis of the TextSecure protocol? https://whispersystems.org/blog/simplifying-otr-deniability/ https://github.com/WhisperSystems/TextSecure/wiki/Protocol It is a ...
12
votes
2answers
3k views

How are mobile telephony networks like LTE and HSPA encrypted?

How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
11
votes
5answers
4k views

Confusion: Why isn't a passhrase encrypted SSH key two factor auth?

I'm trying to figure out the best practices for accessing my devbox from a public terminal. Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
11
votes
7answers
8k views

Who tells that TrueCrypt is secure?

Assuming you're not running on a compromised machine and you're following common recommendations (long random passwords, etc.), who specifically (name and affiliation) asserts that TrueCrypt is ...
11
votes
7answers
3k views

What's the safest way to transmit a message to another client through a server hidden from high level malicious users? [closed]

Suppose you're constantly being menaced by high profile hackers and agencies that try to intercept messages sent between you and a friend. The question is: what's the safest way to send messages to ...