Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

9
votes
4answers
2k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
9
votes
4answers
1k views

How would you analyze an image to find out if there are scripts embedded in it?

How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
9
votes
3answers
2k views

Question about dictionary attacks on GnuPG symmetric encryption

They say algorithms like AES can't practically be broken given a long enough key length (> 128 bits). If I use GnuPG to encrypt a file using AES: gpg -c --cipher-algo AES secretfile it asks me for a ...
9
votes
3answers
2k views

Suitable cipher for SMS encryption

I would like to create application for encrypting SMS messages. After long enough discussions I decided to use symmetric encryption, since handling public/private keys issue is too difficult for most ...
9
votes
3answers
700 views

AES using derived keys / IVs. Does it introduce a weakness?

I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application. Obviously in order to re-use this key, a unique ...
9
votes
3answers
662 views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
9
votes
1answer
6k views

Where is the salt on the OpenSSL AES encryption?

I'm interested in knowing how and where OpenSSL inserts the generated salt on an AES encrypted data. Why? Im encrypting data in Java classes and need to guarantee that I can use OpenSSL to decrypt ...
9
votes
3answers
2k views

Is “Why Should You Avoid AES In MySQL?” true?

From a 2012 Smashing Magazine article quite a bold statement is made to avoid AES in MySQL itself. Or as they put it "Why Should You Avoid AES In MySQL?". However, if you search for SQL encryption, ...
9
votes
2answers
83 views

Do I need to password-protect an “Electronic Copy” of health information given to a patient on e-media?

I'm struggling to find good documentation regarding requirements around security and encryption of patient clinical information when delivered to a patient in electronic format. Patient portals, ...
9
votes
2answers
2k views

Data Encryption and Key Management in C#

Which route to take, what are the pros and cons, which is more secure.. Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
9
votes
1answer
480 views

Reversible, recoverable user data encryption scheme

From this earlier question, I have a general need to obfuscate a set of third-party credentials stored in a user account, which are then used in an internal Winforms software client. The scheme from ...
9
votes
3answers
362 views

Is it preferable to perform encryption using database functions or code?

Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL. Most of the commonly used ...
9
votes
1answer
323 views

Optimal variable sizes in the Secure Remote Password protocol

I am implementing the Secure Remote Password protocol: U = <username> --> <-- s = <salt from passwd file> a = random() A = g^a ...
9
votes
3answers
2k views

Best practices on securely storing access tokens

What would be the best practices for storing access tokens of another api for your users? In particular I'm developing an application with some friends that let's user log into Facebook to both ...
9
votes
2answers
527 views

Can I use hardware random number generation on my computer? Am I already using it?

A lot of computer security depends on encryption: SSL connections, TCP packet sequencing, encrypted files, etc. These depend on random number generation to ensure that attackers can't guess the ...
8
votes
7answers
29k views

How can I determine the encryption strength of an SSL connection

If I've connected to a https url, how can I determine the cipher strength of the connection? My understanding is that after the asymmetric public-key handshake the information is encrypted using a ...
8
votes
5answers
398 views

Encrypting a disk that has stuff on it?

Ok, so a pretty big disk ~1-2TB (90% full, multiple partitions + 2 operating systems on it), needs to be encrypted and zeroed-out, and it's a bit too much data for backing it all up before encryption. ...
8
votes
5answers
386 views

What can one do when encryption methods fail?

I'm in search of an expert to answer my curiosity. Suppose that methods like AES/DES, SSH, PGP, RSA, etc. can be cracked or fail somehow. In other words, suppose that it's possible to determine one ...
8
votes
3answers
2k views

What common products use Public-key cryptography?

I want know what common use products are there that use public key/private key cryptography?
8
votes
5answers
3k views

SSL/TLS - Distinction between self-signed cert and self-signed CA, and other questions?

I have a small personal website which I wish to serve securely over HTTPS. At the moment I do not wish to use a third party CA to sign my certs. I was reading this document on generating a self-signed ...
8
votes
2answers
2k views

Using RSA with 3DES instead of plain 3DES. Does it make sense?

I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And ...
8
votes
3answers
7k views

What is the DUKPT Key Derivation Function?

I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
8
votes
4answers
2k views

Is using HMAC to transmit a password OK?

I'm writing a small webapp and I don't want to transmit login passwords as cleartext. As I don't have SSL available I've written a one-time challenge system which sends a random string with the login ...
8
votes
4answers
2k views

What Partial Homomorphic Encryption implementations exist and how do I leverage them?

It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
8
votes
3answers
5k views

Is RedPhone a secure and secret way to communicate?

RedPhone provides end-to-end encryption for your calls, securing your conversations so that nobody can listen in. But really, how is the probability that a voice conversation is wiretapped still? ...
8
votes
3answers
606 views

Why do so many embedded devices use shared keys?

Many commercially available embedded device manufactures use the same keys for all instances of their respective devices. This situation is so rampant, a project called littleblackbox has created a ...
8
votes
4answers
3k views

moving from MD5 to SHA-512

This question is more of a security policy than a technical security question. Many years ago I developed an asp.net site, implemented Forms Authentication, and stored the user passwords as MD5 ...
8
votes
4answers
508 views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
8
votes
4answers
905 views

Automated encryption detection

Is there any program that, given a cipher text, it would tell me what the encryption algorithm is? What if I have the plain text? Is there something that can be done in that case?
8
votes
3answers
588 views

Most widespread use of PGP after 20 years

Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP ...
8
votes
3answers
213 views

Securing an E-commerce site

I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site. I'm confused as to what the critical ...
8
votes
2answers
819 views

Is ECDSA breakable by quantum computers?

Is ECDSA secure from quantum computers? Will quantum computers be able to calculate it's private keys from the knowledge of the public key once there are working quantum computers?
8
votes
3answers
5k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
8
votes
6answers
523 views

Security of email [duplicate]

Possible Duplicate: How commonly are SSL/TLS or S/MIME used by e-mail providers? Say, Alice uses gmail and Bob uses hotmail. Alice wants to send an email to Bob. Alice goes to gmail ...
8
votes
3answers
1k views

Truly deniable encryption

What tools can be used to make truly deniable encryption? Suppose, authorities can use any force to make you open your passwords. Truecrypt can have only one hidden container, which means that ...
8
votes
3answers
672 views

How practical/important is the Lucky Thirteen TLS attack?

I was reading this article which talks about a new attack against TLS being called Lucky Thirteen. It claims to allow repeatable MitM attacks against HTTPS connections. It's described as being fairly ...
8
votes
1answer
3k views

When using AES and CBC, is it necessary to keep the IV secret?

If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key? ...
8
votes
1answer
2k views

How does adding a random serial number improve a certificates' security?

This article says: "Finding collisions is a tricky process, since it requires you to muck with the bits of the public key embedded in the certificate (see this paper for more details). Also, ...
8
votes
1answer
745 views

Why can't I use the same key for encryption and MAC?

I wrote a simple file encryption program as an example of how to do encryption correctly, but after reading a questions about encryption + MAC, I think I made a mistake by using the same key for both. ...
8
votes
1answer
904 views

How to study the packets sent by a keylogger

One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it. I have a strong doubt that it is a key-logger. ...
8
votes
3answers
1k views

Security implications of storing the password hash along an encrypted AES key

I am using the PKCS#5 standard to generate a key using a random and unique salt and the user's password in input. Consider this key as the "encryption" key. The "encryption" key is used to encrypt a ...
8
votes
3answers
836 views

Location to store an encryption key

I'm building a secure system which stores messages on a server in a Postgresql database. The messages are stored encrypted with PHP's openssl_encrypt() function with the AES-256-CBC method. At the ...
8
votes
4answers
437 views

What steps should one take to provide “reasonable” levels of privacy from a government?

I'm highly uncomfortable with the recent news surrounding government snooping in the UK. If we define a typical user to mean somebody who: Browses web sites such as BBC News and Stack Overflow Uses ...
8
votes
3answers
1k views

Is it safe to store a single symmetric key encrypted with several different RSA public keys?

For the field-based encryption of a database containing sensitive information, I was thinking of the following design: Every user has a smartcard used for client certificate login. After login the ...
8
votes
1answer
819 views

How to choose a stream cipher

Are there high-speed ciphers designed for things like internet streams without sacrificing security? There are so many options that operate in stream mode. How would one choose a cipher?
8
votes
4answers
603 views

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that ...
8
votes
3answers
671 views

Does the SSL encryption strength of a website really matter?

When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart. Immediately there seems to be 4 major ...
8
votes
2answers
4k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
8
votes
2answers
7k views

How is 4G LTE encrypted?

After a few quick searches for 3G security I was able to learn that this standard uses the KASUMI block cipher, of which several weaknesses have been identified (although apparently none of practical ...
8
votes
3answers
899 views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...