Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

14
votes
7answers
1k views

Has cryptography reached the development level where social engineering is the only reliable method of attack?

Note that for the purpose of this question, "social engineering" means extracting information from humans, be your methods compliant with Geneva Conventions or not. Simply put: Do cryptographic ...
14
votes
3answers
79k views

CryptoWall 3 - how to prevent and how to decrypt?

My father's computer is now infected with CryptoWall 3, according to the link below. http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#CryptoWall Is there a way to ...
14
votes
3answers
1k views

start point into cryptography and encryption [closed]

Recently I am growing passion for security/encryption/cryptography. I follow some famous people in this domain on twitter and read articles over the web. However, this topic seems deep and every time ...
14
votes
6answers
2k views

Why not RSA-encrypt the entire document?

I have recently learned of a way for person B to verify that a document sent from person A is indeed from person A. Person A gives Person B his public RSA key. This must be done reliably. Person A ...
14
votes
3answers
4k views

Is amazon S3 secure enough to hold personal documents?

I have a client who is looking to hold personal information such as Driving Licences and Insurance documents in order to verify if a user of the site is who they say they are and lives where they say ...
14
votes
6answers
7k views

Why encrypt data in memory?

I saw that KeePass not only encrypts its password-database-file, it also can encrypt the passwords it holds in memory. This is just an example. I thinking of a new project dealing with sensitve / ...
14
votes
6answers
679 views

Primary Key as Salt?

Is it okay to use the primary key as the salt in a Users table? The only disadvantage that I can see is if the PK changes (unlikely), then the passwords break. What are your thoughts?
14
votes
1answer
3k views

Which Cryptography algorithm is used in WhatsApp end-to-end security?

I have a presentation to make on Social Network Security. I have been doing some research regarding this. I did a lot of searching, but was unable to find the Crypto Algorithm used by WhatsApp for ...
14
votes
5answers
2k views

Is there a digital “safety deposit box” equivalent?

Digital safety deposit boxes: do they exist? if yes, are (any|they) trustworthy? There are many bricks and mortar financial institutions where one can rent a locked box in a locked room and be ...
14
votes
3answers
5k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
14
votes
4answers
734 views

Database Encryption Security

I am encrypting and decrypting my database data from my web applications API. If my web server is compromised, what is to keep someone from using that same method to retrieve the data? For example, ...
14
votes
1answer
2k views

When authenticating ciphertexts, what should be HMACed?

Some have argued for using AES-256-CTR with HMAC-SHA-256 for authenticated encryption over AEAD-specific modes like EAX and GCM. However, when doing, this, what should be HMAC'd? And how? ...
14
votes
4answers
2k views

Is Steganography considered encryption and subject to USA export restrictions?

I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
14
votes
2answers
2k views

How would I implement “Broadcast Encryption”?

I have a stream that I want to encrypt for broadcast to 10,000 subscribers. I know I should encrypt this data using a symmetric key; and also intend that this symmetric key will be rotated every 30 ...
14
votes
3answers
1k views

How secure is “Firefox Hello”?

The new "Firefox Hello" feature promises easy and safe video conversation. It is not nescessary to create an account, you simply share a link with your partner to start the conversation. The ...
14
votes
3answers
17k views

How do I ensure data encryption on Samba transmission on *NIX systems?

I have a heterogeneous system (both MS and *nix) that communicates with CIFS/SMB. How can I ensure proper data encryption at the application layer?
14
votes
2answers
1k views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
14
votes
5answers
9k views

Encrypting files in a windows environment

We have certain client data which must be encrypted at all times. The part we have been struggling with is encrypting files on network shares. Currently we have network folders encrypted using PGP ...
14
votes
1answer
2k views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
14
votes
2answers
1k views

Storing sensitive information securely

I know there have been a few questions about this already, but I just wanted to know if anyone can take a look at my design plans to see if there are any gaping security holes. I am in the process of ...
14
votes
3answers
7k views

Best practices on securely storing access tokens

What would be the best practices for storing access tokens of another api for your users? In particular I'm developing an application with some friends that let's user log into Facebook to both ...
14
votes
1answer
385 views

How would one verify that the public key from WhatsApp's servers belongs to the person I expect it to?

WhatsApp had recently announced end-to-end encryption on all communications. While that's an impressive move, I still have a big open question mark. The articles and this white paper suggest that the ...
13
votes
3answers
1k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
13
votes
4answers
6k views

Why does PGP use symmetric encryption and RSA?

Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
13
votes
3answers
9k views

Is multiple encryption a good idea?

I know that many encryption algorithms, while secure, have vulnerabilities. To reduce risks, would multiple encryption like this Blowfish_CbC ( Rc2_OFB ( AES128_CBC (myfilecontent))) be a good ...
13
votes
6answers
3k views

Identity-Based Encryption - how secure is it?

I was always taught never to invent my own crypto algorithm, and never to trust someone who has a proprietary algorithm. I'm looking at Voltage SecureMail, which uses IBE (identity-based encryption) ...
13
votes
5answers
25k views

SHA, RSA and the relation between them

SHA is the hashing mechanism. However, RSA is the encryption algorithm. So does RSA algorithm use SHA hashing mechanism to generate hashing keys which in turn is used to encrypt the message?? ...
13
votes
3answers
9k views

Can I use a private key as a public key and vice versa?

I have code to encrypt data using a public key and decrypt it using a private key. This is useful when a client wants to send data to a server and know that only the server can decrypt it. But say I ...
13
votes
4answers
2k views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
13
votes
1answer
3k views

PayPal encrypted with obsolete cryptography

My Chrome just complained from PayPal's security, similarly to this issue: Google Chrome "Your connection to website is encrypted with obsolete cryptography" The identity is verified, but ...
13
votes
2answers
14k views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
13
votes
3answers
16k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
13
votes
5answers
6k views

Use RSA keypair for PGP encryption and decryption

Is there a way that I can use a RSA keypair with PGP? What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
13
votes
7answers
4k views

Why can an encrypted private key be brute forced?

When using SSH keys to authenticate to a server for remote access, why is it possible to devise the true key and therefore the passphrase from an encrypted private key, without checking each guess of ...
13
votes
2answers
661 views

Is a large number of RSA-encrypted files a vulnerability?

Would having a large number (10^4) of RSA encrypted files make it easier for an attacker to find my private RSA key? Update: These files would be available to the attacker, and perhaps the content of ...
13
votes
4answers
17k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
13
votes
2answers
635 views

Is there a cipher suite “translator”

I have a list of cipher suites in this format: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384 Is there a fast, easy way of translating it to more human readable/management readable format? :)
13
votes
3answers
21k views

How is 4G LTE encrypted?

After a few quick searches for 3G security I was able to learn that this standard uses the KASUMI block cipher, of which several weaknesses have been identified (although apparently none of practical ...
13
votes
3answers
6k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
13
votes
3answers
589 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...
13
votes
1answer
12k views

Where is the salt on the OpenSSL AES encryption?

I'm interested in knowing how and where OpenSSL inserts the generated salt on an AES encrypted data. Why? Im encrypting data in Java classes and need to guarantee that I can use OpenSSL to decrypt ...
13
votes
4answers
1k views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
13
votes
2answers
15k views

Is it possible to use S/MIME in the web client of Gmail?

I could not find any options in the web interface of Gmail. All I could find was a Firefox plugin to use S/MIME with Gmail, but it seems to be outdated.
13
votes
2answers
379 views

What does banking etc. server room protection look like? What happens if it fails?

Given that information security is derived from physical security, as evidenced by this theft, I'm curious as to what protection surrounds my bank account? There are two main avenues I'm interested ...
12
votes
6answers
5k views

Is (safe) encryption over compromised line impossible?

I realize something like this would be the holy grail of communications security and have never heard anything to suggest it has been done. Am just wondering. A lot of mathematicians and computer ...
12
votes
2answers
5k views

Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?

I've noticed that websites start to use 256-bit symmetric encryption, but often still end up using 2048-bit RSA keys. http://www.keylength.com/en/3/ The link above displays the ECRYPT II ...
12
votes
5answers
5k views

What is the benefit with using encrypted RAM Memory?

I sometimes hear that encryption is used for the RAM Memory, but I don't really understand why this is needed. Why is RAM Memory needed to be encrypted? and is this done by the hardware, the ...
12
votes
5answers
7k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
12
votes
4answers
3k views

What kinds of SSL certificates are usable for encryption?

I know that Verizon SSL certificates cost close to $600. There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
12
votes
5answers
22k views

What does “key with length of x bits” mean?

I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...