Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

21
votes
5answers
3k views

Is it possible to “read” secure (using SSL or TLS) messages if you know the message?

If I am communicating over a secure line (secured using SSL or TLS) and I send the server a message. Could someone eavesdropping tell what that message was if they knew before hand a list of messages ...
0
votes
1answer
44 views

What are the risks of file server access over wireless? [closed]

In our office, all computers connect to the network over wireless. The wireless is protected by a pass phrase and communication is AES encrypted. On the same network is a file server that is used ...
-1
votes
1answer
54 views

What would be a problem with using a block cipher to encrypt the traffic of an online game?

I have a question and can't really find the answer. Here are my 3 possibilities. I think it is the 2nd one but want a different opinion. a)The communications require a key exchange not supported by ...
2
votes
1answer
107 views

How does this encrypted webmails works?

In the last days I was looking on Tutanota, ProtonMail, LavaBoom, and others webmails that promise to respect users privacy. For all those, the one I most liked was Tutanota. I did few tests with ...
1
vote
1answer
70 views

How to send secure messages from a microcontroller circuit?

I have an Arduino with a GSM shield. This enables me to send short arbitrary messages to any server. What do I need to do to enable sending "secure" messages (that cannot be intercepted and have a ...
-1
votes
3answers
183 views

If TLS 1.2 is considered unbreakable, why do the NSA and other agencies invest in supercomputers? [closed]

If a 2048-bit RSA key and a 256-bit AES key are considered to be unbreakable within the foreseeable future by any kind of computer, why do the NSA and other intelligence agencies invest in ...
0
votes
3answers
139 views

Does Wifi encryption create a private tunnel between the adapter and the accesspoint?

When non HTTP/S data is sent over Wifi, can that data be seen by other machines that happen to also be connected to that same access point? Does the privacy of the HTTP data depend on the encryption ...
1
vote
1answer
38 views

Is it possible to convert a gpg key to a different encryption algorithm [duplicate]

Maybe the answer to this question is a simple and unequivocal "No", followed by "How can you possibly think that this is possible?". And if I think about it rationally this seems to be the only ...
0
votes
2answers
143 views

Is all encryption compromised? [closed]

Assuming that what I read about the Nazi enigma encryption being broken in ww1 and ww2, where the code breakers hid the fact that they had broken the code, allowing the world to feel that the code was ...
4
votes
2answers
412 views

Should IBAN and bank details be considered private data and encrypted?

To pay off our users, they are asked to enter their IBAN and bank name and bank address. The users are mostly based in Europe. As far as I know (see also this question) these details can not be used ...
1
vote
2answers
231 views

Two-factor port-knocking via SMS (TXT)

It seems to me that a useful alternative or supplement to traditional port-knocking, fwknop, etc, for a system requiring only occasional access, would be to: Set up a one-time pad of keys, and a ...
6
votes
2answers
370 views

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

This question had been asked several times, but still something's not clearly understood from other answers I have a few servers running with a custom built linux kernel (minimal driver modules etc), ...
6
votes
2answers
937 views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
2
votes
1answer
90 views

Protecting a statistics endpoint

When we download an application - it asks us whether it's ok to submit statistics, error reports to the vendor. Since this data is sent from the application to server endpoint - I am wondering how ...
3
votes
5answers
257 views

A secure way to encrypt a connection between 2 clients securing against both passive and active adversaries

Recently I got interested in encryption and the methods behind them. So for a fun / school project I am building a program in python to encrypt data between two clients (chat and files). I'm just ...
25
votes
9answers
9k views

Do secure phone lines exist?

I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure . I know that Skype and other VOIP service providers have to ...
3
votes
1answer
2k views

Token authentication and storage / websocket issues

My application is running an API authentication that uses tokens rather than cookies. This leads me to ask a few questions : What is the most secure way to store the token ? By using random ...
2
votes
1answer
204 views

linux hidden OS

I have been reading about hidden volume OS with truecrypt, and now with its successor, VeraCrypt. https://veracrypt.codeplex.com/wikipage?title=VeraCrypt%20Hidden%20Operating%20System But Couldn't ...
2
votes
1answer
105 views

Plain text password emailed back during registration [duplicate]

I would like to ask if the passwords in the database are not encrypted if during registration I am receiving plain text password with username.
2
votes
1answer
100 views

What is the default cipher algorithm for GnuPG?

I know, that one can force GnuPG to use AES256 for encryption with gpg --cipher-algo AES256 or with a special setting in ~/.gnu/gpg.conf. But, what is the default cypher algorithm for GnuPG, if I ...
2
votes
1answer
91 views

Is it necessary to encrypt nonce in cryptographic communication?

Server and client have a pre-shared key K. Assuming that that pre-shared key is safe, so nobody other than server/client can encrypt/decrypt. Client sends a nonce N to server, server then sends back ...
3
votes
0answers
102 views

How does Silverlight protect the AES keys it gets from PlayReady? [closed]

I'm doing some research about how Silverlight protects AES keys. Here is the scenario: There is a smooth stream live encrypted channel service. When i log in to the service and tune the channel, ...
2
votes
0answers
64 views

How do I allow for anonymous encryption? [closed]

I have a protocol I am designing that requires anonymity and privacy. My idea is to have a minimum number of hops in the network before the message can be sent to its intended destination. The ...
2
votes
1answer
36 views

How is ECIES available in FIPS Validated libraries?

ECIES is Elliptic Curve Integrated Encryption Scheme. Both Certicom's SecurityBuilder and RSA Data Security BSAFE provide ECIES. Both are FIPS 140 validated, and both clearly list ECIES in their data ...
1
vote
2answers
122 views

Encrypting short data with RSA only?

I have a case where I need to create recovery accounts and I want to create them so that nobody knows the password to them until/unless necessary. Hence, I thought that I would do it using RSA - when ...
0
votes
2answers
88 views

Determine Security Of A PDF File [closed]

How do I find the exact encryption on a PDF file? I can't seem to get a direct answer on the net. For example how do I tell if a document is PDF 1.1 - 1.3 (Acrobat 2 - 4), PDF 1.4 - 1.6 (Acrobat 5 - ...
7
votes
2answers
332 views

An analysis of storing hints for passwords?

What are the security implications of asking users to provide password hints? What are best practices for storing user hints? What research has been done on using user-supplied password hints to ...
55
votes
7answers
16k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
1
vote
3answers
163 views

Is this approach to backups secure?

I've got an existing (personal) backup service which I'm rewriting from the ground up to be secure. At present, I just store files (and diffs) in AWS S3 with no encryption. It works fine but I'd like ...
4
votes
3answers
392 views

Is AES 256 secure enough for putting Backups to AWS or Dropbox?

How long would it take with current hardware to hack an Disk Image which was encrypted with AES 256? I ask because i want to backup personal files (contracts, tax-things, code, keys, private ...
-4
votes
2answers
232 views

Problem with Encryption Protocol

I have a question about a encryption protocol, if it is good or not. Bob and Alice communicate over an insecure channel( a possible attacker can listen). An expert suggests the following protocol to ...
7
votes
2answers
1k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
2
votes
1answer
46 views

Does any DNS Recursive resolver accept a “DNSSEC-only” option under DNSCurve?

I want to use DNSCurve (for privacy) to a trusted DNSSec resolver (for integrity), and want to ensure that I can tell a recursive resolver (like 8.8.8.8, or OpenDNS) that I only want DNSSec queries. ...
1
vote
3answers
688 views

How to intercept and analyze mobile SSL application traffic?

What is the best way to analyze requests sent by a mobile application over SSL? The communication protocol is not necessarily HTTP/S so intercepting them with BURP/ZAP/Fiddler or any other HTTP proxy ...
0
votes
1answer
63 views

Using randomly generated numbers to authenticate with a Relay server

I'm developing a public VoIP relay server, that will help bypass internet firewalls by allowing two clients to connect with it and then it will relay data between the two. Both clients will connect ...
1
vote
0answers
54 views

Logging in from one CMS to another

Two websites with different CMS, user should type login & password on one website and needs to be logged in second website automatically. Now i have this method, it works but i want to know - is ...
1
vote
0answers
56 views

get a key HEX from wpa/wpa2 handshake [closed]

Can I get a key HEX from wpa/wpa2 handshake, or from the network in another way without knowing the passphrase? Example: Network SSID: linksys54gh WPA passphrase: radiustest Hexadecimal key: ...
3
votes
2answers
138 views

Is there any reason for using private key 2 times when creating security hash?

One of the payment solutions for the websites provides the following way of creating security hash for payment link: hash = sha1(private_key + payment_params_json + private_key); Is there any ...
2
votes
1answer
111 views

Strategy for encryption before cloud storage

Apologies if this has been asked before. I am looking to encrypt documents before storing in the cloud. There will be a separate metadata storage, which could be either internal or cloud hosted. My ...
0
votes
1answer
47 views

Which parameters can I use to analyse my cipher? [closed]

I have made a new methodology for a symmetric key cryptography in which I have used matrix operations, a boolean function and ASCII conversion. Please suggest me the possible parameters to judge my ...
7
votes
1answer
1k views

OpenSSL fails NIST AES-128-ECB test vectors?

I'm having trouble getting OpenSSL's ciphertext to match the NIST test vectors. Example : in "ecb_e_m.txt" from http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip, the first test is (in hex) ...
1
vote
2answers
172 views

How to keep database record secret even from developer having access to it?

Imagine a web-based email app, such as GMail. The email should only be readable by the sender and the recipients. No one else, including the developer having access to the database server or ...
0
votes
2answers
144 views

Storing unencrypted, confidential data in client memory

I am currently working on a service which lets users store client-side encrypted data and access it anywhere. The client connects through a browser and the webapp is written in JavaScript. To easier ...
11
votes
7answers
3k views

What's the safest way to transmit a message to another client through a server hidden from high level malicious users? [closed]

Suppose you're constantly being menaced by high profile hackers and agencies that try to intercept messages sent between you and a friend. The question is: what's the safest way to send messages to ...
1
vote
5answers
670 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
35
votes
5answers
49k views

Advantages and disadvantages of Stream versus Block Ciphers

Encryption algorithms such as Blowfish,AES,RC4,DES and Seal are implemented in one of two categories of ciphers. What are the advantages/disadvantages to the type of ciphers?
5
votes
4answers
2k views

How to roll my own security mechanism - avoid SSL

i'm looking at implementing my own security mechanism rather than using ssl due to ssl being 'hopelessly broken' http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysis/ and also because it is ...
0
votes
3answers
780 views

Which PHP encryption method is most incidentally-secure?

just started researching on the latest PHP encryption methods, I've found out my favorite algorithms are compromised. MD5 is no good, SHA-1 has "found flaws", SHA-512 isn't "meant for passwords", ...
1
vote
2answers
268 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...
-4
votes
1answer
55 views

What is the most secure way to protect a custom CMS from infiltration? [closed]

I have a custom CMS with a randomly generated ASCII 100-character string from this site for both my username/password. I also have this following sha512 encryption system, which was created by ...