Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

1
vote
1answer
98 views

what is the best way to know if the entered decryption key is correct?

I was searching for a way to store the encryption key of AES_ENCRYPT and found a good answer here: where to store a key for encryption However, now I am trying to use "Type in the encryption key when ...
6
votes
3answers
602 views

Encrypted password inside compressed archive

File compression utilities like Winrar or ZIP or 7zip encrypt the password and store it inside the archive. How safe is that? I mean you are giving away the archive with the password inside,it's not ...
-1
votes
4answers
165 views

Securely enable FBI backdoor for phones [duplicate]

Most of the issues raised by Apple and others about giving the FBI access to the terrorists iPhone, seem to stem from a concern about reducing the overall security for regular users. Does this ...
5
votes
1answer
124 views

Can a FIDO U2F device be used for symmetric encryption?

As I understand, U2F is mainly used for authentication. It uses challenge-response scheme to check if the device used for logging in is the same device which was used during registration based on ...
1
vote
3answers
137 views

Is it possible for Apple or any other company to create fully encrypted smartphone?

From the latest Apple vs FBI story it's known that Apple is technically capable of changing the boot-loader of the iPhone to provide interface for brute-force finding of 4-digit password. I'm ...
0
votes
3answers
95 views

How does encryption force a processor to “pause”?

I'm often told that encryption forces processors to "make a pause" when performing the math to decrypt a hash, which is why brute forcing can take so long. I don't understand what it means for a ...
4
votes
2answers
241 views

Purely as a technical matter, is it possible to make otherwise-strong encryption implemetations that contain governmental backdoors?

So to be clear right-off-the-bat: I think re-designing modern encryption to include governmental "backdoors" is, on balance, a quite bad idea, for any number of good reasons. Nor (FWIW) do I actually ...
-2
votes
3answers
317 views

Why is encryption bad for passwords?

We use PGP for almost everything and it's so infeasible to bruteforce that it's considered secure. This is the guiding principle beyond CryptoLocker. But for stuff like e-mail, SSH and HTTPS, it's ...
6
votes
1answer
281 views

Bank Has Emailed My Social Security Number

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first ...
43
votes
9answers
7k views

Can an open Wi-Fi hotspot be considered “secure” when using a VPN connection?

There are many open Wi-Fi hotspots scattered around from cafes to airports. I understand that a non-passworded Wi-Fi leaves traffic unencrypted and therefore available for hackers to read. I also ...
-4
votes
1answer
97 views

How to decrypt this javascript code [closed]

I can't decrypt it. Please advise me. javascript code var ...
1
vote
1answer
105 views

Could the FBI dump the drive contents of an iOS device, and then somehow run Virtual CPU's with different keys?

This seems like the most logical answer that would prevent wiping the data. Dump Contents of Drive. SetUp Virtual CPU with different keys. Use existing firmware and hardware for ios x Profit Is ...
3
votes
2answers
61 views

Chosen-ciphertext attack — basic question

Disclaimer: I'm a beginner with security. Problem: I am reading Applied Cryptography by Schneier. He writes: Question: How can "automatic decryption" work without the deduced key? Does the ...
0
votes
0answers
2k views

Android vs iPhone encryption

I'm really curious to know what the technologies behind Android and iPhone are in regards to encryption. I know Android was supposed to go with encryption by default like iOS 8.0 and beyond and never ...
3
votes
3answers
689 views

Why don't ISPs offer encryption?

I was quickly wondering, why don't ISPs offer encryption for the traffic from the customer's router to the ISP-server? Until now, if you want to protect against e.g a MitM-attack you solely rely on ...
3
votes
2answers
134 views

WebCrypto algorithms and differences with other crypto libraries

I was looking at the WebCrypto crypto libraries coming form the W3C. Looks like only a few cryptosystems are supported, including AES-CBC, AES-CTR, AES-GCM, and RSA-OAEP. ...
0
votes
0answers
83 views

C# app and ASP.NET api: validating requests/responses

So I have one C# WPF desktop app (client), which communicates with my web api to login for the user, get info, etc. The C# WPF app will communicate with a hardware device as well. However, there is a ...
-7
votes
2answers
5k views

Is AES slower to encrypt than MD5?

Is this the right interperation of this diagram: http://www.cryptopp.com/benchmarks.html AES/CCM MiB/Second:61 Cycles Per Byte:28.6 MD5 MiB/Second:255 Cycles Per Byte:6.8 And does that ...
5
votes
3answers
5k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
1
vote
2answers
4k views

Encrypted code file (.vbs) hides all my files and shows .lnk files

I am using Windows XP Professional and what happens is that when I try to connect any gadget like a pen drive or a mobile through USB, all my data gets hidden and it shows a 1 kb file which is a .lnk ...
0
votes
2answers
47 views

Guarantee one unique identity per node

I'm in the early stages of designing a decentralised systems protocol, based on a blockchain, for a thesis. For the protocol to remain secure, each node in the system must be capable of generating ...
0
votes
0answers
14 views

Is encryption with a destroyed key a good cryptographic hash function? [duplicate]

Obviously this isn't something I was going to implement, but it was a question floating at the back of my mind. So let's say that instead of hashing passwords to store in the database, you encrypt ...
0
votes
2answers
126 views

Can we store sensitive client information with the admins without them(admins) identifying it?

I am trying to design a pairing application for my university this valentine. How is it supposed to work, you ask?? The clients will submit preferences specifically names to the server and after some ...
3
votes
2answers
74 views

In what case should one encrypt cookies?

I am curious how one decides whether to encrypt cookies or not? And if so when should one use public private key over symmetric encryption?
4
votes
2answers
171 views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
-2
votes
2answers
142 views

How to securely transfer password from a registration page to the database [duplicate]

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time ...
0
votes
0answers
27 views

Is it OK to seal data to TPM SRK directly?

In reviewing various TPM programs and libraries, I have noticed that when sealing data to the TPM, a new key is always created (wrapped by the SRK), and that new key is loaded and used in the seal ...
7
votes
1answer
134 views

Is a 43 character GPG (symmetric) passphrase as secure as a 256-bit key?

A 43 character securely randomly generated mixed case alphanumeric password (with 2 extra chars to give 64 possibilities per character) would constitute 258 bits of entropy (6 * 43 = 258). Since the ...
0
votes
1answer
41 views

Is there a 'key space' equivalent for encryption keys?

If a key space is the term given to the collection of all possible decryption keys for a given cryptosystem, then what is the collection of all possible encryption keys called?
27
votes
4answers
17k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
7
votes
1answer
137 views

Encrypting individual files on OS X

I am about to go paperless, and I want to protect the documents that I scan. The use case is that I'll be scanning paper documents, encrypting each file, and storing them locally and on various backup ...
-4
votes
1answer
71 views

How to encrypt/decrypt with only encryption hardware?

Alice and Bob have agreed a symmetric key to be used for encrypting messages to be sent over an insecure (wrt a passive adversary) communication channel. Both of them have hardware devices for ...
0
votes
0answers
41 views

DSS digital signing approach

Under the DSS approach to digital signing, what is the advantage of using two pairs of keys for each signature?
7
votes
3answers
2k views

Is ENCFS secure for encrypting Dropbox?

I've encrypted my dropbox-folder with encfs according to a few tutorials I found on the web, advocating this approach. But I've found the following critical statement concerning encfs'security in ...
31
votes
4answers
6k views

Is there an encryption algorithm that is fully secure?

Is there an encryption algorithm that is completely secure and isn't based on difficult computational algorithms? If such an algorithm exists, why we don't we use it in SSL/SSH?
3
votes
0answers
97 views

Can I make a digital time capsule? [closed]

Say I wanted to make a super awesome time capsule of some digital information. How would I encrypt it so that no one would be able to open it until a specified date? (E.g. 100 years from now.) At ...
0
votes
1answer
36 views

Secure Electronic Transaction (SET Protocol)

I've looked into the SET protocol and some of the information are outdated. Therefore, I would like to ask if the SET protocol uses 3DES or AES or just the DES and the RSA?
0
votes
0answers
18 views

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax a insecure setup for luks [duplicate]

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax insecure. If so why and what setup would be good for keeping corporate information safe?
1
vote
1answer
60 views

Timing side-channel attack example

I understand that timing side-channel attack is a measurement of time taken to execute cryptographic algorithms. I'd like to see a simple example that explains how timing attack takes a place on any ...
1
vote
1answer
62 views

What password based key derivation does PKCS #12 use?

I would like to make a note that I have read all of rfc 7292. I am trying to decrypt encrypted private key in a pkcs#12 pfx file. The private key is enveloped within pkcs#8 shrouded key bag. The ...
2
votes
3answers
310 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
4
votes
4answers
234 views

How can using multiple laptops improve security?

My being an admirer of Edward Snowden I've read several books about him. In each book and article there was said that he used four laptops in Hong Kong. Not for storing the documents, but because it ...
4
votes
0answers
687 views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
6
votes
1answer
287 views

Should veil framework produce packed and obfuscated binaries which bypass virustotal?

I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the ...
2
votes
3answers
2k views

Key Exchange using PKI

I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl openssl req -x509 -nodes ...
-2
votes
1answer
99 views

Turning hex string into readable chars [closed]

I have this blob of hex data which can be found on https://www.reddit.com/r/codes/comments/421xek/can_somebody_help_me_decode_this_blob/ and I am looking to turn it into ...
2
votes
2answers
117 views

Is encrypted cookie without authentication secure enough?

I have some sensitive data in the cookie, e.g. it contains the user id that is later on used to execute the query and we trust the cookie because it is encrypted. All communication happens only on ...
1
vote
2answers
79 views

plain FTP (no encryption)

Person A want to send important excel files to Person B using plain FTP (no encryption). Person A says the "issue with private key encryption is that its tough to maintain across the company. Sharing ...
1
vote
2answers
83 views

Banner grabbing OpenSSL versions with OpenSSL

With the recent news about a new OpenSSL vulnerability (affecting 1.0.2 only), I'm looking to conduct some research and I was wondering if there was an way to identify what version of OpenSSL a server ...
7
votes
2answers
299 views

Building a backdoor for full disk encryption

I have all my data encrypted on my laptop. All the backup hard drives are also encrypted. I know all the keys by heart and I could pick up any disk, enter the password and restore everything with it. ...