Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

10
votes
2answers
10k views

Is it possible to use S/MIME in the web client of Gmail?

I could not find any options in the web interface of Gmail. All I could find was a Firefox plugin to use S/MIME with Gmail, but it seems to be outdated.
2
votes
1answer
52 views

How to securely derive a second password specific to an user

I'm giving each of my users an unique Blocktrail wallet that is protected by two API keys (which the server knows) and one passphrase (unique to each wallet). I want the wallet's passphrase to be ...
0
votes
1answer
25 views

Use RSA Encryption With ASP.NET

My goal is to implement asymmetric encryption in an ASP.NET website to secure user-entered Social Security Numbers. I want to encrypt the SSNs with a public key, and only display a masked version, to ...
3
votes
0answers
37 views

How to really treat security between peers in WebRTC

Recently I've been implementing WebRTC in my project and would like to add security and privacy to the couple. I then decided to search on and found something if it is really necessary to impose ...
0
votes
2answers
55 views

Safety of Encryption Keys

I'm trying to figure out the best way to encrypt passwords for a forums site I'm working on. I've decided I'm going to use an encryption such as blowfish. From my understanding, you have a key, and ...
5
votes
2answers
819 views

In a browser web server communication, who decides which encryption protocol to use [duplicate]

My IE browser has SSLv3.0, TLS 1.0,1.1 and 1.2 enabled in the advanced settings. And (I was informed by my server admin) my web server can encrypt data in SSLv3.0 and TLS 1.0 Now which system ...
2
votes
1answer
81 views

how do we encrypt 100bits of plain text to get 100bits cypher text using DES?

We have a scenario like that we need to encrypt 100 bits of plain text using encryption algorithm like DES (algorithm takes 64bits plain text block and generate 64 bits of cypher text block, key using ...
2
votes
2answers
207 views

Is it okay if passphrases to KDFs are “predictable”

I'm looking to do file encryption for small amounts of text (8-100 characters for each item being encrypted). Here's what I have: A secret passphrase and a salt. I Use Rijndael to generate a key and ...
2
votes
1answer
50 views

Are TLS session keys cached in a browser?

For example, when authenticating to a TLS protected service, and then closing the tab, you can sometimes reconnect to the service afterwards without re-authenticating. In preservation of perfect ...
6
votes
2answers
122 views

Decrypting arbitrary offset of encrypted file

I want to store encrypted files on some storage backend that allows me to fetch bytes X through Y of the encrypted file. I can obviously decrypt the entire file locally and send it back to the client. ...
3
votes
3answers
90 views

How do browsers negotiate SSL/TLS connection parameters?

For the purpose of this question, let assume that an SSL/TLS connection has 4 parameters: protocol, symmetric encryption method, asymmetric encryption method, MAC. During the negotiation of SSL ...
37
votes
9answers
4k views

Is full disk encryption on a server in a secure data center pointless?

I am having a debate with several people regarding how much protection full disk encryption provides. dm-crypt is being used to encrypt data which is required by my company to be encrypted at rest. ...
-3
votes
1answer
102 views

Is it possible for someone to read Gmail messages with a man in the middle? [duplicate]

Assuming these hypotheses: 1) Your account isn't hacked (hacker has not entered your account directly) 2) Gmail encrypts via SSL end-to-end 3) The hacker is not Gmail or Google 4) There is no ...
11
votes
4answers
780 views

How can I decrypt my files from “Cryptowall” encryption? [duplicate]

I just got infected with "Crypt0L0cker" malware,virus or whatever that might be. They gave me a link (http://bica3zjnvl6fxkqf.tor-area.org/jrrk14.php?%20user_code=94aya99&user_pass=2616, the ...
2
votes
2answers
49 views

Authenticated encryption (Symmetric encryption) for .NET applications [on hold]

Is there an implementation of Authenticated encryption for .NET applications? The AES API from .NET does not include mode such as GCM. In the documentation, I can only see insecure modes (ECB, CBC, ...
-1
votes
0answers
16 views

is there a signature scheme for cramer-shoup cryptosystem? [migrated]

I have a project that I have to use cryptosystem and signature scheme for it, so I've read about cramer-shoup cryptosystem and I want to use it since it is more secure the elgamal cryptosystem, but, I ...
4
votes
2answers
148 views

Why is Chrome saying that “TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)” is an obsolete cipher suite?

When I go to this site, Chrome Version 44.0.2403.89 is connecting to the server with TLS_RSA_WITH_AES_128_CBC_SHA (0x2f), and it states that this is an "obsolete cipher suite". For what reason is it ...
7
votes
1answer
232 views

Linux Plausibly Deniable File System

Is there any way to encrypt a linux filesystem in such a way to maintain plausible deniability? E.g. "Hidden OS support," the way Truecrypt and Veracrypt work, they only support Windows OS due to low ...
1
vote
0answers
39 views

Can high network usage be detected and prevented in Tor? [on hold]

I've already asked this question here but as of yet it has no views/answers. I was wondering if there is any way for Tor to detect high network usage in the context of transferring large files using ...
3
votes
2answers
76 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
20
votes
1answer
622 views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
1
vote
0answers
38 views

Biometric device instead of password - signature security

Lets assume that there is a biometric algorithm for user authentication which compares fingerprints with an user's signature saved in database (comparing function is not important here). Next there is ...
0
votes
2answers
64 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
0
votes
2answers
73 views

Do modern cryptographers / cryptoanalytics need the knowledge of historical cryptography

It makes a lot of sense for people to know the history of their profession from various points of view and I suppose especially in cryptography because people can still use old ciphers and no one ...
2
votes
1answer
62 views

GPG: Can't encrypt DSA 3072 keys

I would like to ask this question as I'm not the first person which has this behavior. I'm trying to encrypt a simple message using GnuPG using a public key I've received from a friend, he's using ...
-2
votes
1answer
29 views

Attack on Androids Encryption called FROST

http://www.extremetech.com/computing/150536-how-to-bypass-an-android-smartphones-encryption-and-security-put-it-in-the-freezer I read this article about FROST and in the comments someone was stating ...
6
votes
1answer
77 views

Is there any reason to use AesManaged over DPAPI in this scenario?

I have a situation where my web application is going to be deployed on multiple web servers, and I'll be wanting to store some securely encrypted data on the DB servers (each web server has a DB ...
-1
votes
1answer
29 views

Best way to store client side Encryption keys

I have different client applications running on different OS (iOS, Android, Windows Desktop, Windows Phone, Mac, Windows Store -All Native Apps-) I have to decrypt (AES-128) some files (thousands of ...
3
votes
1answer
210 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
1answer
278 views

Klein and PTW wep attack

I'm working on an implementation of Klein's wep attack. For that, I've set up a router with wep encryption and collected 50,000 unique IVs from it. I tried only calculating K[0], meaning - the first ...
2
votes
1answer
44 views

Encryption of settings/credentials in mobile apps - what threats does this protect against?

I have been decompiling Android apps recently. In a sample of 37 apps, 12 of these use some form of custom encryption/obfuscation to store settings and credentials on the device. By necessity, the ...
60
votes
7answers
17k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
1
vote
1answer
61 views

Secure Software Architecture

I am designing a software architecture and i need some suggestion and clarification on few issues. This will be a server side RESTfull API for accessing data and multiple mobile/desktop client to ...
-2
votes
2answers
171 views

Cryptowall encryption files

This is a question concerning the way the Cryptowall ransomware encrypts files on the victim's computer. Someone knows if it is possible to recover the encryption key comparing the encrypted file and ...
1
vote
0answers
43 views

Is there anything to worry about — worth putting security on a simple test site?

So I want to make a site, this site won't have users (so no one but me will be able to post to the site) or anything it will just echo out items from Mysql like title and text-body I was wondering if ...
0
votes
2answers
60 views

Content on a usb flash drive available for a limited time [closed]

I need to distribute some content on a USB flash drive. This content should be available for a limited time only. I am looking for some approach to achieve above. So far I do not have information ...
12
votes
6answers
4k views

Is (safe) encryption over compromised line impossible?

I realize something like this would be the holy grail of communications security and have never heard anything to suggest it has been done. Am just wondering. A lot of mathematicians and computer ...
-3
votes
0answers
79 views

Ph.D in Netwok Security? [closed]

I'm already Cisco Network Support Engineer and cleared CCNA Exam . I wanna to start my PhD in network security. What kind of programming skills(Java,c++, Erlang) are required to gain before join PhD ...
3
votes
1answer
90 views

Securing administration network

We would like to secure our administration network from advanced persistant threats and also from rogue administrators. I have already read the best practices from SANS Institute, NSA or other guides. ...
4
votes
2answers
84 views

What encryption and signature systems (don't?) allow for plausible deniability of the OP's key being used?

I need to prevent Mallory from blindly matching encryption and signing keys to messages Hypothetical scenario: A user creates a public key An encrypted or signed payload exists. With only public ...
3
votes
2answers
52 views

Saving Authentication Tokens to Third-Party Websites

So Flickr allows you to authenticate users to your app via app_key and secret and returns an authentication token. I want to securely save that authentication token in my database, but also be able to ...
1
vote
2answers
102 views

Could I ever be legally required to decrpyt user information? [closed]

Suppose I host some web app which stores information about its users. In the interest of confidentiality, that information is stored in an encrypted format. Under what circumstances could a legal ...
-1
votes
0answers
40 views

What software ISPs (or else) use for DPI? [closed]

I am wondering what type of software or what exact product Internet Service Providers (ISP) all around the world can use for Deep Packet Inspection (DPI) purposes? As i understand DPI, this is a ...
1
vote
2answers
161 views

Why do I have to use multiple keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
3
votes
4answers
136 views

How safe is password based key derivation in the case of long password?

I am encrypting files inside a device and store it. So I need to maintain the same key throughout the life cycle of the device. For key derivation I use EVP_bytestokey() of OpenSSL. The problem in ...
0
votes
1answer
74 views

I need to transfer user's private key (RSA) to my App. Is file sharing a good solution?

I've asked a similar question here earlier iOS: Is it ok to store a RSA private key (use to decrypt text) in your application document directory? However, the person recommend me to use keychain ...
1
vote
1answer
34 views

Key derivation inside secure container of HSM

I have to implement custom key derivation function which basically works as follows: I have encryption key K in secure container of HSM. K can't be exported and the only way how to use it is through ...
3
votes
1answer
47 views

Cipher usage by end users and browsers

How do I check in apache logs as to what cipher end users / browsers are using ? Are there other tools to achieve the same to get a result in percentage ? related link: How can I determine the ...
3
votes
1answer
91 views

Are there any passwords managers that use a second hidden encryption drive to hide passwords?

I've heard that encyption program, Truecrypt can create a hidden encrypted drive within an encrypted drive; and even if an attacker accesses the first encrypted drive he/she cannot prove the hidden ...
4
votes
1answer
131 views

Sending Encrypted Messages with Hybrid RSA, AES and HMAC SHA-256

Is this a Secure strategy for sending a large Encrypted Message using Hybrid RSA 2048, AES 256 and authenticated with HMAC SHA-256: Given the Alice already has Bob's RSA Public Key, Alice: ...