Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

1
vote
1answer
18 views

wpa_passphrase command encrpyting psk

Does the wpa_passphrase command turn an ASCII string into hexadecimal and what is the benefit of doing so? Is the psk sent in the header of packets? Can it be easy to sniff if it's in a string format? ...
0
votes
2answers
95 views

As a user, is using MD5-encrypted passwords on websites a good practice?

Disclaimer: This is from a user standpoint. We'll thus assume the target website (say, Paypal or Netflix) already uses a strong hashing algorithm with salts (bcrypt of pbkdf2, for example) and accepts ...
2
votes
4answers
4k views

Understanding AirCrack output in Backtrack 5

First let me clarify that I was trying to crack WPA2 in my home for educational purposes. I followed some tutorials and the message I received was: key found! [ilovegod] I know that this is not ...
4
votes
3answers
860 views

How to store passwords in a text file in USB securely?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
0
votes
0answers
19 views

Level of security TPM2.0

How secure is it to seal only to PCRs 0 and PCRs 2-7 with fTPM 2.0? My device does not support Intel TXT, so I am unable to extend the chain of trust to implement DRTM, and thus cannot use PCRs 17-22....
0
votes
0answers
10 views

How can I decrypt data stored using the android KeyChain API? [migrated]

I have an android application that stores secrets using the KeyChain API. I have root access, and I know all of the credentials for the device. I should theoretically be able to decrypt the files ...
2
votes
2answers
158 views

number of ciphertext-plaintext pairs needed in double encryption

So I know in single encryption you would simply require at least 1 pair of plaintext-ciphertext, to carry out an exhaustive key search; you continue trying different keys until one is found that ...
4
votes
4answers
563 views

UEFI and security implications for encryption

After my old PC kicked the bucket I now own my first UEFI board and I am already having trust issues. I utilized Truecrypt's system encryption for years now and really got used to it. My new board has ...
15
votes
3answers
2k views

How secure is “Firefox Hello”?

The new "Firefox Hello" feature promises easy and safe video conversation. It is not nescessary to create an account, you simply share a link with your partner to start the conversation. The ...
2
votes
1answer
256 views

access to mounted luks partition by non-root user

Recently I searched substitute for truecrypt and played a bit with cryptsetup. The steps I did: mkfs -t ext4 /dev/sdb1 sudo cryptsetup open --type luks /dev/sdb1 enc_vol sudo mount /dev/mapper/...
3
votes
1answer
35 views

Security of “secure messaging” services

There are multiple vendors that offer so-called "secure messaging" services, designed to allow secure e-mail without the need for technology such as PGP, S/MIME or strict TLS between mail servers. The ...
0
votes
1answer
29 views

Is it possible using a file level encryption in addition to TDE in Microsoft SharePoint?

For Microsoft SharePoint, TDE is a great encryption solution to keep databases encrypted. I've tried to find a possible solution to encrypt the files once more using an other level of encryption on ...
-3
votes
0answers
30 views

How to achieve end-to-end security in a Browser-Server architecture?

Let's assume a typical web application with a back-end and a front-end(e.g. a MVC framework using PHP or Python). As far as I have studied and please correct me if I am wrong, it is not a typical ...
3
votes
1answer
73 views

Recommended Crypto Security Setup (Implemented Algorithms)?

Firstly I'm not a crypto expert, however I know how to use algorithms that other people have defined before in practical usages, that is, as long as they live up to their promises. The thing is that ...
-4
votes
0answers
220 views

Reverse the encryption (part of the Labyrnith ctf challenge) [on hold]

So my friend and I were trying to do this ctf challenge here http://labyrenth.com/ and when we were trying to solve the first part of the "Threat" challenges we stumbled upon a challenge we have no ...
1
vote
0answers
50 views

Create reduction functions in rainbow tables

I have been trying to understand rainbow tables lately and one part is giving me trouble to understand here. Let's say I want to generate a table where the chains are 100 000 hash/plaintext long. I ...
12
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
2
votes
1answer
89 views

How well does FDE protect against disk firmware malware?

In early 2015 news broke that the NSA was installing firmware backdoors in many hard drives. I was wondering, if there was a BIOS and Hard Drive backdoor how well would full disk encryption protect ...
82
votes
9answers
16k views

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

I don't have any experience or scientific knowledge in security, I just wanted to ask if this is possible because I am interested in it. What if I encrypt data and every password decrypts it, but ...
10
votes
2answers
2k views

Why is plain dm-crypt only recommended for experts?

I am curious about the following claim from the Cryptsetup FAQ: 2.4 What is the difference between "plain" and LUKS format? First, unless you happen to understand the cryptographic background ...
0
votes
0answers
22 views

Which symmetric encryption method does PGP use for its hybrid-method?

I'm doing some research on PGP for a class-assignment. I've tried to find out which exact implementation PGP uses for its symmetric encryption part. Finding out about RSA as the asymmetric one was ...
7
votes
2answers
158 views

How can I encrypt my print jobs?

I often print confidential documents over a large intranet to various printers based on where I am in the building. However, since the building is so large, it is highly likely there is a malicious ...
0
votes
1answer
69 views

Securing data passed between two sites via a browser

I need to pass some data securely from one web site to another via a browser. A user visits site A and clicks a link there which takes him to site B; this could be just a link which would produce GET ...
2
votes
0answers
18 views

Mixing Off-The-Record and classic SSL

I am developing some pubsub system on top of Node.js and Socket.io. I decided to implement Off-The-Record (OTR) encryption by default for all of data transfers between clients and server(s). Question ...
3
votes
2answers
800 views

Protecting decryption key on server

What is the most suitable way to encrypt and decrypt sensitive data on a public cloud server disk without storing the decryption key on the server in plaintext? REQUIREMENTS In our SaaS web/mobile ...
1
vote
1answer
63 views

Key rotation benefits of a multi-key hierarchy

I think I have a decent grasp of the problems associated with key rotation, and as I'm working through them determining an approach for key management on an application I keep stumbling up against ...
0
votes
0answers
22 views

Does the CASB protect cloud applications and its data end-to-end? [closed]

CASB definition from Gartner site is here. From its definition, one can see the CASB covers most of enterprise security requirements which are mandatory on any deployments (cloud or on-premise). ...
0
votes
1answer
490 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
2
votes
2answers
78 views

Is there such a thing as application-specific encryption?

I am looking for a way to encrypt certain files (.jpg, .pdf, standard file extensions) such that they can only be opened by a certain application (assuming this application will have the relevant file ...
5
votes
3answers
2k views

Digital Signature and Verification?

AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it. So public key is used to decrypt ...
1
vote
2answers
918 views

Is SSH secure and what are the recommended modes of operation?

Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH? It seems there has been very little discussion ...
0
votes
0answers
12 views

Advantages and disadvantages of two-party ECDSA [closed]

I have to study two-party ECDSA and evaluate it. I understand how it works, it uses paillier crypto system and that affects its performance. I need to evaluate it more precisely, so can you explain ...
0
votes
1answer
57 views

What is the weakness/Flaw in ransomware that security researchers use to make a decrypter? [closed]

I have question about the weakness/Flaw in ransomware. From reading the write-up of security researchers who find a weakness/Flaw in ransomware I know that to make a decrypter researchers should find ...
10
votes
3answers
3k views

Suitable cipher for SMS encryption

I would like to create application for encrypting SMS messages. After long enough discussions I decided to use symmetric encryption, since handling public/private keys issue is too difficult for most ...
0
votes
0answers
18 views

Reuse key to encrypt signed content

I am developing an application which generates JWT tokens which are signed using HMAC-SHA256 algorithm during their generation and later on encrypted using Fernet library. Since the signing and the ...
0
votes
1answer
79 views

Should the password be stored in a variable before encryption?

I am currently writing an App using CodenameOne, and there is a login screen, where the user needs to insert their account and password. Now I was wondering, what would be the best way to access the ...
67
votes
5answers
20k views

Why should one not use the same asymmetric key for encryption as they do for signing?

In an answer to a question about RSA and PGP, PulpSpy noted this: It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both)....
4
votes
4answers
756 views

encryption vs access control comparison

I have a very basic and simple question about two security concepts. Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
2
votes
1answer
108 views

In postgres LDAP authentication, are passwords encrypted?

I am wondering if postgres LDAP login is secure? Would passwords be transmitted in clear text potentially if this is not set up properly?
-1
votes
2answers
71 views

How does digital signature algorithms work in a private / public key environment?

From the Wikipedia page on the subject, I get, on a theoretical level, how the process of encrypting and decrypting a message works. The article states that: In a public-key encryption system, any ...
0
votes
1answer
162 views

Encrypt password with salt

Can anyone explain why formula 1 is safer than formula 2?I don't get it even I get the answer. According to 2, it says as s is in plaintext form, the attacker can decrypt the password by (y.s). Isn'...
-2
votes
1answer
177 views

How does the “emergency access” feature of LastPass work?

How does the "emergency access" feature of LastPass work? I can't find detailed information about the used cryptographic methods. How can I be sure that LastPass is not keeping a copy of my master-...
0
votes
0answers
35 views

Encrypt input data file

I have a program in C which reads data from several text files. I want to "obfuscate" its content to the user : I don't have a strong constraint in terms of security, I just want the user not to be ...
8
votes
3answers
608 views

How secure is HTTPS with weak ciphersuites?

Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
2
votes
1answer
171 views

How to enable ECDHE in openjdk-1.8.0 in CentOS 6.7?

I have seen many posts that hinted ECDHE is available in the SunEC provider way back in openjdk-1.6.0. My environment: CentOS 6.7 with openjdk 1.8.0.71-1.b15.el6_7. No ECDHE. Made 2 changes in jre/...
0
votes
1answer
155 views

How to securely send bank details to someone?

I have completed my internship and my employer wants me send him my bank account details so that he can transfer me my stipend. How can I securely do this? I have Ubuntu MATE 16.04. My employer is not ...
11
votes
3answers
1k views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
3
votes
2answers
485 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
4
votes
1answer
188 views

Should SHA-1 be used with RSA-OAEP?

PKCS#1 defines SHA1 as a default hash function and all implementations support this hash function and the mask generation functions based on SHA1. In some implementations you can change the hash ...
1
vote
1answer
45 views

How can we serve sensitive encryped data without storing the key? Should I use user-defined passwords for keys?

System Background Sensitive data must be stored (i.e. Credit Card number or SSN) in the system for a notable period of time, to serve ongoing operation of the company. Anyone can insert sensitive ...