Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

2
votes
4answers
153 views

How do malicious software encrypt victims' files?

Encrypting a file to me is take the contents of the file and dealings with it as a very long string, feed it into the hashing or encryption function to get an other long encrypted sting (or a hashing ...
1
vote
3answers
58 views

Best method for securing text based messages [on hold]

If I wanted to use a device for the sole purpose of sending and receiving text based messages, could it be done so that the messages from A to B are as secure as possible, the information is easily ...
1
vote
0answers
21 views

Reformatting drive from a GUID partition to an MBR partition [migrated]

I understand that Truecrypt is not compatible with an GUID partition but that is the limit of my knowledge. I am currently using a system that has a GUID partition but doesn't have bitlocker ...
2
votes
1answer
63 views

Why am I getting the message that Security Stack Exchange is only partially encrypted? [on hold]

I realize that this is an information website but it does concern me a bit that I'm getting the message that this website does not supply ownership information. Does this mean that my posts can be ...
-4
votes
1answer
44 views

Is it true that breaking into the https padlock settings on a web page is easy to do? [on hold]

I found some posts on this forum that explained that https settings are possible to crack. see here. Why is it possible to sniff an HTTPS / SSL request? And here is another post that mentions ...
4
votes
2answers
133 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
6
votes
3answers
5k views

Tool or Process to check for AES-NI support on processor?

In another question, Thomas' answer mentioned the AES-NI instruction set, which piqued my curiosity. Is there a tool or process available out there to check whether the instruction set is available ...
0
votes
2answers
74 views

Could a compromised root CA impersonate any SSL certificate?

My question is about MITM attacks against https and how those would appear to the end user. Suppose a trusted root CA were compromised / coerced into producing fraudulent SSL certificates. What would ...
10
votes
2answers
15k views

Do VPNs provide sufficient protection over public wireless networks?

I know that VPNs are the standard way to secure communication between a remote user and their primary network, but I've never felt entirely comfortable relying on them when using an open wireless ...
1
vote
1answer
181 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
1
vote
0answers
26 views

Understanding Key Serial Numbers (KSN) in Derived Unique Key Per Transaction (DUKPT)

I have a number of questions regarding Key Serial Numbers (KSNs) in DUKPT: KSNs are 8 - 10 bytes long. Older implementation are 8 bytes whereas newer ones are 10 bytes. Do I risk being incompatible ...
0
votes
0answers
15 views

Sharing Derived Unique Key Per Transaction (DUKPT) Base Derivation Key (BDK) with a partner

Assumptions: We have devices out in the field injected with keys derived from our one and only BDK. The devices encrypt data using the injected derived key. All our devices connect to our server ...
2
votes
0answers
11 views

Requirements Placed on a User of a FIPS 140-2 Validated System

Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be ...
20
votes
2answers
24k views

Is it possible to decrypt a satellite TV signal without using a smart card?

And if it is possible, why has it been decided to keep using a smart card for this task? I will be grateful if you can provide some practical examples on how to bypass the use of a smart card (if ...
1
vote
2answers
53 views

Methods to keep an autonomous log with high integrity

I'm writing a .NET desktop application that is used to send orders to a server via a REST API. To avoid leaking of our authentication token I have made it so that, when used for the first time, the ...
2
votes
1answer
123 views

Difference between fully homomorphic and semi-homomorphic encryption

What is the difference between fully homomorphic and semi-homomorphic encryption?
1
vote
1answer
857 views

Improving stateless REST API authentication token - or ditch it for database persistence?

I'm looking to implement stateless REST authentication into an API. I've been reading up on articles here, and have implemented an idea that works, but I was hoping to get some feedback on its ...
0
votes
1answer
35 views

Identify encryption algorithm for .enc files

I need to identify the encryption algorithm used to encrypt some files. I have the key, but I can't decrypt it using OpenSSL, because I don't know what algorithm was used to encrypt it. Is there any ...
1
vote
2answers
98 views

Is it feasible/possible to have encrypted data that looks unencrypted/innocuous?

i.e., could I send "Let's rob the store at 9 tonight" so that it is impossible to see what I'm saying, but it doesn't look like gibberish and obviously encrypted?
0
votes
1answer
31 views

Decrypting SSL traffic for Security Onion at or before the interface

I have Security Onion installed and doing full packet capture on my home network. I also have a firewall (pfSense) which does my routing. I have Security Onion sitting just behind my firewall and ...
4
votes
2answers
162 views

Is the same decryption key used for data on the server as locally with Lastpass?

Lastpass stores the password databases encrypted on the server. Does it give a database to anyone who asks? If no, then what authentication (i.e. password) is used? I use Lastpass on multiple devices ...
2
votes
3answers
95 views

Securely storing bank account details in database

I am developing a service that will involve the direct debit of customers' accounts on a routine (weekly, monthly, etc.) basis, and so I'll need to store their information (BSB/routing number and ...
2
votes
2answers
280 views

What is the problem with multiple encryption and how do you know if you have decrypted a cipher?

I have 2 questions that are somewhat related: 1. When you try and guess the key in a program (in a brute force way), how does the program know if it got it right and it had deciphered the message (I'm ...
3
votes
2answers
235 views

Multiple encrypted messages known to have matching (unknown) content

A recent discussion regarding ways to keep data secure through multiple iterations of a program's execution (with repeated read/write operations) raised a question regarding known-plaintext attacks ...
1
vote
1answer
32 views

Secure connection between two clients with shared secret

I am creating a system where there are multiple clients, each of which has a secure connection to a central server which could pass out shared secrets to each of them. I could be wrong, but I am ...
-3
votes
0answers
33 views

Can't encrypt email [on hold]

My friend has a problem described here: https://gpgtools.tenderapp.com/discussions/problems/18790-cannot-encrypt-an-email But the solution provided by this link did not work. What else can he try? ...
1
vote
1answer
53 views

Cloud-based IM protocols / services saving messages encrypted on server which is decryptable only by user? [on hold]

I am looking for a cloud-based (i.e. not end-to-end) secure IM protocol or service. The first one comes to my mind is telegram. Here is a quote from telegram's privacy policy: Cloud Chats ...
1
vote
1answer
120 views

Any way to revoke old key pair?

There is a many-year-old 1024 DSA key in the public keyservers under my name. There is a 2048 ELG-E subkey for it. I didn't create these keys, they were created for me by a former employer without my ...
2
votes
1answer
72 views

UEFI and security implications for encryption

After my old PC kicked the bucket I now own my first UEFI board and I am already having trust issues. I utilized Truecrypt's system encryption for years now and really got used to it. My new board has ...
7
votes
2answers
359 views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
0
votes
1answer
43 views

VPN and authorization [closed]

I wonder, if one should implement two factor authorization and encryption in a client-server solution, how is it done? Of course there can be many ways but some examples would be great. I imagine the ...
2
votes
2answers
399 views

No HTTPS on credit card entry form - can it be safe?

I was going to make a purchase on a website, but the page containing the credit card entry form is served via HTTP and not HTTPS. Is it definitely unsafe? The website advertises the use of ...
1
vote
1answer
23 views

Is it possible to assign different UIDs to subkeys for the purpose of having multiple identities?

Many people advocate generating new primary keys for each identity they wish to have. For example, creating one primary key and associated subkeys for workplace use, and a completely different ...
0
votes
2answers
323 views

Which default encryption does OpenSSL use?

If I create a private key via: openssl req -x509 -newkey rsa:2048 -out cert.crt then OpenSSL writes the private key to the file privkey.pem and if you do not provide the -nodes parameter it will ...
0
votes
1answer
43 views

How to securely derive a second password specific to an user

I'm giving each of my users an unique Blocktrail wallet that is protected by two API keys (which the server knows) and one passphrase (unique to each wallet). I want the wallet's passphrase to be ...
1
vote
1answer
26 views

Machine readable, user non-readable - XML file

I need some advice as I have been unable to find anything useful via the web - (Google search). I have used the application EventGhost so as to create a custom shell, that I run using the Windows 7 ...
35
votes
3answers
36k views

Is 7-Zip's AES encryption just as secure as TrueCrypt's version?

The main difference being TrueCrypt creates containers and 7-Zip encrypts the file itself, so file sizes can be guessed. Now let's just talk about the strength and breakability of the encryption. ...
4
votes
4answers
9k views

Is diskcryptor really secure?

Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, ...
5
votes
2answers
144 views

How to securely store application data on mobile device

How can security be enhanced to the maximum in a messaging app storing messaging history on the device (like whatsapp)? I am specifically referring to methods to minimize the risk of the data being ...
2
votes
1answer
40 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
0
votes
0answers
21 views

Create Incremental/complete backups from a disk encrypted using TrueCrypt? [migrated]

I have a tricky question about whole disk encryption and its backups particularly TrueCrypt for which I have never found a great answer What method do you recommend/use for create automatic backups ...
0
votes
1answer
21 views

Evaluating encryption/promised anonymity of message service [closed]

This is a question that in my opinion should be able to be generally answered, and not just discussed. I therefore hope some discussion will lead up to a straight answer. Scenario: A website X ...
2
votes
1answer
49 views

GPG: Can't encrypt DSA 3072 keys

I would like to ask this question as I'm not the first person which has this behavior. I'm trying to encrypt a simple message using GnuPG using a public key I've received from a friend, he's using ...
1
vote
1answer
71 views

How to determine if mail was encrypted during transport using the header information?

First things first: I know about the difference between end-to-end-encryption and transport encryption. Back to topic: I already read some things about how mail server handle transport encryption, ...
2
votes
2answers
202 views

My Virgin Media account password is visible in plaintext to call center staff. What do I do?

Whilst on the phone to support staff (about billing) to Virgin Media, perhaps the largest ISP and telecoms company in the UK, I was asked to confirm my password over the phone. I asked the advisor ...
3
votes
1answer
193 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
1answer
257 views

Klein and PTW wep attack

I'm working on an implementation of Klein's wep attack. For that, I've set up a router with wep encryption and collected 50,000 unique IVs from it. I tried only calculating K[0], meaning - the first ...
1
vote
1answer
80 views

Check HMAC after completing decryption or before?

I have written a piece of software that symmetrically encrypts big files (multi-megabyte). Plaintext is encrypted, after the encryption the HMAC is calculated and written into the header of the file. ...
3
votes
1answer
94 views

RC4 encryption of torrents safely

Torrent clients offer encryption of traffic using RC4, and people consider this very safe to hide traffic information from ISP. Now since I have a website with SSL encryption, I know that RC4 has a ...
1
vote
2answers
150 views

Is there a way to securely store unsalted passwords?

So, obviously I'm not talking about username/password pairs here, I plan to store passwords with two salts and three hashes, but what occurred to me is that if I had a table where I kept pairs: ...