Tag Info

New answers tagged

0

Nice project but as usual you really should not reinvent the wheel. Writing such protocols for production use is a bad idea in almost every case. I recommend reading Bruce Schneier's Cryptography Engineering book. It is not a light read but would definitely clear out all your questions. First of all I think burning keys into executables is a terrible idea. ...


0

Fundamental to the question, is if the endpoint is not secured, keys, whatever they may be can be obtained, which is why for endpoint secure transactions, the terminal itself is under the aegis of the proprietor - eg. atms, cash points, etc.


1

You can't have a private key hard coded in software that is distributed. The two options I see are: Have each client generate a unique key-pair that they use for communicating with the server. Bob would send his public key to the server when he initially connects. The server will then encrypt messages to Bob with his public key. The first communication ...


0

I'm not a programmer but i think that if you don't want people having access to your code then you need to make it server-side, code executed in the client side, must be available not-encrypted on the client side at some point. This is exactly like DRM: you're giving the user a lock, and also the key to it, and expecting to be able to say what they can do ...


1

is it really necessary worrying about superusers? My gut feeling says no: in princible whathever the encryption method a superuser can read all the files and ultimately any kind of keys of the users; Kind of. Even if the file is encrypted and the decryption is only done within the process the superuser has on most systems access to the process memory ...


5

How fast can you crack AES-256? Either never (within next two centuries) or within days. AES-256 is considered incrackable by itself. Even most implementations are considered safe. (no side-channels). OTR protocol uses AES-128 (weaker than AES-256) as symmetric encryption algorithm and the world's best funded intelligence agency NSA wasn't able to decrypt ...


6

AES-256 is definitely secure for file storage. The only weakness is the key that you choose. As long as you choose a strong key for it, AES-256 will keep your files safe. According to this Wikipedia page, the best attack on AES was published in 2011 and to break AES-256, it still required 2^254.4 operations. The page further states that: This is a very ...


2

AES 256 is a standard of the US Government to protect their own files (FIPS 197). Yes, there are stronger methods and deeper cryptography and NIST is reviewing their standards and will upgrade to something stronger in the future, but for the average person, AES 256 will suffice as a strong encryption. Now the question will be: how will you handle the keys?


0

The segment size refers to how much plaintext is encrypted by the output of the AES encryption operation. AES has input and output in 128-bit blocks, and CFB mode converts the block cipher into a stream cipher using an IV, outputting 128-bits of stream at a time. In segmented modes, only a portion of that stream is used. For an 8-bit segment size, only the ...


3

I haven't tested OpenSSL but I'm pretty sure it implements AES-CBC correctly. Your program, however, obviously uses different data, so it isn't surprising that you get different results. The test vectors are given out in hexadecimal. For example KEY = 0000000000000000000000000000000000000000000000000000000000000000 IV = 00000000000000000000000000000000 ...


0

Any proper use of encryption will not store the key in a config file. While a hash might be stored, it's one way, so knowing the hash will not allow for recovery of the password, only that the entered password's hash matches the stored hash, and therefore the proper password was entered. You will need to use the original app as it most likely uses a ...


0

AES-256 is perfectly adequate (in fact, AES-128 is perfectly sufficient too, and arguably better according to some experts' opinion) to protect any data that you may have, provided that Your password is not only long (as you stated) but also not guessable. The software you use has no backdoor (Veracrypt to my knowledge doesn't have one). However, the ...


1

To answer your questions: Using serpent-twofish-aes only makes sense if you believe there is a cryptographic break which will work for one but not all three. Using this idea, if one is broken, the others will continue to protect your information. In order to be practical to decrypt your data assuming a model where the attacker has no known ...


0

If the module you're using is FIPS 140-2 validated I recommend you read the publicly available Security Policy. This as well as the product documentation should tell you if you are able to export the private key. The Security Policy is available here: http://csrc.nist.gov/groups/STM/cmvp/validation.html It could be that the module does not support AES key ...



Top 50 recent answers are included