Tag Info

New answers tagged

4

You should be worrying about secure storage of the AES key, not about breaking up the data. If the key is compromised, it really won't make any difference what you've done with the data because Kerckhoffs's principle. Edited to add: Most especially, you must not store the AES key in the same database that holds the encrypted data because a database ...


0

Well for the project I selected XBC (cross block chaining) scheme which was submitted to NIST this year in may. It was difficult to find a scheme for which security analysis had not been done.. we had few resources to our avail..NIST site, RFCs submitted over the years, security conferences... We had to look at almost every paper for security analysis of the ...


1

May I suggest that you rethink your approach to this problem. Where are you storing the data? If it's in a database most databases have the ability to encrypt data at rest fairly securely. Does the data need to move over an insecure channel? Look into the HTTPS or secure FTP. Don't mess with crypto unless you absolutely have too. It's extremely easy to ...


26

You are doing it wrong. Not in the splitting or whatever; but in the thinking. AES encryption, if done properly, won't be "cracked". AES is the most robust piece in your system; this is the last part of it that you should be worrying about. What AES encryption provides is a very specific functionality: using a given key K, it transforms a piece of data (the ...


0

Symmetric ciphers (even those described as "block ciphers") are usually used in a stream-like fashion, encrypting or decrypting a sequence of bytes of arbitrary length. Consequently, measuring their speed in MB/s is a useful thing to do. Asymmetric ciphers are usually used in a block-like fashion, encrypting or decrypting a single small piece of data. ...


1

if you jump to ~10:00 in this presentation they actually appear to outline how they can perform integer factorization using quantum annealing and at ~12:10 they can produce a D-Wave machine (maybe as an NSA special order) that can factor 2n bit number with 2n^2 qubits. First he describes that you can describe RSA as an optimization problem. But you can ...


-3

In asymmetric encryption with public key cryptography, there is an exchange of public keys which could be intercepted by a man-in-the-middle. That is a major weakness, which symmetric encryption doesn't have. Since the US government is doing mass-surveillance, there's a real possibility that MIM is commonplace. Using predetermined keys with symmetric ...


1

If someone can steal your encrypted key, then they can read your private files: chances are they can execute code into your machine and sniff your key password (however strong). A GnuPG smartcard with an external keypad protects both the card and the password. Edit: did you try cipher-algo AES512? Addedd strength is probably superfluous, but the added ...


8

The amount of human effort which has gone into computing each of those SHA-1 hashes found in Git is significant. And that means the number of hashes computed that way is fairly limited. If you want to find collisions, you need zero human effort per hash and very little computer time spend on each hash. Bitcoin might be the only system with enough computing ...


12

You could probably compute your own SHA1 hashes quicker from small arbitrary texts than that you harvest the hashes that someone else computed. But there's a lot of possible SHA1 digests, like a few for each atom in the universe and still some left. That illustrates the challenge if you want to keep a list of all known digests and search that list.


48

Is Git crowdsourcing the production of SHA-1 preimages? Not to any meaningful degree. Github doesn't say how many commits it's tracking, but it's probably not more than a few billion. For comparison, there are 1,461,501,637,330,902,918,203,684,832,716,283,019,655,932,542,976 possible SHA-1 hashes, so the odds of finding a plaintext matching an arbitrary ...


3

Some vendors sell systems that work like you describe. The biggest problem is lack of active cooperation from vendors; there is no reliable way to build a list of hashes of "allowed binaries" since: What looks like "an application" from the user's point of view may be a collection of many executable files (to a large extent, that's what DLL are). Any ...


0

Passwords and keys are two distinct items. For example, when we hire new employees, and they need access to Unix based systems, we deploy ssh keys for them so there is no password is involved. If/when they leave, we revoke the keys. The need to manage any password they’d have is a moot point since we could reset the password. Splitting a password is a ...


13

With most file formats it is not difficult to identify the original filetype without knowing the original extension. A JPEG file, for example, always begins with the HEX sequence FFD8FF. Seeing that sequence at the beginning of a file tells you that it is very likely a renamed JPEG image. There are tools available which detect many common file formats ...


11

This is in no way shape form of fashion secure. It's akin to taking money from out of the mattress and placing it in the cookie jar. Let's illustrate what you said in five steps hades$ ls -ltha example.jpg -rw-r--r--@ 1 hades wheel 586K Dec 8 11:28 example.jpg hades$ md5 example.jpg MD5 (example.jpg) = a7ecc5e48db6cbfd609b9c6c6ca9b21f hades$ mv ...


4

A youtube video from Defcon 21: http://youtu.be/NG9Cg_vBKOg?t=6m19s The guy being investigated simply changed the extensions of the files (eg. from test.jpeg to test.txt). However when the crypto guys look at it their tool detects that the extensions don't match the files and these files are the first to be examined more closely by a human.


44

What you are doing is no kind of encryption, it is just obfuscation. It relies on security by obscurity. It may be enough to hide your files from an amateur/casual observer, but anyone analyzing the files in a hex editor is going to be able to rebuild and access them. Effectively your method is about equal in complexity to attempting file undeletion, for ...


1

Hybrid Encryption Systems OpenPGP defines a hybrid encryption system, which combines the best of both asymmetric (public key) encryption and symmetric encryption. While asymmetric encryption is great at key management, it is very slow for encrypting large amounts of data; symmetric encryption on the other hand would require exchanging keys with everybody ...


3

Because the entire message is not encrypted separately for each recipient. Instead, a single symmetric encryption key is chosen at random, the message is encrypted once using that key, and then the encryption key is itself encrypted separately for each recipient, using that recipient's public key, and appended to the encrypted message. Each recipient ...


0

I´m not sure if I´m understanding correctly but I´ve seen systems that generate a random token on the client which is then entered on a remote server which validates token authenticity and in turn generates a second token, this second token is entered again on the client (or wherever the information you want to recover is) which now allows for a password ...


0

I think a password manager is honestly your best bet here if it is just you who is in control of these passwords. You can store passwords within an encrypted password database file. This file can be stored in the cloud, on a USB you give to a friend, and on your local/work computer. All you need to keep or have is a strong passphrase for the database and ...


1

Clarifications: If I understand you correctly you are interested in including the order a password is typed within the data needed to use it correctly. For example if my password is typed out in order like this: 'p' 'a' 's' 's' 'w' 'o' 'r' 'd' It would not work if someone typed 'w' 'o' 'r' 'd' and then clicked to the beginning and typed 'p' 'a' 's' 's'. ...


12

Nope Generally speaking: No. Hashing is not encryption. Hashing is not reversible. At all. It always generates a fixed length output. So with an output fixed to say 32 characters, and an input of 33 characters, there is no possible way to reverse this. The information of that one character is irretrievably lost. -- And along with it all other characters. ...


0

As others have stated thats a block cipher. Its ok to experiment with your own ideas and techniques. It can be fun! Just don't put your experiments into production. Other people that are way smarter than you or I can probably defeat your protection. Go check out modes of operation for block ciphers, identify the mode most closely related to yours, and ...


5

First don't roll your own crypto and read DTK answer. But, I do believe that we learn by experimenting so I will answer your questions Does there already exist a similar two-way function? Yes. They are called block cipher and come with different mode of operation. The block cipher is a function that encrypt the data for 1 particular block. In your ...


9

There are several reasons why this would be a sub-optimal security scheme. Here are a few: The biggest issue with secure passwords is our memory, or our limited capacity for remembering passwords. We're pushing our memory limits as it is, and always working to devise new tricks to help better remember more secure passwords. This scheme introduces new ...


7

Read Shannon's 1949 work. Understand diffusion and confusion. Then understand that you do not understand enough *YET* about set theory, probability and linear maths to know that you don't have enough background to design or implement an enciphering algorithm. Read Dunning-Kruger effect while you are at it, but please keep learning, so that some day you will ...


0

If you mean "trust" in the communications sense, you're defending against man-in-the-middle attacks, and that means using HTTPS. For bonus trust, use certificate pinning in the mobile app. If you mean "trust" in the "server wants to ensure that the client has authenticated" sense, you should read more about OAuth. The short of it is that Your user will ...


0

If the purpose of using encryption is simply the amusement of the persons communicating and the communications have no value, then it is not a problem. However, obscurity of the ciphersystem is not a good protection for a communication that has value if it is either surreptitiously read or modified. Put simply, the reason those ciphersystems are no longer ...


-2

While the answers above are mostly correct, there are exceptions. As mentioned, the One Time Pad is uncrackable, if used correctly (completely randomized text in pads, no pad re-used, pads destroyed after use and kept 100% secure at all times). When someone says that the OTP has been cracked, read the fine print and you will find a physical security problem ...


0

You don't say what your application is, but you could consider having a dedicated back-end server used to verify pins. You can then restrict access to that server more than you can for the front-end web server. You can implement restrictions such as rate-limiting on the pin-checking server so that even if the front-end server gets taken over by an attacker ...


5

The number one problem with the scheme you've proposed is that you've completely ignored secure key exchange. The next problem is that the output isn't going to be anything like random as Iserni pointed out and is therefore susceptible to a number of attacks. The next problem after that is that it isn't authenticated, which can lead to ciphertext ...


8

I'd like to implement some kind of simple (yet as strong as possible) encryption > for my client-server application network traffic. Data to be encrypted can be both textual, and binary. You're implementing a modified Vigenère cipher. That might be a problem in that any sufficiently large sequence of repetitive data (with binary zeroes being the most ...


0

You're basically talking about implementing a "one time pad" - (with some modifications). To do a one-time pad right, you would need to: ensure there is sufficient random data (which is basically the key); it needs to have cryptographically strong random properties; you need to distribute this key securely to all parties who need to decrypt it; you ...


3

No, most cryptographic methods that are considered secure are based around assuming every computer in the world is working on the problem non-stop and it still takes to the heat death of the universe. Sure it could be used to break less secure encryption, and in fact, using a super computer to crack such weak keys is effectively the same thing as using a ...


2

For "symmetric cryptographic algorithms" (symmetric encryption, MAC...), things are simple: a non-broken cryptographic algorithm is such that it uses an n-bit key, and the fastest method to find the key is trying out all possible keys until the right one is found (that is called exhaustive search or brute force). The algorithm is said "non-broken" precisely ...



Top 50 recent answers are included