Hot answers tagged

95

Yes, it's called One Time Pad and we don't use it in SSL/TLS because key-exchange is problematic at scale.


34

The only theoretical algorithm that can fulfill that is OTP, one-time pad. See the question How is the One Time Pad (OTP) perfectly secure?. We don't use it in anything common for a few reasons: Its security depends on having as much truly random data as we have data to transmit, and that random data has already been sent to both parties securely, and is ...


3

In fact, the one-time pad (OTP) encryption technique is the only proven unbreakable encryption system. It is simple to use, it only uses the XOR operation, and is so secure that the ciphertext is literally uncrackable if done correctly. The dark side is that it requires a lot of pre-shared data which gets used up as you encrypt data. When you run out, you ...


2

In some versions of GPG, the default KDF is PBKDF-SHA1, which will result in a 160-bit key, I am unsure what the default KDF is for each version, however their website man page says it is RIPEMD-160 (for the current version I assume). You can change the default to the more secure SHA512 using the command --s2k-digest-algo SHA512, which should result in a ...


2

The key space is the set of all possible keys that you may choose for both encryption and decryption keys. In the case of symmetric key algorithms, both encryption and decryption keys are the same. However, in asymmetric-key algorithms, with one key for encryption and another for decryption, we refer as the key space for both scenarios. I hope that this ...


2

An overt channel is a communications path that is not hidden. Anyone can see that Steve connected to Stack Exchange. A covert channel is an intentional communications path that is hidden, using a technique like steganography. This might use a technique like a dead drop, where I post a picture on eBay, you view the posting on eBay, but nobody can easily ...


2

The only safe method for a website to transfer a password to the server is using HTTPS/SSL. If the connection itself is not encrypted, an ManInTheMiddle can modify or strip away any JavaScript sent to the client. So you cannot rely on client side hashing. You cannot setup a secure connection between client and server on your own, because there is no already ...


1

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http)? Not to be too blunt, but I think you're trying to solve the wrong problem. The best practice here is that the password should be salted and hashed client-side so that the server never even sees the ...


1

If the request to the 3rd party API is through your server, then store the access token in the database tied to the user, encrypted with a key that is stored as an environment variable. If the database is compromised, the tokens are safe. (Bonus, encrypt the tokens with a key that is generated and stored on the mobile app.) If the request to the 3rd party ...


1

As tylerl and user80945 already said, using EncFS in a Dropbox is not secure. More information can be found in this article. An alternative would be CryFS. It is a new open source project that doesn't have the security vulnerabilities of EncFS, and also encrypts the metadata (e.g. file sizes and directory structure). Disclaimer: I'm one of the developers ...


1

One tangible example is timing attack on string comparison. It works by measuring how much it takes for the application to compare 2 strings. The default string comparison implementations in nearly all programming languages are optimized and they work by comparing 2 strings character by character and they alert a mismatch as soon as they see a difference ...



Only top voted, non community-wiki answers of a minimum length are eligible