Hot answers tagged

16

I think it's easier to split this into its component parts, and consider them as separate entities: AES and CBC. AES itself does not "basically consist of XORing together chunks of the block" - it's a much more complicated affair. Ignoring the internals of it for a moment, AES is considered secure in that without knowing the key, it's practically impossible ...


16

It's very unlikely that any government agency would crack the encryption. They would need the key. And the only way they could get that is if Whatsapp had a backdoor or weakness in their software which allowed for such a key to be extracted. There is, as of today, no direct evidence that such a backdoor exists in Whatsapp. But, since Whatsapp is closed ...


15

As you state in the question, doing this in a foolproof way is technically impossible. For the video to be displayed on the screen it must somehow reside somewhere in the RAM on the computer, be transfered to the monitor and then displayed there. From all these points the video could be extracted. Possible ways include: Copied from RAM. Recorded with ...


13

Do not roll your own DRM scheme. The industry have tried and failed so many times that a homebrew solution will stand little chance. It would be better to "stand on the shoulders of giants" and use existing DRM solutions. Windows Media Rights Management and PlayReady are good solutions. The latter supports HDCP and are used by mainstream premium content ...


8

No, because the key is secret. The "block cipher encryption" block in the diagram scrambles the data depending on the key. The XOR in the diagram does not provide the security, the encryption does. The XOR and the IV are just to make sure the same plaintext encrypts as different ciphertext for each block.


8

Your friend is correct in that private key encryption is not the tool for the job. This answer on Cryptography.SE does a good job of explaining why. Some highlights: Any public-key encryption schemes is bound to increase the size of the data that it enciphers. While there are more efficient schemes, it is safe to say that a symmetric scheme is ...


7

As mentioned, its impossible to prevent capture of the displayed video - even in the worst case, the user can record the video on a smartphone or using a fixed camera (as some pirate movies do when they are recorded at the cinema) What you can do then is to shift the protection from stopping copying, to prosecuting copiers. You can embed watermarks in the ...


7

Asymmetric cryptography has two common use cases: Encryption: You process a message or file with the public key of somebody else. Only he/she can decrypt it with his/her private key. Signature: You process a message or file with your own private key. The message or file itself can be transmitted unencrypted. It is common to process/sign only a hash of the ...


5

This is a question about scope and application interaction. So where one is better than the other depends on the scope of access of the data. With application layer encrypt the data is only view able in your applications memory space. If this is what you need then application level encryption is the way to go. However when sent to another application, that ...


5

You have asked one question, but I think that you are asking two: can Whatsapp encrypted communications be captured, and can Whatsapp encrypted communications be captured in "the clear" To your first question, all communications can be captured by legal authorities. It's actually not that difficult, and there are multiple examples of this happening. To ...


5

The answers to the linked question give a very good overview of why quantum computers break modern encryption schemes (RSA and Elliptic Curve Cryptography (ECC)), but not how to mitigate against it. Summary: expect it to take until ~ 2020 to work the kinks out of post-quantum algorithms - Use AES-256 for now! As mentioned in Thomas Pornin's answer to the ...


4

This is a problem of trying to protect what you want to provide. It's impossible to do, but you can make it difficult. Probably the best approach would be to encrypt the files. But at the end, you give all the data for a person to run on a computer they have full access to. Since it will play the video at some times, it means the keys will be available in ...


4

You cannot open a remote file with GPG through FTP. Instead you would need to download the file to the local system and open it there. Because of this the decryption will be done only locally (and will be independent from that way the file arrived on the local system) and thus password for the file will thus stay local too.


3

All modern encryption methods (AES, blowfish etc.) are designed to be much more secure than you seem to expect. Let us quickly look at some attacks which such ciphers are designed to be resistant against. Known plain text attack - In this case we assume the attacker has access to many plain text blocks along with corresponding cipher text blocks encrypted ...


2

Risks of Exposing Encrypted Information With it being encrypted I assume having it publicly accessed wouldn't affect security as the encryption setup would make it pointless for anyone to try and decrypt it. Your encrypted information will stay private as long as the crypto works (no flaws in the underlying mathematical principles are found), the ...


2

In short: Intercept encrypted communication: yes (attacker gains some metadata) Decrypt content of intercepted encrypted communication: no (presumably) Intercept not-yet-encrypted or already-decrypted communication at either end: yes (attacker would have to alter the client, but government agencies can force WhatsApp/Facebook or Google or Apple to push ...


2

I know that many giant companies has spent billions of dollars on how to prevent the privacy of their products but still they cant prevent it... So I am not expecting that I can get 100% solution on this, but still I want to protect it as much as I can. You've already got your answer, you just don't realize it. "As much as you can" is "not at all." ...


1

The IV has the same security requirements as the encrypted blocks. For CBC to work, you need to XOR the unencrypted data in the current block with the encrypted data from the previous block. Because there is no block before the first block (so no encrypted block can be obtained) an IV is used instead.


1

Let me answer this based on how PGP/GPG works. So you have a file for say Client X, and you are using FTP as a delivery mechanism. You want to ensure that your data is protected (encrypted) and only Client X can read it. To do so, you would be using your PGP key for signing, and they will use their key for decrypting. You (PGP key which can be looked up on ...


1

It is possible, if your server accepts files uploaded by an anonymous user and if you don't provide a hash (e.g. SHA-256, SHA-512,...) in order to check that cred.gpg actually contains passwords.pdf and not evilfile.pdf.


1

I Have a few suggestions but no definitive best go to solution since it really depends on your specific use case. First off look into BerryBoot, it offers full disk encryption out of the box. A second alternative is to use any of the TrueCrypt like applications such as VeraCrypt It offers a bunch of options to either perform full disk encryption or make ...



Only top voted, non community-wiki answers of a minimum length are eligible