Hot answers tagged

10

Is that a bad method? YES. Can this be easily decrypted by spying on the data? YES. How? Standard cryptographic analysis as been done in wars like WW2 and before. Essentially what you got is a variation on the Caesar cipher. Simple statistical analysis will quickly identify your 'letters'. and as soon as that is done, its only a matter of getting ...


6

I'm assuming that you are talking about additional hashing. So it would look like this: Client --sha1(password)--> Server --bcrypt(sha1(password)--> Database Hashing or obfuscating a password client-side can be a good mitigation against password reuse: Even if an attacker accesses the password in plaintext either in transfer or at the server, it ...


6

The IV is a random non-secret value. Its sole purpose is to prevent two similar blocks from yielding the same ciphertext as it could give information away about the structure of the plain text. In general you just generate the IV randomly and concatenate it to the ciphertext. The IV must be of the same length as the block for AES-CBC, which is 128 bits. You ...


4

To add to the excellent answers already here, I'll focus on this point: If I want to securely speak with a mate on the Internet with a program I made specially for this, which only we have. This is problem #1. Somebody else could acquire a copy of your program. Even worse, do it without your knowledge. This is why in cryptography there's a ...


4

Is that a bad method? Yes, this method is bad for many reasons. First, it does not really gain you anything. If you are already using RSA then using your own on top of that does not gain you anything. If you are not using RSA or another publicly accepted encryption ... then rolling your own is a terrible idea. can this be easily encrypted by spying on ...


3

Even though an answer is already accepted, I'm going to add another because I actually believe the exact opposite of the accepted answer. Basically, you are rolling your own obfuscation, and then using RSA encryption on top of that. Is that a bad method? No, but it's pointless. Strong RSA encryption is sufficient without your additional obfuscation. Can ...


3

You should not deploy your own encryption scheme for this, neither share symetric keys with multiple parties. To protect data on transit between each client and the server, you should use TLS to protect those connections. TLS will take care of symetric key agreement and encryption decryption to each client the right way, avoiding many many things you are ...


2

Yes, this can be broken, but no, I'm not going to do it. Your friend's system is based on the principles of Hebern rotors. Such schemes were first broken in the 1920s. The most famous break of these was the Bombe, used to crack the German Enigma codes in WW II. The Enigma was a three-rotor system and looks quite similar to this algorithm, the principle ...


2

The plain text of first ciphertext is: Encryption is the most effective way to achieve data security. To read an encrypted file, you must have access to a secret key or password that enables you to decrypt it. Unencrypted data is called plain text ; encrypted data is referred to as cipher text. I was able to break this with a simple brute force because ...


2

When based on a standard, especially those as stringent as FIPS 140-2, you have to go through the following processes (which are time consuming and expensive): Design Testing Certification If you take a look at the NIST Implementation Guide for FIPS PUB 140-2, along with the other documents, you can search for the Level 4 implementation which detail that ...


1

What are some reasonable/interesting ideas of ways to address this issue practically? GPG encryption, with steganography to hide the fact that you're using encryption in plain sight. The basic idea you need to avoid mandatory compromise to encryption, is find any data channel that is not blocked and use non-compromised encryption over that data channel. ...


1

First of all, as @WhiteWinterWolf points out, this is a digital signature scheme. Digital signing is specifically for the purpose of making sure that the message is from you, not somebody else, and hasn't been modified since it was signed. Without going into the math, here's how it works: You have a message that you want the world to know came from you You ...


1

As tim wrote, it could help mitigating the effects of password reuse for users in a few cases, but if what you're thinking of is hashing it client side instead of on the server side, this would be a major design flaw. https://en.wikipedia.org/wiki/Pass_the_hash This problem plagues the NTLM authentication, where it's actually even worse than in the common ...


1

Well you have to brute-force the 48 character recovery key (https://blogs.msdn.microsoft.com/si_team/2006/08/10/bitlocker-recovery-password-details/) As I remember it visually shown when 6 character sub-key is successfully entered so I guess it is possible but if there are tools available I'm unaware of. Good luck


1

Relying all your security in a single file is dangerous. The file can be easily decrypted even if you use strong passwords. The reason is because the amount of attacks that can be done per second is incredibly high (more if you consider that a copy of the file can be attacked by multiple computers at the same time). As Alexander pointed out, there is ...



Only top voted, non community-wiki answers of a minimum length are eligible