Tag Info

Hot answers tagged

21

You are doing it wrong. Not in the splitting or whatever; but in the thinking. AES encryption, if done properly, won't be "cracked". AES is the most robust piece in your system; this is the last part of it that you should be worrying about. What AES encryption provides is a very specific functionality: using a given key K, it transforms a piece of data (the ...


12

No, it isn't safe because you expose (in your program) a key which should be secret. Your proposal is based on symmetric key cryptography, where both ends of the communication channel need a copy of the same key. Symmetric key cryptography is effective only when both ends of the channel are secure. As others have pointed out, a key embedded in a program ...


4

Cryptographically secure voting is difficult because voting encompasses so much. Let's take, for example, vote-buying or coercion. Imagine a system where I can vote, and can verify that my vote was tallied correctly. Now I can provide that proof to a third party who purchased my vote to claim renumeration for that vote. If the voter cannot verify their ...


4

No, this is not a secure alternative. It is entirely possible that a hard-coded key could be discovered, which would leave you with application traffic that is essentially unencrypted. So, if you feel the data is not sensitive enough to secure, don't bother encrypting it at all. Deliver it over HTTP. If, however, there is any reason to secure it, do ...


4

Based on a google search of your hash it's a Dahua hash.Luckily for you it looks like it has some vulnerabilities www.exploit-db.com/download/29673/ I don't know if they fixed vulnerability and I don't really know much about CCTV systems.If that fails you could try bruteforcing the hash.


3

Yes, it's in scope. There's actually a pretty thorough and explicit guide from the PCI Security Standards Council (the DSS people) to your exact question here: Information Supplement: Protecting Telephone-based Payment Card Data Which makes reasonably clear statements like this about card numbers: Call centers will need to ensure that PAN data is ...


2

You should be worrying about secure storage of the AES key, not about breaking up the data. If the key is compromised, it really won't make any difference what you've done with the data because Kerckhoffs's principle. Edited to add: Most especially, you must not store the AES key in the same database that holds the encrypted data because a database ...


1

May I suggest that you rethink your approach to this problem. Where are you storing the data? If it's in a database most databases have the ability to encrypt data at rest fairly securely. Does the data need to move over an insecure channel? Look into the HTTPS or secure FTP. Don't mess with crypto unless you absolutely have too. It's extremely easy to ...


1

If you can require that the ranges are block-aligned, the disk encryption modes (LRW, XEX, XTS, CTR, etc.) seem ideal for your purposes. ECB mode also works with block-aligned ranges, but is, well, ECB mode. If you need byte-level alignment, the only mode that looks promising is OFB mode: you compute a keystream that includes the range you want to decrypt, ...


1

There's a lot of good general security practice information in the other answers, but as I've just been researching for myself the implementation of security in the HomePlug AV spec (used by the devices you mentioned, and many others), I thought I'd add a little more specific info not covered yet. First, there's no such thing as unencrypted data transfer ...


1

Unluckily, although PGP is awesome in theory, the "real world" benefits of PGP are quite limited, if existent. If PGP was the default that everybody uses, it would rock. TLS gives you (ignoring the possibility of exploits) a secure connection to your mail server. You have the guarantee that the server you talk to is really your mail server, and that nobody ...


1

Skype is a modified P2P network. You have no guarantee that your traffic is going to them, so a sniffer wouldn't work the way you'd expect. However, you can resolve the person's username to their ip address with a tool like this while they are online. So if you can get their username from the Skype number, or the email address associated with the number (to ...


1

Yes it is possible but unnecessary in your case. People often use VMs to isolate potentially malicious applications from their main host and to have some sort of rewind button to restore the VM to a previous state in case something goes wrong in there, but looks like that's not what you want to do. To defeat forensics all you need is full disk encryption ...



Only top voted, non community-wiki answers of a minimum length are eligible