Tag Info

New answers tagged

1

Each additional computer that has access to your keys increases your risk of being compromised. However, one way that you can greatly reduce the risk is by using a cryptographic smart card. Cryptographic smart cards store the private keys and do the encryption / decryption on the card. This means that the computer never sees the private keys. Assuming ...


2

The private key is owned by a human, not by a machine -- indeed, the normal case is that you (as a user) have one key pair, and use the private key on all machines where you need to. Having a key pair per machine would not work well; this would mean that when people send you an encrypted email, they will use one of your public keys, and you will be able to ...


1

I have not used these technologies before but what I can tell you is if you decrypt the password in your SQL query then anyone on your network can sniff and get the passwords as plain text. If I understand correctly, your C# will get the decrypted passwords? If so I would recommend you have something such as in your C# application: C# generate a random ...


0

Are you developing this software? I would just generate a unique token stored in database such as: TokenId UserId (Or some entity which this token relates to.) TokenKey (Which will be used as an identify to the public.) IsExpired Ip (Which is hashed such as SHA512 so doesn't expose the users IP if compromised.) CreatedOn UsedOn Now, we need reduce ...


2

The Nazis had physical code books they would distribute. They would determine the Enigma settings for the day. Then using those settings, each message would start with a message key setting the starting rotor settings for the rest of the message. These were useful as cribs for breaking out messages since all messages the Nazis sent for a day started using ...


3

Here's a possible website you can use to find out more: http://www.openculture.com/2013/01/the_enigma_machine_how_alan_turing_helped_break_the_unbreakable_nazi_code_.html A Summary: Legitimate Method: The Nazis released a monthly code sheet with the appropriate settings for each day of that month. Once you knew the settings, you could type in the nonsense ...


2

Check out Turing's biography by Hodges. There's a pretty good description of both how the legitimate (ie; nazi) and unauthorized encoding and decoding of enigma messages worked.


3

All of the answers to this question helped me. What confused me was that the library name of OpenSSL isn't actually the real version number. OpenVPN has its own statically linked OpenSSL library and the name of the library was libssl.so.1.0.0. It turns out this library executable isn't actually version 1.0.0, is vulnerable, and needed to be upgraded. See: ...


5

Using the OSI model of layers is often a good way to spread confusion; it was not initially meant for TCP/IP, and TCP/IP always had trouble fitting in it. When data is encrypted, it can no longer be understood by whoever does not know the decryption key. However, firewalls don't look at all the data, and encryption does not encrypt everything, because the ...


1

As Terry says, the main advantage is that it offers information-theoretical security. But on a couple of points you mentioned in the rest of your question: The length is not an advantage in itself but the fact it means you can never prove what you derived from a guessed key is the actual decrypted data makes it infinitely secure - provided you do not fall ...


1

It is extremely important to understand that "One Time Pad" is an element of the actual cipher used, not any particular protocol. For example, SSL or TLS using RC4 is, effectively, implementing a digital One Time Pad, while SSL or TLS using DES or AES is not using one. One Time Pad refers to the old-school cryptographic technique of printing code pads... ...


5

It is a matter of redundancy of information. An attacker wants to decrypt some piece of data, because he is interested in that data, and thus has context information. For instance, assuming a HTTPS connection, the attacker knows that what is encrypted is an HTTP request and an HTTP response, both coming with syntactically correct HTTP headers. It is highly ...


2

The SSL library in OpenVPN is vulnerable the following 2 files in /usr/local/openvpn_as/lib/ eg: libssl.so.1.0.0 and libcrypto.so.1.0.0 download one of the following versions for your distro at https://openvpn.net/index.php/access-server/download-openvpn-as-sw.html that should solve your problem. Remember to backup you config files.


8

A one time pad offers information theoretic security. This essentially means that the one time pad cannot be broken even if the adversary has unlimited computing power. This is because XOR-ing any data against a truly random key will guarantee that the output be random as well because you are simply flipping bits.


0

But tons of information is available on this utility that it can be circumvented what other choices do I have? At the end of the day, all of this doesn't make any sense. The computer needs to execute it, therefore at some point in time all of the sensitive information will be somewhere in memory. With current day technology there is no way around it. ...


1

You could try to encrypt the script using standard methods and decode it on the fly by giving the secret key either directly or through a process. But, this would only help against attackers which have no permissions to modify any of your data or the programs you call, which especially means that they have neither root permission nor the same uid as you. And ...


8

Actually quantum computers are not that much a threat for symmetric encryption. To put it in simple (and somewhat simplistic) terms: A quantum computer, if it ever exists, will totally break the most used asymmetric encryption and key exchange algorithms (RSA, ElGamal, Diffie-Hellman...) but not all asymmetric algorithms (QC does not break the concept of ...


3

I have used a similar method in the past: I had a plain-text file containing my credentials and encrypted this with the Blowfish cipher. Now I use KeePass, an offline password manager. I strongly recommend it, as it is Much more user friendly than an encrypted text file, and Much more secure than a text file encrypted just once (N = 1, see below). KeePass ...


-1

A good encryption method like AES or RSA is more than enough. Nothing is 100% secure, but using RSA-1024 or RSA-2048 should be enough.


1

Might be well worth the effort to have a look at KeePass Password Safe, an offline password manager. I use it and am very happy with it. Perhaps also check out Wuala, a cloud data storage service similar to Dropbox, OneDrive, and Google Drive. Wuala is different because it encrypts your data locally before storing it on their servers (Wuala only stores your ...


1

How should I authenticate WebSocket clients like Socket.io on top of HTTPS ? There is no need to authenticate a connection more than once, so if you are using websockets, you can put security token in the first message that client sends after connecting to the service. HTTPS is a must. After handshake you will have secure connection (token can be ...


2

Your Webserver (heartbleed.py tests https on port 443) seem to be affected, but it doesn't tells you weather OpenVPN is affected or not. (as Anti-weakpasswords already stated, you could have multiple OpenSSL libraries or static linked libraries on your system). To test your OpenVPN, I wrote a similar Python script which explicitly talks to OpenVPN to test ...


2

You are asking to generate secret data from a single, non-secret source. It can't be done under those exact conditions. You need a 'source of secrecy'. You can try to squirrel a key away in a config file, perhaps encrypted with yet another key, or you can move some aspect to a different, secure machine, such as using a Hardware Security Module (HSM) to host ...


4

The key has to be somewhere other than on the encrypted drive, because logic. Typically the key is stored in one of three places: In the user's head (or, since keys are hard to store in a head, a password is stored that can be used to derive the key) in a TPM module inside the computer on a removable token, such as a smart card or USB fob From your ...


1

From what i understand, you want to protect the data on your disk if you send it away to a repair shop? Are to able to access the disk at all? There is no need to apply such hard encryptions on the entire disk IMHO. Partition the disk and encrypt your personal partition or/and volume. Grab a copy of hirens boot cd to partition the broken drive. You should ...


1

No. TRESOR only provides a method of storing AES encryption keys in the CPU. It will not prevent an attacker from stealing certificates, user information, password, or whatever else may present in the server's RAM


2

Site owners should not have the ability to instantly see every single user's password (and possible every password they've ever used on your site) - many users share passwords, and you don't need to get into their bank account. Nor do you need to be accused of getting into their bank account based on having their password. Should an attacker get your ...


0

3DES exists because of a need for an encryption algorithm stronger than DES that could be implemented using hardware optimized for the computations involved in DES. It is considerably weaker than cyphers such as AES (which was standardized at the same time as 3DES) and hash algorithms such as SHA-1 (several years earlier), and should not be used if other ...


2

You can have several versions of OpenSSL in various places on your system, in additional to possible statically compiled code. Perhaps pull up another couple client-based tools from my answer here - in particular, perhaps one of the "go" language based ones, and see if they also agree, since you've already used a python one. To verify, however, open up a ...


1

Most encryption schemes are designed so that encrypting the same value twice generates different encrypted values. This is a security property. Encryption schemes such that encrypting the same value twice results in the same ciphertext are said to be deterministic. Deterministic encryption is necessary in some applications, but should be avoided by default. ...


2

It appears that encryptWithManagedIV () generates random IV each time you use it. Thus, different ciphertexts (which is good BTW). See here: Use the encryptWithManagedIV() function to have Salesforce generate the IV for you in the first 16 bytes of the cipher text.


0

To store the token: For a traditional (non-Ajax) web app you usually store the token in a hidden form field. For a single page app you usually store the token in a JavaScript variable and include it in the JSON data with each request. This approach avoids the token being in the URL, and it works with WebSockets. Most applications use a cookie as the ...


1

i am not a pro but im working on a problem like this and i think you can use encryption with RSA and use a public key to encrypt data and then save it on database and when admin wants to read data , with a private key start to decrypt with a safe private key. and you may do this on top of hashing data with strong salts. obviousley you should keep private ...


1

The Perspective addon does distributed certificate pinning. Certificate pinning means to associate a particular certificate to a particular host, so that any changes can be noted. This is mainly to help prevent man-in-the-middle (MITM) attacks. For example, say that when you visit https://www.eff.org/ on Monday, the security certificate for that site was ...


0

If your own company is an enemy then you have a problem. Or possibly you are the problem. Normally, you connect your machine on the company's network based on a contractual agreement which makes you the employee, and defines your rights and duties. In particular, many companies do not allow employees to plug their own hardware on the company network; or ...


0

If you have full control over your computer it should be easy to detect SSL interception, because the browser will complain about unknown issuer if you access https-Sites. At least if the firewall administrators did not get an intermediate CA from a trusted CA (see https://lwn.net/Articles/480279/). And even these you will be able to spot if you use Google ...


0

Your password data is exactly as safe as the encryption of your TrueCrypt volume and the quality of the TrueCrypt volume password. For example, if you have used AES and a high entropy password to encrypt your volume, its very very very safe. If you want to feel even more safe, create a random keyfile from Tools > Keyfile Generator menu when generating the ...


1

Doing this makes your data marginally less safe, since "the cloud" is just a fancy name for "someone else's computer". However, you already have implemented a good control against offline attacks in Truecrypt. And, you've gone with SpiderOak, which is one of the safest cloud providers. So the risk increase is very small. At the same time, you have also ...


0

What I understand you to mean is, could someone use a brute-strength attack on the key directly (without using using password-guessing to generate different keys) any easier if it were generated with a weak password than with a strong one? If that is your question, then the answer in the vast majority of cases (and certainly with any recently implemented ...


1

You can encrypt by using the open source Truecrypt software to create an encrypted container. An encrypted container is a file that Truecrypt uses and sort of pretends is a disk drive. It is formatted like a drive, and everything that is written to it is totally encrypted. When you mount it in Truecrypt, you get a drive letter on your computer and ...


0

What exactly counts as "safe" is a matter of opinion. If you are using a decent passphrase on your Password Safe file, then the risks are low. It is effectively impossible to decrypt an encrypted file without the passphrase, so it wouldn't greatly concern me that a third party has my encrypted file. You are right that someone could do differential analysis. ...


3

No With current technology there is no 100% secure way to transfer data over the Internet. The best you can hope for is to follow standard best practice. In which case you need to: Secure your web server - apply patches, hardened config, firewall Secure your application - code to the OWASP top 10, avoid SQL injection, etc. Use SSL to protect data in ...


2

If you're trying to protect data-in-transit between two servers, please just use SSL/TLS certificates instead of rolling a new encryption scheme. Note that SSL/TLS technically uses symmetric encryption as well, but the shared session keys are encrypted with asymmetric keys during the initial exchange (hence the need for certificates). One of the huge ...


0

Yes, it is possible for an attacker to gain access to your private and sensitive data during encryption or decryption. This attack is known as memory sniffing attack. In my opinion this is very sophisticated attack. The attacker dump the machine memory (e.g. RAM, swap files, etc) and then analyze this data to retrieve sensitive data (e.g., password, ...


2

One censorship method that hasn't been mentioned yet is TCP Reset packet injection, which terminates undesired connections via forged TCP RST packets. The Great Firewall of China has been known to do this for years (source: http://www.icir.org/vern/papers/reset-injection.ndss09.pdf). Often this is used in conjunction with DPI, such as to do protocol ...


5

Some research on this topic: Empirical Analysis of Internet Filtering in China (2003) For some 1,043 of sites tested, we confirmed that DNS servers in China report a web server other than the official web sever actually designated via each site's authoritative name servers. We call this phenomenon "DNS redirection," though others sometimes refer to the ...


3

Exact answer depends on the involved mode of operation, but most of them begin to exhibit unwanted structure when about 2n/2 blocks have been processed, when the underlying block cipher uses n-bit blocks. The fundamental reason for this is that a block cipher like AES is a permutation: any two distinct input blocks are encrypted into two distinct output ...


0

In the UK the police can force you to reveal encryption keys. There have been a handful of cases of people jailed purely for refusing to reveal their key. I think the UK is somewhat unusual in this regard, but you would have to check your local laws. Of course, if revealing your key implicated you in something serious (like mass murder) you would do best to ...


1

1.They can't guarantee it's what it's said to be if they can't retain the original binary data that makes up the evidence of the accusation. In such a case, they could never charge anyone without proof, and if they can't decrypt it, they can't prove anything. Assuming that any confiscated or eavesdropped data is encrypted in a secure way, there is ...


1

I'll leave legality to someone else. In terms of how they do it, here's a rough overview: Any connection, encrypted or not, is visible to your ISPs routers as a TCP session (generalization, I know there are other protocols). The routers know, regardless of whether or not encryption is present, how long each session has been connected for, and how much ...



Top 50 recent answers are included