Tag Info

New answers tagged

0

When a user access a website, in order to encrypt communication between the the user and the website, a symmetric key is to be use. Yes. *In order for the symmetric key to be used by both the client and server, information about the creation of the symmetric key must be encrypted using the asymmetric key Yes, unless it is diffie-hellman. ...


0

You could generate a cryptographically secure 128-bit key and store it in HTML5 storage on the browser. This would encrypt data without any input from the user. However, the user would have to use the same browser and computer all the time. You could add the option to export the value - e.g. a browser extension that extracts the key in HTML5 storage and ...


2

Secure random data should not be predictable. Since encrypted data can be predicted from input text and encryption key they can never be a secure random source. Apart from that the whole purpose of encryption is to hide the original content. The primary purpose is not to look like random data. This means you can not use the output from some arbitrary ...


1

First, I think that you're confusing some terms. The term is "digital certificate", "certificate", or simply "cert". Not "digital certification". If you really mean "digital certification" then this answer is likely wrong. Yes. Symmetric keys are used for bulk encryption because symmetric encryption algorithms are much faster than asymmetric ones. No. This ...


4

If I am not mistaken, importing your own SSL certificates is just for the connections which you make to the device's own web interface so that won't help you to accomplish your goal. What you would need to do is: Create your own root CA Make those devices trust your own root certificate Redirect all SSL traffic from those devices to your proxy When a ...


0

You can use your computer as a proxy server using "Squid" and configure SSL dump by decrypting the traffic, analyze it and re-encrypting it again and send it to its destinations. You will have to import the certificate created by Squid to your connected devices.


4

There is no standard way to do what you envision and I'm not aware of any proposals of relevance. The currently established PKI structure allows only for a single certificate chain (i.e. a single issuer for a certificate) and the TLS protocol like used allows only for a single leaf certificate. In theory one might create a certificate with multiple issuers ...


1

In general, storing passwords in a reversible format is a bad idea. That said, you could use AES, with the user's password as key (enforce a strong password policy). That way, users wouldn't be able to view each other's encrypted data, and a compromise of the server won't reveal the key to everyone's data without cracking the user password hashes first. ...


0

should I make the API retrieve an auth token or the users password before the details are updated? NO because I am assuming that this backend app will be used mainly by the web admins/operations and why should they have access to the user's password or auth token? Also, whoever is going to use this app must login to the system themselves and you ...


0

Secure digital cards define a protocol and commands for password protection of read/write access to the part of the stored data. Data access is impossible without presenting a password. A specification snapshot is available at http://blog.ednchina.com/Upload/Blog/2007/10/26/eb26e3c5-586e-43c7-a0a1-ff4920ee7113.pdf


2

This is the typical issue with encryption: the trouble is not how to securely encrypt a file but rather how to handle the encryption keys. Basically, you have several options: Use a secure channel to exchange the encryption key. It could also be a less than secure channel that you just hope isn't intercepted by anyone monitoring you line (SMS, for ...


-2

It is secure, at least if comparing to emails. Before email came into popularity, fax transmissions presented the only way to send written communication quickly. They could provide papers and printouts in a few short minutes over hundreds or thousands of miles. Since email has come into wide use, some companies have completely abandoned fax machines. Still, ...


5

With one-directional communication the sender must have least some knowledge of the recipient so that the data can be encrypted. This knowledge might be a common pre-shared secret which is used in symmetric communication or it might be the public key like used in PGP and S/MIME. This public key then can be used to encrypt a message which can be decrypted ...


1

OTP and variations thereof can be utilized and would be the best option given a strong enough key, of course traditional symmetric & asymmetric ciphers can also be used. The problem however would be forward-secrecy for previous communications, once the data is encrypted and sent it is a matter of time before the key can be factored leading to a ...


1

Disclaimer; I haven't done HIPAA work for over a decade, and reality may vary from history. I welcome comments and alternative answers from someone currently working in the space. The encryption specifications of HIPAA are "addressable", which is to say, they're not "required". You can choose to do something else as long as you document in writing that ...


0

I don't even play a DBA on TV, but I used different (google) bigtables with different access permissions, joined when accessed by the privileged users, via either the GUI or the sorta-nosql language. For the others, you might need a system with Mandatory Access Control and a DBMS that understands them. Existed once, but not a business success, so I ...


1

If the KMS holds the key then they can read the message. If the KMS is breached, then an attacker can read all messages associated with all keys that they stole. Asymmetric keys where the private key is only held by the recipient only allow the recipient to read the message so there's no worry about peeping KMS systems. If the private key is stolen, it is ...


2

Using the source listed for the SSL Socket object in the Android API Client Side +-------------------------------------------------------------------+ | Protocol | Supported API Levels | Enabled by Default (API Levels) | +-------------------------------------------------------------------+ | SSLv3 | 1+ (BASE) | 1+ (BASE) ...


2

ServerHello and ClientHello? - nope they're in the clear. Key exchange? The premaster secret is encrypted using the public key from the certificate so only the authenticated server can read the premaster secret. Or in the case of Diffie-Hellman the key exchange is signed by the server and verified by the client using the server certificate public key. ...


1

Try to assign a patent for your new encryption method. And try to sell licences or your patent. That's what the RSA guys have done. But keep the Kerckhoffs's principle in mind, and publish your algorithm. Because history has shown most proprietary algorithms fail, due to design errors.


1

Requirement 2: Opt-in revealing of name and email Option 2 can easily be done without your server having to always remember UserId & user's email: When the user wants to post a non anonymous message, the user supplies his name and email address. If identity sproofing is a problem the user can keep a certificate proving that he owns the given username ...


1

If I understand you right than you want to make sure that no user data are compromised even if your site gets hacked. First you should be clear that this only can apply if you detect hacks to your site. If the attacker manages to hack your site and you don't notice this then the attacker can track all activity on this site and probably de-anonymize the users ...


2

If you can really trust the third party that it keeps your private key secret and uses it only for passively sniffing and decoding the encrypted traffic (like within an IDS) then you are probably right about the impact. But of course this third party can also use this private key for active interceptions (i.e. modify traffic) or for impersonating your ...


1

Depending on the encryption mode you would either get a slightly changed message, or a very changed message. Encryption's job is to provide confidentiality. This is the guarantee that C can't read/generate arbitrary messages sent between A & B. What you are talking about is message integrity. This would be the guarantee to B that the message he is ...


2

As stated in RFC 5246: The TLS Handshake Protocol involves the following steps: Exchange hello messages to agree on algorithms, exchange random values, and check for session resumption. Exchange the necessary cryptographic parameters to allow the client and server to agree on a premaster secret. Exchange certificates and cryptographic ...


1

I believe requiring full plausible deniability leaves only Steganography: Hide in images (approach of Freedo) Hidden TrueCrypt partition (this is basically Steganography as well, on a (visible) partition instead of an image) However there is one big problem with these approaches, the software to read (and most often also write) the data must not be ...


2

If you're using simple HTTP for communication then TLS would be the easier route. While you think you might have thought everything through it's better to use an established protocol for the following reasons: It's already supported by most browsers, operating systems, and devices. The infrastructure is already in place, with lots of examples for ...


-1

Given that information, I suppose although it's easy to get around, you can create another partition on your computer's hard drive, assign it a drive letter, copy encrypted files to it, then remove the drive letter from that partition. This essentially hides the partition from the operating system until you open Disk Management and reassign it a drive ...


-2

While I understand your concerns, I believe a more appropriate approach for you if you wish to be security conscious is full disk encryption, or FDE. With the price and performance of SSDs nowadays, FDE is the way to go as the overhead is negligible in most cases. If you have a Mac, an FDE solution is provided for free via FileVault (utilizing XTS-256 I ...


3

The user name and password are encrypted; this is confirmed in the OpenVPN documentation: OpenVPN 2.0 and later include a feature that allows the OpenVPN server to securely obtain a username and password from a connecting client, and to use that information as a basis for authenticating the client.


0

Not sure of your question, is it how these values are encrypted? It is described in RFC-2548 section 2.4.2. The reason I think this is that in your question you state: I have an example of freeradius and the session key is converted from 16 bytes long to 32 bytes long before the construction of the string stated in RFC 2548. so you are wondering ...


0

Pastec.io is a very nice API using OpenCV, which can be used for encrypting the image and detecting using android phone's camera.


1

There are lots of protocols on a LAN that use encryption, so if you know you are using one of those, you can make some assumptions. But you open up the question when you say "all outgoing traffic" because it is possible that proxies force unencrypted traffic on the LAN but turns it into encrypted traffic outside the LAN, even though you specify that you ...


0

You should try a password manager such as KeePass or LastPass. The passwords will be stored securely using a master password and other criteria you may designate to encrypt them so you can ensure that your passwords are safe. They also offer other functionality as well. Keepass for instance has an auto-fill feature which will make an attempt to enter ...


2

I’m not deeply knowledgeable about load balancing, but: depending of your load balancer, the SSL/TLS termination could or could not be managed by it. If you use HAProxy or nginx as load balancer, these one work on the Application layer/layer 7 – here TLS+HTTP – and they will handle the TLS termination, so all the TLS configuration will be there and the ...


4

I think you're looking for SSL Termination, what basically happens is that the load balancer handles all the TLS/SSL process and forwards the requests to the end servers. This approach aims to streamline the implementation and management of SSL connections, imagine a load balancer serving 20 back end servers, it would require 20 machines to be able to handle ...


0

Most modern encryption algorithms are designed such that the ciphertext is indistinguishable from random noise. But if an older algorithm was used, it may be possible to glean some information about the algorithm from the ciphertext. See this post on Cryptography SE for more info.


0

Not an answer (@raz got that) but some errors in your "understanding" too large for comments IMO: Browser will send a request to the server to get some resource. Server checks if the protocol of the request is HTTPS, if so then it will send its certificate (this certificate is already signed by some CA (Certificate Authority, like Digicert)) in the ...


4

The limiting factor for an attacker using a quantum computer is the number of qubits they can keep entangled long enough to perform a calculation. The qubits required to crack RSA keys are estimated to be 2•bits while ECC is roughly 6•bits, but RSA keys are generally much longer so they end up taking more qubits; roughly 3x on the low end (2048 vs 224) and ...


1

Taking AES-128 as an example, you have a 128 bit key. The "stupid" brute force attack would require you to check every possible 128-bit key until you get back plain text that makes sense. There are 2^128 possible keys and hence the complexity of brute force on AES-n, where n represents the key size is O(2^n). Now obviously there are ways to constrain the ...


4

Short answer: It will need internet connectivity briefly, then it will encrypt everything even if you disconnect. Long answer As soon as CryptoWall runs, it will generate a random RSA public and private keys, connect to one or more control servers, and upload the private key along with some information on the system it is, like OS version, public IP and ...


0

If you are going to go down that route a key derivation function (KDF) from the users password might be the way to go. That way the encryption keys are generated from the user's input so you would not have to store any of the keys. However this also runs into the issue that if the user cannot remember his or her password the data will be lost and KDF's can ...


3

One of her key requirements is, that the data stored will be encrypted in a way that only the user will be able to access it. The only way to truly guarantee this is to have the encryption key reside on the client, under the control of the user. This introduces (at least) two problems - Having a thick enough client to support key management and ...


3

If you are encrypting a client secret where it needs to be decrypted and used to access another service, you should not expose this to any untrusted system, including checking in to source control, as that would mean that people with access to the system would be able to get access to the secret. Also other automated processes which work off the source ...


8

Yes, any value in a GET statement or POST data (e.g. ?user=ANYTHING), is encrypted once the SSL/TLS sessions are negotiated. During an TLS connection, the first thing that happens is a "Client Hello" messages that begins negotiating the encryption ciphers/hashing ciphers to establish a connection. On some browsers, the hostname is sent using the SNI ...


2

When a connection is encrypted with SSL, the entire content of the connection is encrypted, including the GET values.


2

How secure this is will depend on a number of factors. Do you have device wipe enabled on incorrect guesses. Assuming that you have the device set to wipe after 10 incorrect PIN guesses then without any clues and a purely random PIN, an attacker has a 1/1000 shot at guessing it. Of course most users base PINs on things like dates or years which cuts the ...


2

Regarding #1, "Does the FBI/NSA or other government agencies have access to my data or can easily decrypt them?" legality aside, there are several factors to consider. "Easy" is relative. Depending on the charges, and the value of the data that is encrypted, they may have more or less incentive to break the encryption. If it's a list of neighborhood ...


5

The Electronic Frontier Foundation maintains an excellent FAQ on digital rights regarding search and seizure of computing devices. For your specific questions: (I'm going to assume US, because you reference FBI and NSA) 1. Can government agencies break disk encryption? Without a warrant or probable cause, no. With a warrant, if your question is: "Can the ...


1

Question 1 Question 1: Are there any obvious security flaws in that scheme (except that the attacker can access the data of all logged-in users)? Proposed scheme: Registration The user digests a password key P from the plain-text password p using SHA 256 The user sends this key over a secure connection to the server The server generates a random ...



Top 50 recent answers are included