Tag Info

New answers tagged

1

Below blog has good intro to Windows' use of Secure Boot, Trusted Boot, and Measured Boot: http://blogs.msdn.com/b/olivnie/archive/2013/01/09/windows-8-trusted-boot-secure-boot-measured-boot.aspx As to 'horrificially insecure', None of these are fully-secure, for example Intel has created Boot Guard technology to help protect system at silicon/firmware ...


0

I do not know of any "formally reviewed" implementations, beside the general concept of "community review" for well-known open source projects. Wikipedia has a page on AES implementations which can be a starting point. Generally, major open-source projects are more likely to have been scrutinized - but again this is not a "certification" (such as the French ...


1

There are actually two kinds of KDFs. One kind is designed to derive a key from high-entropy input (like another key); this can be done with a fast keyed hash like HMAC. The other kind takes a password as input. Passwords are low-entropy; they're not inherently very hard to brute-force. A good password hash thus has to be slow. In your question, you said ...


0

You might want to look into Vault. Vault is an open source tool that provides centralized secret storage that can be accessed over a REST API. It has various methods of authentication (like auth tokens or certificates) and provides policies that can be used for authorization. Keep in mind that it is a good idea to take a step back and look at your ...


2

Since PBKDF2 could be use to generate as much bytes as you want/need, you can of course use it for both master password hashing and key generation. You don't even need to use different salt, just generate a n bytes hash, then generate n+m bytes, discard the first n bytes and use the other m bytes as key.


10

The normal mechanism for a password manager is to have some sort of "master key" and encrypt the data (symmetrically) with that key. The master key, in your case, being derived from the master password through proper password hashing (so it becomes, in this case, password-based key derivation). So use bcrypt or PBKDF2 to turn the user's master password into ...


2

What you're looking for sounds like Privileged Access Management - a central database that stores administrative and other non-user credentials and allows authorized users to "check them out" for use. Such systems often will programmatically change the credentials on the target system so as to prevent re-use outside the window for which access was granted. ...


0

I personally use Cryptosys PKI to do all of my RSA cryptography within my .net apps. I find it so much simpler than the built in methods - and for the main reason that it allows testing with my previous company's well established weak test keys.


1

You don't want to encrypt passwords, because with encryption, the encryption key and the encrypted data can produce the unencrypted data. If someone gains access to your data store, they can recreate the original password. With a hash, you don't store enough info to recreate the original data. All you can do is verify that input data produces the same hash ...


4

Well, let's use proper terminology then. You don't want to encrypt passwords. You want to hash password. This is something completely different. Read this. There is a good password hashing function called "bcrypt" which is internally derived from an encryption algorithm called "Blowfish"; from which came a lot of confusion with some software platforms claim ...


5

DES is a block cipher, which means that it processes blocks of a fixed size. When you want to encrypt a message, i.e. a sequence of bits whose length is not necessarily that of a single block, you need to apply a mode of operation that applies the block cipher "properly" to encrypt and decrypt a message. The Wikipedia page has nice schematics. Each mode of ...


4

Are TLS session keys cached in a browser? Yes, sometimes, but not as you're describing. The simplest bottom line answer for you is "Yes, sessions are cached until the browser is closed." That's not absolutely true, or true in all cases, but it's a reasonably secure belief for you to base your actions upon. when authenticating to a TLS protected ...


0

Salsa20, at least as implemented in libSodium, seems ideal for this: Salsa20 is a stream cipher developed by Daniel J. Bernstein that expands a 256-bit key into 2^64 randomly accessible streams, each containing 2^64 randomly accessible 64-byte (512 bits) blocks. ... The crypto_stream_salsa20_xor_ic() function is similar to ...


3

Yes, this is insecure. It might pass audit if nobody checks, but it is very insecure. In any case, your method doesn't save you a whole lot, because you still have a key management nightmare of determining which year to use for which entries (unless you are basing it off of modified date, which is a bad idea). You are going to need a more fully fledged ...


5

The first thing that comes to mind is that once someone knows one password, they know all past and future passwords, too. The idea behind changing them yearly is to counter that problem if someone ends up cracking the passphrase, but it also provides at least a little protection against past employees who may have had access to those passphrases, too.


0

Here are 2 more advantages (assuming you use new encryption keys each time you re-install): If you run file recovery tools that scan the full block device, e.g. PhotoRec, you do not have to checks tons of old files that are no longer of interest. If you run filesystem repair tools that scan the full block device, you do not run the risk of confusing ...


0

There are several libraries that allow for authenticated encryption in .NET. Bouncy Castle, mentioned in an earlier answer, is not. Microsoft itself offers an open source library that is quite low-level, just wrapping the CNG APIs that offer authenticated symmetric encryption in Windows, called CLR Security. The CLR Security library is going to be the ...


1

One could recover from older infections by file-restoration programs and even decrypting the crypted ones (using the leftover deleted key). None of these options work anymore (unless you pulled the powerplug/battary when your hd started to perform excessive work (nobody did or recognizes that, especially on non-tweaked FF/Win8 hd-killing software)). ...


4

There are known attacks against this ciphersuite. The main reason why this mode has been made obsolete is due to these attacks. I refer you to the Lucky 13 attack (by Nadhem AlFardan and Kenny Paterson), which is an advanced padding-oracle attack that uses time differences between padding and other errors. It is extremely difficult to overcome this in ...


1

Truecrypt works with linux, it just doesn't work with full disk encryption. Within linux, you can mount a Truecrypt volume that features plausible deniability, and then simply chroot it. Or if you feel fancy, have the volume contain a Docker image, and "Dock" it.


9

Multiple CryptoRansomware are known to not properly erase unencrypted files securely. Practically some of these malware create a new file where they hold the encrypted data, and simply delete the unencrypted file instead of encrypting the data in-place. I'd advise you to attempt recovering deleted files, with a software such as Recuva (from Piriform). ...


8

I do not want to be pessimistic but the ransomware author is the only party that knows the needed private decryption key. CryptoLocker uses using a mixture of RSA & AES encryption. There are good security practices to prevent your computer from being infected by it, but once infected there is not something to do really about it for the moment. Do not ...


2

You say "SSH is fast". It's not. It's fast enough for its intended purpose (remote shell access and occasional file transfer/sshfs) but it's definitely not fast enough for IPC, let alone efficient. On a local machine there's never any need for encryption between processes. If an attacker can read what you're sending to localhost, he can most definitely read ...


-1

If the malware creator did his crypto correctly, there is no way to decrypt the files. Strong crypto is strong, no matter whether it's used for good or nefarious purposes. Some of these ransomware happen to transmit the key over unencrypted HTTP to their remote server; in the rare case you had an HTTP proxy intercept the connection, you may look at the ...


2

No, you seem to have a misunderstanding of how encryption and obfuscation work. Encryption provides confidentiality: a message is hidden with a mechanism using a shared secret from all parties not possessing that secret. Obfuscation refers to a number of techniques employed to make, in general, a scripting programming language application difficult to ...


0

What you describe sounds like obfuscation, not encryption. Please do not use "invented" encryption or hashing algorithms (please read this OWASP write-up). If you'd like to use password-driven keys, check out this JavaScript library for key derivation. There are several JavaScript libraries that implement AES (check out this StackOverflow post) and other ...


2

A big reason for knowing outdated ciphers is so you can decrypt older documents that were made before the advent of modern cryptography methods. As a famous example, we have Kryptos, a sculpture by Jim Sanborn that's found outside the CIA offices in Langley. Kryptos has 4 different encrypted texts, 3 of which have been decrypted already, the 4th being one of ...


2

If you're doing reverse engineering, penetration testing, or generally involved in looking at things someone else has built, for some strange reason, folks always try coming up with their "own" encryption schemes, which are either flawed or embarrassing mis-interpretations of old ciphers, or just vanilla implementations of old algorithms. Beyond that, you ...


1

I'm not sure what quote you are referring to in the article but I can answer in generally. You certainly could pop the case to remove the battery so phones with fixed batteries don't seem much safer than phones with removable batteries. But a bricked phone is probably safe from the warranty techs. The attack only works if you chill the phone while it is ...


0

This is probably a little late but just as a recommendation for other people who stumble on this. For this type of problem I would always use ProtectedData over rolling your own implementation with AesManaged for two reasons. First, you don't need to deal with managing cryptographic keys with ProtectedData which is a hassle to do correctly. Second, there's a ...


1

For each of the operating systems you've listed, you should leverage the operating system's built-in secure storage for the keys rather than attempt to "roll your own" solution. In general, it is not seen as a best practice to use your own encryption as you will continue to have to support, and debug your implementation which may have unforseen ...


2

The problem with hardcoded keys is that you can find them (as you did). As you've stated encryption and decryption of the data is trivial. Android's process isolation is solid (not perfect), but does provide a good degree of separation between applications. There are three scenarios that I can think of that a threat could take advantage. Malicious ...


2

@ThomasPornin address your first question. Your second question, then, is "how does one configure the protocol and cipher suite in the browser?" Firefox Protocol is configured by modifying the about:config variables security.tls.version.min and security.tls.version.max. You can set the min and max to: 0: SSL 3.0 is the minimum required / maximum ...


2

In SSL, the key exchange, symmetric encryption and MAC algorithm are all grouped together into a single aggregate notion called a cipher suite. In the initial handshake, the client sends: the highest protocol version that it supports; the list of cipher suites that it supports, in order of preference; other things which are not relevant here. Then the ...


1

Both the client (browser) and the server support a set of cipher suites. The browser sends its list to the server, then the server picks from its (sorted) list something they both support. The 4 parameters don't get chosen independently. All 4 belong to one cipher suite. Which cipher suite your browser does support you can see here. Scroll down to "Cipher ...


4

Here's the definition they use for non-obsolete cryptography: In order for the message to indicate “modern cryptography”, the connection should use forward secrecy and either AES-GCM or CHACHA20_POLY1305. Other cipher suites are known to have weaknesses. Most servers will wish to negotiate TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. In this case the fact ...


1

I will keep my members password in database with SHA-512 hash. I will use SALT for password. So i will keep SALT keys in database for each member. Is it safe and ok to implement that way? Yes, if you are using salt (which you should) then you should store the salt (in the clear) alongside the hash. Should i keep IV (Initialization Vector) in the ...


0

Try this site . You can upload a file and then they can provide a private key that could decrypt it https://www.fireeye.com/blog/executive-perspective/2014/08/your-locker-of-information-for-cryptolocker-decryption.html


1

DRM-based solution may be the only solution to such need. With such solution, when the client opens the document / software / whatever is stored on the USB key, the application must contact your server requesting for a key to decipher the document. All you have to do then is to decide at which moment you stop distributing the key for this document. ...


1

As long as the USB drive is run on a customer's equipment, there is no way its content can be made available for a limited time only. This because the customer can control the time of the machine where the USB drive is accessed. The only way you could do this is to have an USB firmware with an embedded clock which wipes out the content of the flash drive, ...


0

Defcon 22 talk by Phil Zimmerman promoting his phone company (SilentCircle) as wiretap-free https://www.youtube.com/watch?v=HuHm1vzzm1g His idea is to get rid of Public Key Infrastructure by verbally comparing session key hashes, he also gives interesting examples of PKI failures, the audience asks many questions that are in my opinion acurate and ...


2

As of late, there has been a best practice in the DevOps Community: If it's not automated, it's not secure. Automation provides benefits for security (e.g. limited, audited access via configuration management, e.g. Puppet, Chef, SaltStack), but also for availability and ease of support. As far as availability goes, it should be fast to roll back changes ...


-1

Is not the solution to encrypt with the recipient's public key? Anybody could have written it but only the intended receiver can read it.


0

So I figured that you can save a hash key client side in a session/cookie. This basically means that anyone one the server will not be able to do anything with any information because they don't have the map that says this person is connected with this api/property. So client has 1 half of the key, and server has the other half of the key. I would hash this ...


1

A KDF to strengthen the password is only needed if the password itself could be weak. The prime example is when a human has generated it. A KDF will iterate the password hash a number of times. This means that an attacker that gains access to the password hashes will have to iterate each password guess that numbers of times, slowing their attack. This has ...


1

I spent a long time trying to reason this one out. I found a real solution, but not one that can be packaged up and made into a product. You see, a passive listener will be absolutely foiled by Diffie-Hellman with big-enough key size. But if the guy is willing to MITM it falls down flat. If we know the topology we can know how long any packet should take ...


6

It's possible if and only if, at some point in the past, a trust chain was established that allowed you to authenticate your second party. It should be common sense that if A never had any idea how to identify B (or how to identify anyone else who could indirectly identify B), then, by definition, A simply doesn't have enough information to distinguish ...


2

I am not a lawyer and this is not legal advice. If you are actually going to do this, you should ask a lawyer. The EFF might be able to help clarify things without charge. The answer will probably be that it varies from place to place, and depends on what legal authority you mean. Different parts of governments have different kinds of authority (the twilio ...


4

In light of the fact that you don't have the private keys (given the way that you've posed the question), it would be impossible for any authority to force you to decrypt information that was encrypted using the accompanying public keys. You can't get blood from a stone. But notwithstanding, authorities in the US have been known to force site operators to ...



Top 50 recent answers are included