Tag Info

Hot answers tagged

72

Shamir's Secret Sharing is a method for this. It allows one to encrypt a file with a public / private keypair, and then effectively split up the parts of the private key to be distributed to several different people. After that action (and assuming the various parts and original input private key are destroyed after distribution), it would require a quorum ...


49

All of our answers are speculation, of course, but I suspect that the most likely way that the documents are protected are by following Bruce Schneier's advice regarding laptop security through airports: Step One: Before you board your plane, add another key to your whole-disk encryption (it'll probably mean adding another "user") -- and make it ...


44

What you are doing is no kind of encryption, it is just obfuscation. It relies on security by obscurity. It may be enough to hide your files from an amateur/casual observer, but anyone analyzing the files in a hex editor is going to be able to rebuild and access them. Effectively your method is about equal in complexity to attempting file undeletion, for ...


33

When creating a password-protected Zip file (with the "compressed folder" utility integrated in the OS), Windows XP uses the "standard" encryption algorithm for Zip files. This is a homemade stream cipher, and it is weak. With 13 bytes of known plaintext, the complexity of the attack is about 238 operations, which is doable in a few hours on a PC. 13 bytes ...


33

There are two types of PDF protection: Password-based encryption and User-Interface restrictions. You are describing the second type of protection, namely the missing permission to copy-and-paste, to print and so on. If there are user-interface restrictions placed on a PDF file, the viewer still needs to decrypt the contents to display it on your screen, so ...


31

Adobe's PDF lock functionality obeys to the rule of security through obscurity. If third party softwares are able to unlock a PDF file it is because If the if the file is encrypted then it contains necessarily the information needed to decrypt it. The encryption key of a PDF file is generated as following: 1. Pad the user password out to 32 bytes, ...


28

Your first question is really a legal one, and you seem to be assuming two things: The attacker is a government of some sort. That government actually respects citizen privacy and requires some sort of reasonable suspicion before it can force people to give up encryption keys. Neither of those assumptions are necessarily true. For all you know, some ...


24

He might be referring to neuroscientific methods of cryptographic primitives such as those outlined in the following paper: https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final25.pdf Basically, you can prevent against "rubber hose attacks" as they call it (torture the password out of somebody) by training the user via some sort of ...


23

You are creating something called "entropy". Random number generators within computers can, if implemented within software, only be at best pseudo-random. Pseudo-random number generators (PRNG) start with a seed. If the seed is well-known, then anyone with knowledge of the PRNG algorithm can derive the same values you derived (this is actually really good ...


23

Here is an original technique I have come up with that can survive a rubber-hose attack: Get a stack of cash, about 50 one-dollar bills. Maybe mix some fives and tens in with them. Shuffle them into a random order Derive a password from the serial numbers, for example by taking the two least significant digits from each bill in order to form a 100-digit ...


22

No (with a minor exception at the bottom). The passphrases "correct horse battery staple" and "correcthorsebatterystaple" are equivalent entropy-wise. Choosing to put spaces in an incorrect spot or sometimes including spaces and sometimes not including spaces will give you a few extra bits of entropy; but its not worth it for the extra difficulty ...


21

There are a number of defenses you can use to help prevent and recover from theft. The first thing you should look into is full-disk encryption, e.g. LUKS, TrueCrypt, or PGP. This will prevent an attacker from reading any data on the disk, even if they steal the hardware. You will need to enter the password at boot, though, so for unattended remote hardware ...


21

Making your own crypto is fine as long as you understand that it is for learning, not for using. There are several "layers" in cryptography. There are algorithms, like RSA, AES, SHA-256... Then there are protocols, which assemble algorithms together. And then, there are implementations, which turn protocols into executable code. For a first grasp of ...


19

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? What is EFS? Folders on NTFS are encrypted with a specalized subset of NTFS called Encrypting File System(EFS). EFS is a file level encryption within NTFS. The folder is actually a specalized type of file which applies the same key to all files within the folder. NTFS on disk format ...


18

If you want an alternative to Windows zip, consider 7-Zip. It's open source, and uses AES-256 (which is very unlikely to be broken any time soon :) It can also compress to .zip format, so anyone can read it. Note - I just double-checked, and Windows XP's built-in zip can not decrypt AES. However, it's possible to use 7-Zip to make a self-extracting .exe ...


18

You're wrong in your assumptions. There are many legal jurisdictions where you can be required to produce passwords for encrypted data on suspicion, rather than proof, that the data may be relevant to a criminal investigation. If you don't provide your password, you can be jailed. But if there's no encrypted volume visible, they don't know to do it. For ...


16

Spaces in a passphrase add entropy exactly insofar that they could not have been added. An important point is that an attacker cannot test for a partial match on a password; contrary to what Hollywood movies tend to suggest (in a most graphic way), there is no such thing as a "partial decryption" (where the text is partly legible, but blurred) or a "partial ...


16

I am not finished and I don't know whether I ever will. However my current results: The code itself is quite advanced (from my point of view). The code itself is shellcode http://en.wikipedia.org/wiki/Shellcode that tries to load a payload from a remote server. The code has at least one level of indirection. At first it looks like those are the server ...


15

The main problem with password-protecting a PDF file with a password is that you are basing the security on a password, which is some piece of data that a human user, somewhere, came up with in his mind, and was arrogant enough to deem "unguessable". It turns out that most passwords are guessable. The situation can be somewhat improved by making the ...


14

Because encrypted files are not compressible, the most useful place to put encryption is in a compression program; that way you can compress the content and then encrypt it. Modern tools generally use well-vetted algorithms such as AES. Avoid classic ZIP encryption because it uses a bad algorithm. 7-zip is a great tool because it's FOSS, cross-platform, and ...


14

Summary: yes, but use TrueCrypt instead. From the documentation: WinRAR offers you the benefit of industry strength archive encryption using AES (Advanced Encryption Standard) with a key of 128 bits. So yes, the data is encrypted. This is only one of the elements of security, however. Another important element is how the key is derived from the ...


13

If you haven't already looked at it there's a couple of sources I'd recommend for this. John the ripper with the community jumbo patch supports zip cracking. If you look at the supported modes there's some options (including the basic brute-force) for cracking zip passwords. Elcomsoft have good zip crackers including guaranteed recovery under some ...


13

You need to store a "password" (or password to decrypt the password, or password to decrypt the password to decrypt the password, etc ad infinitum), somewhere. So, either you can store it on the computer, but then it can be deobfuscated and read (if your program can do it, any program can do it) or in the user's head (harder to get at programatically, but ...


13

With most file formats it is not difficult to identify the original filetype without knowing the original extension. A JPEG file, for example, always begins with the HEX sequence FFD8FF. Seeing that sequence at the beginning of a file tells you that it is very likely a renamed JPEG image. There are tools available which detect many common file formats ...


12

http://www.autohotkey.com/board/topic/86586-tcbrute-2-truecrypt-bruteforce-password-recovery/ seems like exactly what you're after. The other one to try is OTFBrutusGUI - which can be had from http://www.tateu.net/software/ - though it has little documentation beyond scattered forum posts (such as http://www.tateu.net/forum/index.php and ...


12

Keyfiles can almost accomplish this. The idea is the encryption key is stored as a file rather than a phrase the user memorizes. Keepass/KeepassX offers keyfiles as an option for securing the password database instead of a passphrase. The key can be more secure because it can be of much longer length than something a human needs to use, but the downside is ...


11

Before encrypting, you must first define what kind of property you want to achieve, and what are the paths which a putative attacker may use. Encryption is a tool for gaining confidentiality. Most security models also need some kind of controlled integrity check ("only passive" attackers are very rare). There are encryption modes which combine encryption ...


11

Truecrypt is appraised and widely used, but most of its usage is for disk encryption. As you are more interested on single files, I would either research how to effectivley use Truecrypt for single files or another option is GnuPG. "GnuPG is a volume and individual file encryption tool with support for a dozen encryption schemes, paired keys, and expiring ...


11

TrueCrypt is what you're looking for. Other (paid) solutions include PGP Desktop, and Jetico BestCrypt.


11

This is in no way shape form of fashion secure. It's akin to taking money from out of the mattress and placing it in the cookie jar. Let's illustrate what you said in five steps hades$ ls -ltha example.jpg -rw-r--r--@ 1 hades wheel 586K Dec 8 11:28 example.jpg hades$ md5 example.jpg MD5 (example.jpg) = a7ecc5e48db6cbfd609b9c6c6ca9b21f hades$ mv ...



Only top voted, non community-wiki answers of a minimum length are eligible