Tag Info

New answers tagged

0

Also guessing; the doc is encrypted with 2 passwords (doc owner knows both) the first password starts to decript it 10 years later the second password is required to finish Having the docs decrypted 10 years later may be not an option for the torturer, but it could be ok for the owner of the info.


1

There are very interesting answers there. One warning though: I was once offered to the ATM access to my bank account via a finger scan instead of the typical PIN. I refused. The bank was then assuring me that they guarantee that a copy of my fingerprint cannot be used (yeah, it was a few years ago) I then told them that I am not sure that the bad guys know ...


5

Here is an original technique I have come up with that can survive a rubber-hose attack: Get a stack of cash, about 50 one-dollar bills. Maybe mix some fives and tens in with them. Shuffle them into a random order Derive a password from the serial numbers, for example by taking the two least significant digits from each bill in order to form a 100-digit ...


0

Here's a plausible scenario Assume that the encrypted file has two passwords (passkeys if you may), one that successfully decrypts the file and one that irreversibly damages the file. For example, it could do a deep format. Let's say that the password which correctly decrypts the file is A and the password which destroys the file is B Extending this, ...


4

While I haven't seen the film, I can easily imagine a randomly generated passcode which changes every [brief time window here]. Some online gaming security protocols started doing this a couple years ago, such as Battle.net (Blizzard - games like World of Warcraft, Starcraft, Diablo) Add in the fact that you can only get the most recent passcode from a ...


4

What you describe here is called a known-plaintext attack. The attacker has at least part of the plaintext, and tries to use it to figure out the key. AES and all other modern encryption algorithms must be able to withstand this type of attack. So the answer is no.


46

Shamir's Secret Sharing is a method for this. It allows one to encrypt a file with a public / private keypair, and then effectively split up the parts of the private key to be distributed to several different people. After that action (and assuming the various parts and original input private key are destroyed after distribution), it would require a quorum ...


27

All of our answers are speculation, of course, but I suspect that the most likely way that the documents are protected are by following Bruce Schneier's advice regarding laptop security through airports: Step One: Before you board your plane, add another key to your whole-disk encryption (it'll probably mean adding another "user") -- and make it ...


-2

It might refer to having multiple possible decryption states. Basically, you start with an extra-large blob of encrypted data, and multiple keys. Each key results in a different document. Obviously, the encrypted data needs to be large enough to hold all documents, but there's no way to prove how many keys exist. Make it large enough to hold 10 documents, ...


4

I haven't seen the documentary, but in addition to what others have spoke about, he could be talking about public/private key encryption. You encrypt a file with the public key provided by an anonymous third party who shares your view. Only they can decrypt the file, and you don't know who they are. So he has a document, encrypt it so it is protected and ...


9

Keyfiles can almost accomplish this. The idea is the encryption key is stored as a file rather than a phrase the user memorizes. Keepass/KeepassX offers keyfiles as an option for securing the password database instead of a passphrase. The key can be more secure because it can be of much longer length than something a human needs to use, but the downside is ...


14

He might be referring to neuroscientific methods of cryptographic primitives such as those outlined in the following paper: https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final25.pdf Basically, you can prevent against "rubber hose attacks" as they call it (torture the password out of somebody) by training the user via some sort of ...


2

You have to create a hidden volume for two related reasons. If you are arrested by the government and they suspect that some of the data in the encrypted volume is evidence, you can be forced to provide the password. Since TrueCrypt advertises its ability to create a hidden volume and encourages its use (and that's stating it mildly) the government is ...


27

Your first question is really a legal one, and you seem to be assuming two things: The attacker is a government of some sort. That government actually respects citizen privacy and requires some sort of reasonable suspicion before it can force people to give up encryption keys. Neither of those assumptions are necessarily true. For all you know, some ...


4

Your assumptions in 1 are just false in many places. In the US, you cannot be forced to hand over encryption keys. That is not generally the case; in the UK, the Regulation of Investigatory Powers Act makes it a criminal offense to not surrender encryption keys when asked. Assuming "just because they know I encrypt my data doesn't mean they think I'm ...


18

You're wrong in your assumptions. There are many legal jurisdictions where you can be required to produce passwords for encrypted data on suspicion, rather than proof, that the data may be relevant to a criminal investigation. If you don't provide your password, you can be jailed. But if there's no encrypted volume visible, they don't know to do it. For ...


3

Process-based access control only works on data in transient memory (e.g.: RAM). Once data is stored on a semi-permanent media (e.g.: hard drive, flash drive, DVD, etc.), that media can easily be connected to a system that will not honor any access restrictions that are enforced in its native environment. You could add process-based access control to the ...


1

Your scheme does not protect against an adversary choosing the same SigningKey as an honest party. Even if that is not a problem, whether or not an adversary could falsely "get credit for" a plaintext still depends on the details of PKCS#1 v1.5, since it would need to be infeasible for an adversary to find a different malicious SigningKey for which is ...


2

Compression is not security at all. You may be confusing compression with steganography data hiding but regardless, neither provides true security but instead merely hides things. Encryption of course does secure your data. From Wiki: Brute-force attacks can be made less effective by obfuscating the data to be encoded, something that makes it more ...


0

Multiple attacks with very evocative names have shown that compression can induce vulnerability by leaking infos about the plaintext: CRIME (Compression Ratio Info-leak Made Easy) BREACH (Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) Basically, if you can control some part of the plaintext, you can guess other parts of ...


4

There are several factors that come into play. The first is that encryption should hide patterns: if you have a file that contains the same content repeated several times over, encryption should hide this fact. If you have a weak encryption scheme, that leaks some information about patterns in the plaintext in its ciphertexts, then compression can help ...


-2

Imagine that someone is trying to brute force decrypt a file, and when a certain password is tried, an obvious English text file pops out. Or suppose that the same exercise is tried, but all the bytes in the text file were shifted forward 79 places before encryption. The second approach is stronger, even though obfuscation (shifting bytes) is NOT ...


1

It seems you need your own protocol, as Tom explained. If you decide to do this, you should sign the message (with cryto_sign()). When Alice sends a message to Bob, she wants to make sure than an active eavesdropper Eve does not alter the message. Therefore you have authentication (which crypto_box() takes care of automatically). When Alice sends the ...


2

You're encrypting your document with a polyalphabetic cipher (the best-known of which is the Vigenere cipher). Techniques for breaking these have been known since the mid-1800s. Yours is particularly vulnerable since the number of alphabets (64) is fixed, and the alphabets are simple rotations (as opposed to shuffles). If you really want to protect your ...


6

this is only brute-forceable if you know what to expect Stop right there. What you're describing is security through obscurity. You're betting that an attacker won't be able to know or guess your scheme. This is a really, really, really terrible assumption. It's an alluring one, but time and again it's been proven wrong. Any proper security scheme must ...


0

Generate a string which incorporates upper case, lower case, numeric and special characters of a minimum length of 12 characters and a maximum length of 25 characters, with random truncation within the parameters described. Additionally, the string's algorithm would ideally contain a randomized pattern such that the algorithm used comes from a set of ...



Top 50 recent answers are included