Tag Info

New answers tagged

-1

The red flag mentioned by Mark is not quite an argument. If you read their technical overview to the end you will notice that all keys can be stored locally and no internet connection is required. Nevertheless it is closed source. So no, you can not trust them.


1

If you can require that the ranges are block-aligned, the disk encryption modes (LRW, XEX, XTS, CTR, etc.) seem ideal for your purposes. ECB mode also works with block-aligned ranges, but is, well, ECB mode. If you need byte-level alignment, the only mode that looks promising is OFB mode: you compute a keystream that includes the range you want to decrypt, ...


13

With most file formats it is not difficult to identify the original filetype without knowing the original extension. A JPEG file, for example, always begins with the HEX sequence FFD8FF. Seeing that sequence at the beginning of a file tells you that it is very likely a renamed JPEG image. There are tools available which detect many common file formats ...


11

This is in no way shape form of fashion secure. It's akin to taking money from out of the mattress and placing it in the cookie jar. Let's illustrate what you said in five steps hades$ ls -ltha example.jpg -rw-r--r--@ 1 hades wheel 586K Dec 8 11:28 example.jpg hades$ md5 example.jpg MD5 (example.jpg) = a7ecc5e48db6cbfd609b9c6c6ca9b21f hades$ mv ...


4

A youtube video from Defcon 21: http://youtu.be/NG9Cg_vBKOg?t=6m19s The guy being investigated simply changed the extensions of the files (eg. from test.jpeg to test.txt). However when the crypto guys look at it their tool detects that the extensions don't match the files and these files are the first to be examined more closely by a human.


44

What you are doing is no kind of encryption, it is just obfuscation. It relies on security by obscurity. It may be enough to hide your files from an amateur/casual observer, but anyone analyzing the files in a hex editor is going to be able to rebuild and access them. Effectively your method is about equal in complexity to attempting file undeletion, for ...


6

No, this is not secure. The HMAC check is vulnerable to timing attacks. Since the author uses a standard string comparison, the check stops as soon as one character from the provided HMAC doesn't match the corresponding character from the expected HMAC. So the longer the common prefix, the longer the check takes. By carefully observing those time ...


1

The Pixelfck/SymmetricEncryption class seems to hit everything I would look for in a mcrypt abstraction system. It is using derived keys using what looks to be a standard algorithm (PBKDF2), employes AES128 in CFB mode, and uses a hash_hmac of SHA256. I would say it is reasonable to expect this class provides Authenticated Encryption and doesn't appear to ...


5

Recently, our clients want to encrypt their files for one reason: " They don't want FTP server admin has access to their files". With this requirement the encryption should not be done at the server side. Otherwise an administrator could just grab the content before it gets encrypted. And of course the management of the passwords/keys should also be ...


4

My suggestion is to have your clients manage their owns encryption password or certificates. Certain FTP clients will allow the use of encryption, as an example: http://www.coreftp.com/docs/web1/FTP_Encryption.htm. I want to make sure though that you're actually using some type of encryption for the transit of their data. You don't mention it and since ...



Top 50 recent answers are included