New answers tagged

0

McNerdHair is correct to require you to use an authenticated mode. There are more options than GCM mode though: GCM mode is fast. It is sometimes called a 1.5 pass authenticated mode because of the fast GMAC calculation. It is standardized by NIST. CCM mode is another NIST certified mode specifically created for packet encryption, i.e. transport mode ...


5

You should always use an AEAD mode if you can, especially over the network. Crypto++ seems to support GCM, which is a good AEAD mode that has seen use in TLS 1.2. (There are others that are just as good, but TLS's "star power" lends GCM a lot of credibility.) Importantly, AEAD modes authenticate "additional data." This is unencrypted data not included with ...


0

You could consider FDE (full disk encryption) of the [ server | SAN | NAS ] that the data is resting on. If it's a Windows server, consider BitLocker: https://technet.microsoft.com/en-us/library/cc732774(v=ws.11).aspx


1

EXIF data is metadata. Basically any (unencrypted) metadata can be altered anytime with access to (a copy of) the file. Your idea of creating an executable to open images and protect EXIF data seems a bit like building a underground bunker just for storing the labels on and tabs in a physical folder. Apart from the practical problems like system rights ...


1

Not an answer but you asked for suggestions and this would be a lot for (SX) comments. (0) openssl pkcs8 -topk8 ... -v2 aes-128-cbc -nocrypt is misleading at best if not wrong. If the output file is not encrypted, it doesn't matter what algorithm is not used to encrypt it. (1) openssl enc -pass file: (or -kfile) reads the first line of the file as a string,...


1

Using the same Key and IV pair for multiple file encryption is very dangerous because encrypting the two files with the same same content will result the same ciphertext for any block mode encryption. Here are a few related posts about this: Why must IV/key-pairs not be reused in CTR mode? Dangers of using CTR mode for encryption AES-CBC and IV — ...


1

As I understood the problem you are trying to protect the firmware file over web when board needs to be updated(Firmware Update), correct me if I'm wrong. Why you are mixing symmetric and asymmetric cryptography altogether, even you can achieve your goal by only using asymmetric cryptography. As you mentioned you are generating the public and private key ...


2

Many file-encrypting ransomware viruses add some "unique" file extension to the name of the affected file and leave a "manual" of how to decrypt the files in the affected directories. This is one of the easiest ways to detect them. On windows file servers you can set up the file server ressource manager to look for those files and block the creation or ...


-1

The best way that I would recommend would be to use a storage solution that offers block level storage vs file-system level storage. Many SAN solutions, and shinier cluster-based storage solutions like gluster and ceph, offer periodic snapshots of the storage blocks. Got ransomware? Roll back to your most current snapshot. Poof, no harm done. (After you ...


0

I'd recommened you use a time-tested compression library that is capable of strong encryption (AES-128/256) to wrap your entire file. The reason is that designers of those file formats have already evaluated potential attack vectors and have built them into the format requirements. Libraries implementing those formats thus have a minimum standard to adhere ...


2

It is entirely up to you. In Java for example, there are libraries (cryptographic functions should not be implemented from scratch) for AES encryption that let you use this cipher to encrypt a byte stream with a given key and IV. So most often, even when using libraries, you are still left with the problems you mentioned: Where should meta information be ...


2

I'm the author of AxCrypt, a file-encryption software. It does not create encrypted virtual disk containers, nor does it do full-disk or partition level encryption. Yes, it might give you a false sense of security for locally stored files, and why I recommend that it's used together with full disk encryption for local security. Even without that it still ...


2

Yes file-encrypting software can give you a false sense of security for the use-case you are interested in where the host operating system (windows in you case) is generating certain artifacts from the sensitive files (like swap files, thumbnails etc) and storing those in non-encrypted files. Thats why I use full disk encryption with Bitlocker. However, the ...


4

When & How to Properly Encrypt When deciding where and how you want to apply encryption, it is important to consider what sorts of attacks you're actually expecting to prevent and whether or not the data you're encrypting actually needs strong protection in the first place. This breaks down into three main factors: Sensitivity of the data. A database ...


0

Yes (I found a sub-version of TeslaCrypt to do that a while back) , but most will only hunt for extensions. Some have different behavior like encrypting full folders with have the majority of files of known document types. Something as simple as having a .tx instead of .txt will many times keep your files safe. The problem is that the methods of eliminating ...


1

It depends.The application used to open the file decides what happens with it. Assuming you mean double clicking the file in the windows explorer this by default means, if it's an .exe file it will be run as a program. If it's a .jpg it's passed to the set default image viewer for .jpg files. Only if you rewrite the executable, or wrap it into an other ...



Top 50 recent answers are included