Tag Info

New answers tagged

1

For what it's worth, I'm on the enterprise security team overseeing half a dozen major companies that we own (mostly in USA), totaling over 10,000 employees, and we don't employ SSL decryption anywhere. A technique like that isn't even on our radar.


3

"SSL decryption" (through a firewall-controlled CA and on-the-fly MitM) is a feature offered on most "expensive" firewall appliances, so one can say that most big companies can deploy SSL decryption. Whether they really do it is another matter. Common reasons for not using that feature include: Legal concerns. In many jurisdictions, employees are allowed ...


1

I believe it depends on which industry you are in. It might be justified if the company has lots of proprietary content which they are afraid of competitors getting their hands on. Some companies even have policies forbidding the use of internet for non-work related purposes. Therefore, if you are using the internet solely for work purposes, decryption of ...


4

Why it does not guarantee integrity is easier to see in the case of a stream cipher like RC4, where the encryption is a bit-by-bit XOR of the data with a key-dependent stream. Basically, the encryption of message m is: e = m XOR sk, where sk is the RC4 output (a long stream of pseudorandom bits produced from the key k). Suppose that you ...


2

The problem is that hashing provides nothing in terms of integrity in your scenario. You are relying on the encryption alone to assert integrity. If I get a hold of the message and decrypt it, I could alter the message, recalculate the hash, encrypt it again and pass it on. If you trust encryption alone to provide integrity, then this process works, but ...


1

An attacker would have to have access to the encryption key to decrypt the volume, modify a file, then re-encrypt. An attacker couldn't just modify the straight encrypted data. Then when you went to decrypt the data, the decryption would fail. As long as the encryption key is secure you shouldn't have any problems. If you're worried about file ...


6

Near impossible, or at least very difficult. First, there is too much data. It would take a VERY long time to compute a hash of the entire HDD every shutdown and again for every boot. You could alternately use chaining of hashes though to get around that, but it would require a specialized file system. Second however, even if you were willing to wait for ...


4

You can have both integrity and confidentiality. There is no such "exclusion". However, you must remember that they are different things provided by distinct algorithms. Piling layers of encryption does not provide integrity. Integrity is normally obtained with a MAC, while confidentiality relies on encryption. Combining encryption and a MAC algorithm ...



Top 50 recent answers are included