Tag Info

New answers tagged

1

They are defined in the standard, maintained on the OASIS website...symbols and abbreviations. And the list there matches yours.


0

Firstly, glad you did not suggest designing your own; that way lies years of insecurity and support nightmares. PGP supports a PKI with X509 certificates[1], though few people use it that way. Another option is S/MIME, with certificates issued by a well-known CA[2]. Either way, you get central management of the hierarchy of trust and can skip the headaches ...


0

I don't know if you are looking to "roll your own" solution, or if your business is willing to invest in a commercial product. If you are interested in a commercial product, Voltage Security has "Voltage SecureMail" http://www.voltage.com/products/securemail/ which would meet the needs you've described.


0

Why don’t use just use a tool like IRI FieldShield (works on any DB and flat-file via Eclipse or command line) and apply AES-256 format-preserving encryption as a rule across the SSN and ZIP code columns across your sources? That preserves realism, referential integrity, restricted access, and reversibility all at the same time.


0

Most if not all database engines support 'encrypted columns' which securely stores the data, so in this way yes there are tools that do this for you. Next you have the issue of searching based on those encrypted columns. http://dba.stackexchange.com/questions/23908/how-to-search-a-mysql-database-with-encrypted-fields The quick explanation is that you ...


0

To avoid the "not completely implemented" issue mentioned in Jens Erat's answer, use gpg --homedir on a temporary directory. You may need to modify the mktemp command based on your platform: gpg --homedir $( mktemp -d -t '' ) --import /tmp/somekey.asc


0

Apologize for posting a question without doing research on my own. Here is how i got around just in case anyone gets into the same bind convert the cert into bytes and then convert to X509Certificate. Then you can do X509Certificate.getSigAlgName(); Thanks Again


1

A key is a key. There is no such thing as a "RSA-with-SHA-1 key". A RSA key that can be used for signatures (using the PKCS#1 standard) will be used in conjunction with some other parameters, including a hash function such as SHA-1 and SHA-256; but there is no intrinsic property of a key that would prevent usage of SHA-1 or SHA-256 as hash function within a ...


5

Your description is a bit confused and appears to be wrong. In particular, we see Alice computing here Diffie-Hellman half gKA and then proceed to send... her Diffie-Hellman secret KA to Bob, which is not at all what she should do. Plain Diffie-Hellman works the following way: Alice generates (randomly) her secret KA and computes gKA. Bob generates ...


0

All the details of proper database information handling go well beyond the scope of a quick StackExchange answer. You really want to do this the right way. Part of your problem is the architecture where the database, and the web app accessing the sensitive info are on the same server. If that server gets compromised, so does the keying material for any ...


2

If you only check that the certificate is valid in the PKI, but not that it matches the server name (either the domain or IP address), then you can be fooled by a certificate issued to a different site. Suppose: I own malicioussoftware.com Thus I can but a certificate for malicioussoftware.com You (attempt to) connect to https://www.microsoft.com, but I ...


5

This is done as you say, except with an optimization. The email itself is encrypted with a newly generated random symmetric key; and that key is then encrypted with the public key of each recipient. This means that if you have a 2MB email and send it to 20 people, total size is a bit more than 2MB, not 40MB.


0

is there any way to both sides share a secret key and then generates key pairs using it You can derive further keys from an initial shared key, there are various key derivation mechanisms that would allow you to do this, but you still have the problem of distributing the initial key. Anyone who intercepts this key could replicate the derivation process ...


1

This is a security feature called certificate pinning (or public key pinning). In this case the browser knows which certificate (or public key) to expect and refuses any attempts to override it by the user. Twitter is included for public key pinning since Firefox 32. See https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning for more details.


8

Ardi does not obtain his private key from the PKI. The PKI obtains Ardi's public key from Ardi. Ardi owns a public/private key pair: a public key and a private key that "dance together" (they are two mathematical facets of a single object). The public key is meant to be public. The job of the PKI is to publish the public key, and offers some verifiable ...


0

I think you need to decide do you want to encrypt the whole Db, or do you want to Encrypt Each record individually. Encrypting the whole Db - is easy to accomplish. There are various mechanisms that you could implement. This mechanism provides good protection from being hacked/db stolen, but will be easy for your IT staff to read/steal the data. Encrypting ...



Top 50 recent answers are included