298 reputation
1311
bio website
location
age
visits member for 2 years, 9 months
seen Sep 29 '12 at 17:19

Aug
22
comment How to ensure web application remains secured after intrusion of server
@MarkHillick Thanks for the suggestion.
Aug
22
comment How to ensure web application remains secured after intrusion of server
Thanks for the response, appreciate it.
Nov
17
comment OpenPGP Encryption / Decryption Process Using GnuPG
Ah I see, many thanks for your clarification.
Nov
17
comment OpenPGP Encryption / Decryption Process Using GnuPG
Many thanks, I really appreciate your answer. When you say 'powers that you grant to the supposed attackers', what do you mean by 'powers'? Could you give me a few examples please? Thank You.
Nov
17
comment OpenPGP Encryption / Decryption Process Using GnuPG
@mikeazo Thank you for your response. The web app is secured using SSL.
Nov
4
comment RSA 4096 with AES 256 Encryption Process Using PyCrypto
@MichaelKjörling Ah I see, thanks for the clarification.
Nov
4
comment RSA 4096 with AES 256 Encryption Process Using PyCrypto
@D.W. Ah I see, thanks. Just to clarify when you use the word "integrity" do you mean ensuring the authenticity of the data and when you use the word "confidentiality" do you mean ensuring that the data is not decrypted?
Nov
3
comment RSA 4096 with AES 256 Encryption Process Using PyCrypto
@MichaelKjörling Justice states "The CBC IV is not a secret, so long as you never reuse an IV." I am encrypting multiple data sets at any given time, therefore I cannot use the same IV. Do you disagree with not reusing an IV?
Nov
3
comment RSA 4096 with AES 256 Encryption Process Using PyCrypto
Thanks, some very good points.
Nov
3
comment RSA 4096 with AES 256 Encryption Process Using PyCrypto
Wow, great feedback, thanks - really appreciate it.
Nov
2
comment RSA 4096 with AES 256 Encryption Process Using PyCrypto
@MichaelKjörling My understanding is that in order to decrypt AES encryption you need to generate the cipher for decryption using the secret key and the IV (I'm using a unique IV and a secret key for different data sets for tighter security).
Nov
1
comment RSA 4096 with AES 256 Encryption Process Using PyCrypto
@TomLeek Thank you! I love clarity, have a lovely evening! :-)
Nov
1
comment RSA 4096 with AES 256 Encryption Process Using PyCrypto
@TomLeek Thanks. Just to clarify, would I be correct in saying that integrity checks serve to ensure the authenticity of the data rather than facilitating the strength of the encryption from being broken?
Nov
1
comment RSA 4096 with AES 256 Encryption Process Using PyCrypto
@BernieWhite Thanks for the response. The data is patient data and therefore needs to be kept highly private. I'm using the PyCrypto module.
Nov
1
comment RSA 4096 with AES 256 Encryption Process Using PyCrypto
@TomLeek Firstly, thanks for the great response, really appreciate it. I've updated the question that answers some of your questions. It's a case of both :-) The data that is being encrypted/decrypted is quite small so CPU cycles aren't really an issue. Also could you please elaborate on 'integrity check' How would the absence of integrity checks weaken security?
Oct
26
comment Are SSL certificates from a CA necessary for secure communication?
Thanks for that, it's given me more clarity.
Oct
24
comment Are SSL certificates from a CA necessary for secure communication?
Thanks for the response. How would an eavesdropper act as a man-in-the-middle, could you give an example please in the context of a web application?
Oct
24
comment Are SSL certificates from a CA necessary for secure communication?
Thanks for the response. Assuming I was the user and I could confirm an unsigned certificate would the communication channel be secure?
Oct
13
comment AES-256 OR RSA-2048 for web application security?
I really appreciate all the help, many thanks.
Oct
13
comment AES-256 OR RSA-2048 for web application security?
Firstly, thank you for the thorough and succinct answer, really appreciate it. In response to your question with regard to the 'attack model', I want to be sure the Internet facing server doesn't get attacked. Also when you say that nothing hinders an attacker changing the data to something else because of the use of a public key - I'm sorry I don't understand this, could you elaborate please? Thanks