Questions tagged [encryption]

Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

Identity confirmation using PIN to decrypt previously issued token

I am building an app (for web and mobile) that requires a user pass two stages of authentication/authorisation in order to access a server-side API and subsequently use the app. First, they must ...
0
votes
1answer
70 views

Are there any security concerns with storing private keys in browser's javascript?

I'm working on a web app, and I know little about security/cryptography (for now, still learning) but I'm trying to set up a front-end where: At the very beginning, the user puts in their private key....
2
votes
1answer
70 views

Is this key exchange algorithm secure and valid? [on hold]

I'm writing reliable UDP implementation and I want it to be secure. Also, I want to make use of elliptic curve cryptography. I don't have the proper education to really understand the math behind this ...
-1
votes
0answers
45 views

How to determine encryption type? [on hold]

What type of encryption is this? l��� $�a&e;u��K��9��d���6�m�j�� Fh3� g\拡b��8o;��6�=S�[�^e�tGB�ʪ�o�Q}p��`��k�9/����A�FA �Va���H�hjvǺH4�/c# ��7 %��$�yO���VS����/g/u�<�{�o> Z&y�����z��a�C&...
1
vote
0answers
20 views

Can I use Keycloak as a key store like Hashicorp Vault for an example? [on hold]

Can I use Keycloak as a key store like Hashicorp Vault for an example? Keycloak has realm keys, can I use this feature as a secure key store and use it to encrypt and hash data in my web application? ...
0
votes
1answer
63 views

Recover corrupted password protected Zip

Good evening. I have a password protected zip archive (Zip 2.0 CryptoZip) with a .txt file with sensitive info inside. The problem is that I can't extract it. 7Zip:"Data error : Wrong password?" ...
6
votes
1answer
126 views

How do RF remote clones manage to clone rolling codes?

I wanted to clone my garage door remote to learn more about IoT security in particular so I read a lot about rolling codes, and the more I read the more I am convinced there is no way to actually ...
-2
votes
0answers
45 views

Using VOIP encryption when all endpoints are compromised

Yo listen up here's the story about a little guy who's internet uplink is mostly compromised, same with the rest of the family including smarthpones, routers ... And all day and all night he is ...
0
votes
0answers
28 views

encrypt/decrypt arbitrary data provided in custom attribute by IdP in SSO scenario

I am considering the following design for application with client-side encryption Let' say we have web application that manages/stores sensitive business data of users, and we do not want to know ...
3
votes
1answer
45 views

Can any private key information be exposed when signing an email? [duplicate]

So I know that PGP encrypted email can be vulnerable to a known-plaintext attack from a known, consistant email footer or greeting (“Hello”, “Yours truly, xxx”, etc), but does the same thing apply to ...
1
vote
1answer
61 views

Bypassing NET::ERR_CERT_DATE_INVALID

When I try to access the Openmailbox web site, Google Chrome returns a NET::ERR_CERT_DATE_INVALID error. The details state that "openmailbox.org normally uses encryption to protect your information. ...
1
vote
1answer
71 views

Is encrypting the FireFox folder with EFS protecting saved passwords in case of someone accessing the hard drive?

What I want to do: Use the "save password" feature in FireFox (on Windows 10) without using FireFox's master password feature. What I'm afraid of: Someone stealing my laptop or getting access to my ...
0
votes
3answers
106 views

Encrypt Different Users with unique keys

I have a database that I want to implement an encryption per x amount of users. Say I have 1000 Users in the database and I wanted every 1000 encrypted differently then I would generate a new key and ...
4
votes
0answers
128 views

What are the actual merits of Galois/Counter Mode? [migrated]

GCM (Galois/Counter Mode), in particular in combination with AES, has been a de-facto gold standard for years. Encrypt and authenticate in one step, that's just too awesome, and terms like AEAD work ...
2
votes
1answer
94 views

Can I avoid storing data on the web by emailing it?

My client wants to gather some sensitive info via an app. I don't want to store it on the server. Is this a good plan? Encrypt it on the phone using a public key embedded in the app. Send it to the ...
0
votes
0answers
56 views

Is there any Password Manager that supports Hardware-Based OTP encryption/decryption?

I see that some projects like KeepassXC use CR based OTP to provide some additional security. While this is discussed quite controversial my opinion is that - for quite some cases (e.g. most non-...
1
vote
1answer
55 views

Using Bitlocker and hidden volume feature of VeraCrypt together

I'm currently using Bitlocker encrypted external hard drive. The drive is entire-encrypted and single partition. After dividing the drive into partition A and B, I'm planning to make a hidden volume ...
1
vote
1answer
96 views

What can a hacker do if I publish my email id and password but have 2FA on all of my accounts?

I have 2FA on ALL of my accounts. But my password was leaked in 7 breaches. Unfortunately I have used the same password for most of the accounts. Is it possible for him/her to bypass the 2FA?
0
votes
2answers
76 views

Can National Insurance number and Unique Taxpayer Reference be stored unencrypted in a database?

Should these details be stored encrypted, not at all or in plain text in a database? These are both UK terms, used to identify individuals to the tax authorities; the NI number is used more widely, ...
1
vote
0answers
70 views

Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?

Our team's goal We want to protect our sensitive data from being potentially data-at-rest exposed after we relinquish a Linux VPS (see below) provided by a hosting service. We're exploring simple(r) ...
0
votes
1answer
61 views

Common Encryption types with keys stored in Base64

I am a noob :) I am attempting to recover a password from a piece of software. The software has a XML file contains three fields that appear important to this process: Password Value, EncryptionKey ...
1
vote
1answer
67 views

How do i validate that a PGP Public Key the user inputs is valid?

we want to encrypt emails that we send to the user with his public key. this works great, however the user can also type in a broken/invalid public key ("asdf123") and then the encryption won't work ...
31
votes
3answers
4k views

Should I be able to see patterns in a HS256 encoded JWT?

I was fiddling with https://jwt.io/ using this header { "alg": "HS256", "typ": "JWT" } when I realized that replacing the payload name with something repetitive like AAAAAAAAAAAAAAAAAAAA would ...
1
vote
0answers
39 views

Does Telegram official client encrypt its local storage on iOS with app-specific passcode?

I failed to find any proofs for / against the question in the subject. My end-user question is: if I set up a long paraphrase on official Telegram client, can I be sure that history of chats (...
0
votes
1answer
53 views

How to implement server/client software where only user can access his files via key-pair

I want to implement a server side application with REST API - clients are browser and mobile app. User will have a login (email, password) and will store his files on the server. These files must be ...
0
votes
0answers
38 views

I found this easter egg, any ideas what kind of encryption it is? [duplicate]

I am looking to have the cryptography identified of this encrypted message aHR0cHM6Ly9nb28uZ2wvZXY5SDN1 Any ideas what crypto was used here? Thank you
3
votes
0answers
75 views

Does adding more letters provide added security compared to a standard substitution cipher? [migrated]

Let's say that a substitution cipher had 52 symbols instead of 26. For this, we would include all lower case and upper case letters. This creates a key space of 52! wehere the cipher text can contain ...
0
votes
1answer
69 views

Concept needed: user specific encryption on server

In a typical mobile project, a user can register and login into an app, and the app communicates with a server. For simplicity, consider an app where the user can register/login using the OAuth2 ...
1
vote
2answers
70 views

Most secure algorithms for KDF and Public Key Encryption [duplicate]

I'm developing an application which will need to derive a private/public key pair from a user provided password, and then use the public key to encrypt some text (up to 1000 characters in length) such ...
0
votes
1answer
29 views

How to encrypt user data in app using Google Sign-In

I am currently writing an application which needs to store user data encrypted in the database. One of the requirements is that some of the data stored in the database needs to be encrypted in a way ...
0
votes
1answer
61 views

How are files in file container (posibly in archive file) encrypted? [closed]

I see advantage of using container in it that offer work with more files rather than with one but is there some advantage in encryption technique?I would like to know if it encrypt each single file in ...
1
vote
0answers
32 views

What should the hamming weights be between every iteration of AES? [migrated]

I have an assignment where I have to print out the hamming weights between every iteration of AES's diffusion steps and I have been getting a maximum weight on every iteration, but I can't seem to ...
0
votes
0answers
38 views

Server/Client token storing mechanism

We have an iOS/Android app communicating with a central database. Each account created from the app, has an associated private key stored there, used to encrypt some private info needs to be stored ...
0
votes
1answer
47 views

SSL decryption/visibility on the host [closed]

Can host app see traffic before network encryption? E.g. can a host-based VPN app see cleartext traffic (http to https) to make any traffic routing decisions? Considering the TCP/IP model, all operate ...
5
votes
1answer
204 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
2
votes
0answers
50 views

ECDSA ECDH Man In The Middle Attack

We have a long-term key used for signing/verifying the ephemeral keys. The problem is we have to first share the long term public key with the other party. Is it possible to avoid a man in the middle ...
0
votes
1answer
43 views

SFTP -What is Public Key is Duplicated on another server

I have an SFTP server. My ServerA wants to send a file to SFTP server, and i was told that ServerA public key needs to stored on SFTP server for Authentication purposes. My question is, if the public ...
1
vote
1answer
46 views

Looking for a specific quote about keys and transparent encryption implementation

I'm struggling to find a quote advising that we should be comfortable in sharing details of encryption methods and implementation with would-be attackers and the system still remain secure. The idea ...
1
vote
1answer
61 views

Why do we need DKIM to be used along with S/Mime?

S/Mime can be used to encrypt email and it can also be used by the sender to provide his digital signature so that the recipient is able to confirm the authenticity of the sender. Why then do we ...
2
votes
1answer
119 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
0
votes
0answers
30 views

Is it possible to encrypt a message stream with the same IV each time and for it to be secure? [duplicate]

I know we should ideally never reuse the IV (Depending upon the mode of encryption used), but is it possible to have a protocol which uses the same IV for the message stream and is as safe as one ...
-1
votes
1answer
81 views

Secret-Key Encryption Question (OFB mode) [closed]

Alice uses the OFB mode to encrypt her emails sent to Bob, but instead of using randomly generated IVs, she always uses the same IV to encrypt her emails. Charlie somehow gets the following data: ...
0
votes
0answers
29 views

How would i figure out what type of encryption is used in this instance? [duplicate]

I am trying to decrypt a file currently but am at a loss for what type of encryption this is, It could be a different file type that I do not know off the top of my head. What would be the best way ...
0
votes
1answer
47 views

Zero server knowledge encryption for media server

I'm making a little media server, just for fun, but I want to know if what I'm thinking makes sense. The idea is that the files will be stored on the server, encrypted. The file encryption key (...
1
vote
2answers
119 views

Securely editing encrypted text files

My method for editing encrypted text files is to decrypt them in a RAM drive, edit them, and then encrypt them. What I'm worried about is information from my text files being transferred to non-...
1
vote
1answer
58 views

Securing Code Secrets - What is the relevance if the host gets compromised?

I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
2
votes
0answers
36 views

BitLocker Sleep/Hiberate Settings for DMA protection

The Bitlocker the guidance from Microsoft is to disable sleep states and use hibernate in combination with TPM + PIN for elevated security against cold boot and DMA attacks. Unfortunately this is ...
39
votes
2answers
11k views

How do email clients “send later” without storing a password?

Email clients like Spark for macOS have a feature where a user can send an email later, at any given time, even when the computer is turned off. An SMTP server needs a password based authentication, ...
1
vote
1answer
141 views

How do PGP keys “expire”?

When creating a PGP key, you can choose when the key "expires". What does this mean and how does it work?
0
votes
0answers
28 views

Install Debian on a dedicated server remotely without sending any clear-text credentials

As stated in the title, are there any existing best practices to install Debian on a remote server, without sending clear text passwords over the link? For example - a lot of dedicated server ...