Questions tagged [encryption]
Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
5,877
questions
68
votes
6
answers
29k
views
Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?
Current setup
We have a service that allows users to upload documents through a website and stores the uploaded documents encrypted on disk.
The documents on disk are encrypted with a per-user key, ...
- 1,092
67
votes
21
answers
70k
views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
- 50.9k
67
votes
4
answers
15k
views
Why is so much ransomware breakable?
The site: https://www.nomoreransom.org/ offers many decrypter tools for ransomware.
But why?
It shouldn't be so hard to use the Windows Crypto API (e.g. just google "create AES Key in Windows") to ...
- 711
67
votes
9
answers
30k
views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
- 2,734
64
votes
2
answers
8k
views
Why has the NSA had a hand in deciding on encryption standards?
The NSA has had a large hand in the design of at least two significant encryption standards: the Digital Encryption Standard, and its successor, the Advanced Encryption Standard.
Because of their ...
- 6,845
64
votes
3
answers
61k
views
When using AES and CBC, is it necessary to keep the IV secret?
If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key?
...
- 743
62
votes
10
answers
15k
views
Is there such a thing as a "Black Box" that decrypts Internet traffic?
I have been reading about the Snoopers charter bill that was passed in the UK this week.
It mentions a "Black Box" which is cited here: ‘Black boxes’ to monitor all internet and phone data.
It ...
- 3,041
62
votes
7
answers
79k
views
Asymmetric vs Symmetric Encryption
I am currently taking a Principles of Information Security class. While talking about different encryption methods, a large number of my classmates seem to believe that Asymmetric Encryption is better ...
- 1,080
61
votes
6
answers
118k
views
Can my IT department read my Google Hangouts chats while at work?
Is Google hangouts encrypted? Would my work's IT guys be able see pictures and text I send while on a work computer? Yes I know I shouldn't be sending stuff I don't want them to see while at work, but ...
- 713
61
votes
4
answers
39k
views
Why do HTTPS requests include the host name in clear text?
I'm having a little bit of trouble understanding why the HTTPS protocol includes the host name in plain text. I have read that the host name and IP addresses of an HTTPS packet are not encrypted.
Why ...
- 1,229
61
votes
5
answers
84k
views
Is 7-Zip's AES encryption just as secure as TrueCrypt's version?
The main difference being TrueCrypt creates containers and 7-Zip encrypts the file itself, so file sizes can be guessed. Now let's just talk about the strength and breakability of the encryption.
...
- 1,151
60
votes
7
answers
11k
views
Is there an encryption algorithm that allows for a single payload to have two different outputs based on the password?
Suppose I have some confidential information that is encrypted and I'm forced/compelled to disclose that password.
My goal is to make that decrypted payload seem meaningful / and the password valid. ...
- 50.9k
60
votes
4
answers
107k
views
How secure is 7z encryption?
I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters:
Compression parameters:
Archive format: 7z
Compression level: Ultra
...
59
votes
2
answers
36k
views
How Does A Random Salt Work? [duplicate]
I don't understand how using a random salt for hashing passwords can work. Perhaps random salt refers to something other than hashing passwords? Here is my thought process:
The salt is used to add ...
- 771
58
votes
9
answers
79k
views
How to securely send private keys
What is the recommend way and best-practice to send private keys and SSL private keys? I was thinking of zipping up the files, then using gpg:
gpg -c thefile.zip
The problem then becomes how do you ...
- 1,237
58
votes
5
answers
63k
views
Standards for encrypting passwords in configuration files?
My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they don'...
- 1,438
57
votes
8
answers
7k
views
Online backup : how could encryption and de-duplication be compatible?
A "soon to enter beta" online backup service, Bitcasa, claims to have both de-duplication (you don't backup something already in the cloud) and client side encryption.
http://techcrunch.com/2011/09/...
- 5,507
56
votes
10
answers
16k
views
Is it really safe to use Signal or Telegram on untrusted phone hardware?
How safe are we when we use phone hardware from untrusted manufacturers and use end-to-end encrypted communication like Signal and Telegram? Are our conversations really safe from keyloggers or ...
- 587
56
votes
17
answers
4k
views
Can we still provide confidentiality when cryptography is outlawed?
In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
user185
56
votes
13
answers
23k
views
Is WhatsApp or Facebook Messenger secret conversation a reasonable method for transferring passwords?
I have the Netflix account in our family, meaning I have the password.
It's a secure password, with 16 characters, including symbols, numbers and uppercase, for example 3?TeJ)6RK]4Z_a>c, which has ...
- 950
56
votes
6
answers
52k
views
What are the differences between TPM and HSM?
TPM (Trusted Platform Module) and HSM (Hardware Security Module) are considered as cryptoprocessor, but what are the differences exactly?
Does one of them has more advantages than another?
- 2,764
56
votes
2
answers
82k
views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
- 811
56
votes
5
answers
47k
views
Are phone calls on a GSM network encrypted?
When I make a call on my cellphone (on a GSM network), is it encrypted?
- 2,058
55
votes
5
answers
50k
views
Encryption and compression of Data
If we want both encryption and compression during transmission then what will be the most preferable order.
Encrypt then compress
Compress then encrypt
- 4,844
55
votes
8
answers
19k
views
If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?
I've been trying to figure out "practical encryption" (AKA "PGP") for many years. As far as I can tell, this is not fundamentally flawed:
I know Joe's e-mail address: [email protected].
I have a ...
- 559
54
votes
3
answers
31k
views
Is Signal still more secure than WhatsApp?
WhatsApp has "recently" deployed end-to-end encryption using the Signal protocol, which is of course also being used by Signal itself. The related white paper (PDF).
Now this raises the question:
Is ...
- 9,770
53
votes
4
answers
10k
views
Why would a password be hashed before being used to encrypt something?
When reading some documentation about the security of a product, I found that the vendor uses the SHA-2 of a password to encrypt data (AES-256), instead of using this password directly.
Are there any ...
- 9,038
53
votes
2
answers
11k
views
Digital Certificate deployment: using two certs for each user?
At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs:
One for signing documents, emails, etc. that is ...
- 2,833
53
votes
9
answers
65k
views
What does this Https - "not fully secure" warning mean?
I went to sign into a website today using Google Chrome and was presented with the following error:
Your connection to this site is not fully secure
Attackers might be able to see the images you're ...
- 3,041
53
votes
5
answers
84k
views
gpg --encrypt fails
When trying to encrypt files, I get the following error in KGpg editor window:
The encryption failed with error code 2
On the command line I get:
$ gpg --list-keys
/home/user/.gnupg/pubring.gpg
-...
- 1,241
53
votes
5
answers
35k
views
How do I verify that WhatsApp is using end-to-end encryption?
Slightly old news: Whatsapp Just Switched on End-to-End Encryption for Hundreds of Millions of Users
Is there any test that I can perform to verify that WhatsApp is indeed using end-to-end encryption ...
- 653
52
votes
8
answers
23k
views
Can an open Wi-Fi hotspot be considered "secure" when using a VPN connection?
There are many open Wi-Fi hotspots scattered around from cafes to airports.
I understand that a non-passworded Wi-Fi leaves traffic unencrypted and therefore available for hackers to read. I also ...
- 3,041
51
votes
3
answers
114k
views
How can I check that my cookies are only sent over encrypted https and not http?
I read a blog post GitHub moves to SSL, but remains Firesheepable that claimed that cookies can be sent unencrypted over http even if the site is only using https. They write that a cookie should be ...
- 5,203
51
votes
5
answers
63k
views
GnuPG decryption not asking for passphrase
I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away.
Does it store the secret key somewhere and uses it (I ...
- 703
51
votes
2
answers
23k
views
Is "real salt" the same as "initialization vectors"?
In the question about real vs. fake salt, the answers describe how real salt 'perturbs the encryption algorithm.' I know roughly how initialization vectors work; is this the same concept, or something ...
- 1,206
51
votes
5
answers
6k
views
What actions should I, as an end user, take in response to EFAIL?
There's a lot of talk about EFAIL:
The EFAIL attacks exploit vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext of encrypted emails. In a nutshell, EFAIL abuses active ...
- 65.6k
50
votes
9
answers
19k
views
Writing my own encryption algorithm [closed]
I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
- 637
50
votes
7
answers
11k
views
Doesn't the choice of encryption algorithm add entropy by itself?
Let's say someone has my encrypted data and he wants to decrypt it. People always talk about how the length of the key (e.g. 256 bits) decides about the entropy of the encryption, which totally makes ...
- 617
50
votes
8
answers
11k
views
How does malicious software encrypt victims' files so quickly?
Encrypting a file to me is akin to dealing with a very long string, feeding it into the hashing or encryption function to get another long encrypted string (or a hash in the case of hashing).
This ...
- 8,773
50
votes
4
answers
50k
views
Can I use a private key as a public key and vice versa?
I have code to encrypt data using a public key and decrypt it using a private key. This is useful when a client wants to send data to a server and know that only the server can decrypt it.
But say I ...
- 602
50
votes
5
answers
13k
views
How does a country block its citizens from accessing a site?
Following Turkey's recent social site blocks, I am wondering how can you efficiently accomplish that as a country. Similar for a big company.
Blocking IPs → easy to circumvent, (proxys, tunnels, etc)...
- 2,871
49
votes
7
answers
17k
views
What is the point of encrypting the home directory?
If I have selected a good password and kept it secret, what is the point of encrypting my home directory, as a setup option with some flavors of Linux offer during setup?
Won't the Linux permissions ...
- 682
49
votes
3
answers
78k
views
Which host key algorithm is best to use for SSH?
When you first connect to an SSH server that is not contained inside your known_hosts file your SSH client displays the fingerprint of the public key that the server gave. I found from this question ...
- 819
48
votes
10
answers
23k
views
Is full disk encryption on a server in a secure data center pointless?
I am having a debate with several people regarding how much protection full disk encryption provides. dm-crypt is being used to encrypt data which is required by my company to be encrypted at rest. ...
- 649
48
votes
5
answers
71k
views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
48
votes
5
answers
12k
views
HTTPS still NSA-safe? [closed]
There are exerpts, that say that using https can be broken by the NSA by now.
So is https still a solution for secure web-browsing?
source: http://www.digitaltrends.com/web/nsa-has-cracked-the-...
- 2,390
48
votes
8
answers
11k
views
HTTPS is widely adopted, why isn't encrypted e-mail as popular?
I don't have an education in computer science, I've just become interested in information security and encryption lately.
I'm struggling to understand why encrypted web browsing using HTTPS has been ...
- 589
48
votes
4
answers
16k
views
Aren't keyfiles defeating the purpose of encryption?
I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
- 787
48
votes
2
answers
136k
views
RSA public key and private key lengths
I'm having a problem understanding the size of an RSA public key and its private key pair.
I saw different key sizes for RSA algorithm (512, 1024,... for example), but is this the length of public ...
- 849
48
votes
2
answers
21k
views
Web Application encryption key management
In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions:
...
- 591