Questions tagged [encryption]

Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

Filter by
Sorted by
Tagged with
182 votes
9 answers

How to determine what type of encoding/encryption has been used?

Is there a way to find what type of encryption/encoding is being used? For example, I am testing a web application which stores the password in the database in an encrypted format (WeJcFMQ/8+8QJ/w0hHh+...
Karthik's user avatar
  • 2,304
67 votes
21 answers

Lessons learned and misconceptions regarding encryption and cryptology

Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
makerofthings7's user avatar
173 votes
4 answers

Where to store a server side encryption key?

I have some data that is symmetrically encrypted with a single key in my database. Rather than hard coding it into my code, I am looking for a safer way to store the encryption key. Where can I safely ...
Radek's user avatar
  • 1,833
418 votes
14 answers

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
Joshua Carmody's user avatar
79 votes
3 answers

Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?

For example, say the following are HTTPS URLs to two websites by one IP over 5 mins: "", "", "", "", "". Would monitoring of packets reveal: nothing, reveal only ...
blunders's user avatar
  • 5,062
259 votes
12 answers

Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?

Why can't a password hash be reverse engineered? I've looked into this ages ago and have read lots on it, but I can't find the explanation of why it can't be done. An example will make it easier to ...
Mucker's user avatar
  • 2,707
119 votes
6 answers

Why should one not use the same asymmetric key for encryption as they do for signing?

In an answer to a question about RSA and PGP, PulpSpy noted this: It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both). ...
Iszi's user avatar
  • 27.1k
24 votes
3 answers

Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?

From time to time, questions come up in this board concerning web applications that utilize client-side cryptography (or ‘in-browser’ cryptography), where these applications claim to be designed in ...
mti2935's user avatar
  • 22.7k
56 votes
2 answers

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
Kalai's user avatar
  • 811
52 votes
2 answers

Digital Certificate deployment: using two certs for each user?

At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs: One for signing documents, emails, etc. that is ...
George's user avatar
  • 2,813
105 votes
5 answers

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
user310291's user avatar
  • 1,403
101 votes
5 answers

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
Lernkurve's user avatar
  • 1,144
48 votes
5 answers

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
Sergey Romanovsky's user avatar
22 votes
3 answers

Is multiple encryption a good idea?

I know that many encryption algorithms, while secure, have vulnerabilities. To reduce risks, would multiple encryption like this Blowfish_CbC ( Rc2_OFB ( AES128_CBC (myfilecontent))) be a good idea? ...
Surfer on the fall's user avatar
144 votes
14 answers

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
Luke Sheppard's user avatar
33 votes
5 answers

Compute the AES-encryption key given the plaintext and its ciphertext?

I'm tasked with creating database tables in Oracle which contain encrypted strings (i.e., the columns are RAW). The strings are encrypted by the application (using AES, 128-bit key) and stored in ...
Null Pointers etc.'s user avatar
29 votes
6 answers

Principle of asymmetric algorithm in plain english

I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
Sivachandran's user avatar
8 votes
3 answers

How to login and encrypt data with the same password/key

I've made a "vault" web app in PHP for storing passwords, credit card numbers, etc. It's mostly just for myself, but I'm practicing building it with multiple users in mind. I use two way encryption to ...
Joel Mellon's user avatar
71 votes
3 answers

How to estimate the time needed to crack RSA encryption?

How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
Predator's user avatar
  • 961
110 votes
5 answers

What kinds of encryption are _not_ breakable via Quantum Computers?

There's the recent article NSA seeks to build quantum computer that could crack most types of encryption. Now I'm not surprised by the NSA trying anything1, but what slightly baffles me is the word "...
Tobias Kienzler's user avatar
76 votes
3 answers

symmetric encryption session keys in SSL/TLS

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
lurscher's user avatar
  • 1,230
56 votes
5 answers

Are phone calls on a GSM network encrypted?

When I make a call on my cellphone (on a GSM network), is it encrypted?
Ram Rachum's user avatar
  • 2,028
47 votes
3 answers

Is there any advantage to splitting a password?

I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm. The LM hash is computed as follows: The user’s ASCII password is converted to uppercase. This ...
Bill the Lizard's user avatar
39 votes
1 answer

Why can't I use the same key for encryption and MAC?

I wrote a simple file encryption program as an example of how to do encryption correctly, but after reading a questions about encryption + MAC, I think I made a mistake by using the same key for both. ...
Brendan Long's user avatar
  • 2,908
15 votes
3 answers

Encrypt and Authenticate localhost-traffic?

I have some app-components on the same machine but in different languages which need to communicate. I am using socket communication over localhost to do so. The data transferred is confidential. ...
Biff Wellington's user avatar
505 votes
8 answers

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
jrdioko's user avatar
  • 13.1k
241 votes
6 answers

Is Telegram secure?

There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption. But they store all the messages in their servers and WhatsApp ...
ilazgo's user avatar
  • 2,753
179 votes
8 answers

Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?

As far as I understand, the 4 digit passcode is combined (in some fashion) with a key stored in secure read only memory (e.g. secure enclave chip or similar), where it is directly embedded into ...
user9806's user avatar
  • 1,689
68 votes
6 answers

Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?

Current setup We have a service that allows users to upload documents through a website and stores the uploaded documents encrypted on disk. The documents on disk are encrypted with a per-user key, ...
Monika's user avatar
  • 1,092
30 votes
4 answers

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
makerofthings7's user avatar
25 votes
4 answers

Why does PGP use symmetric encryption and RSA?

Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
Ken Bellows's user avatar
23 votes
6 answers

Why do you need message authentication in addition to encryption?

I've been reading up on Authenticated Encryption with Associated Data. The linked RFC states: Authenticated encryption is a form of encryption that, in addition to providing confidentiality for the ...
Jonathan's user avatar
  • 345
6 votes
1 answer

In PSK TLS, how is the key used for encryption derived?

I'm trying to decrypt a message sent over a secure communication channel using TLS_PSK_WITH_3DES_EDE_CBC_SHA. I now have the client random number, server random number, PSK identity and PSK value. My ...
bookhuntress's user avatar
93 votes
2 answers

How secure is Ubuntu's default full-disk encryption?

How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it? If someone could at least provide a link to some documentation or article regarding that ...
Jonnathan Soares's user avatar
64 votes
3 answers

When using AES and CBC, is it necessary to keep the IV secret?

If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key? ...
Stu Pegg's user avatar
  • 743
52 votes
8 answers

Can an open Wi-Fi hotspot be considered "secure" when using a VPN connection?

There are many open Wi-Fi hotspots scattered around from cafes to airports. I understand that a non-passworded Wi-Fi leaves traffic unencrypted and therefore available for hackers to read. I also ...
User1's user avatar
  • 3,041
50 votes
4 answers

Can I use a private key as a public key and vice versa?

I have code to encrypt data using a public key and decrypt it using a private key. This is useful when a client wants to send data to a server and know that only the server can decrypt it. But say I ...
Graeme Perrow's user avatar
41 votes
3 answers

Block chaining modes to avoid

Everyone knows that ECB operation mode with a block cipher should be avoided because of clear and obvious weaknesses. But little attention is given to comparison of the other modes in the context of ...
tylerl's user avatar
  • 83.2k
31 votes
6 answers

What ciphers should I use in my web server after I configure my SSL certificate?

There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list. ...
makerofthings7's user avatar
27 votes
4 answers

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
Caesar's user avatar
  • 484
27 votes
3 answers

How does non-ephemeral Diffie-Hellman key exchange become compromised in SSL when the RSA private key is leaked?

From my understanding, one of the major reasons we recommend Diffie-Hellman Ephemeral (e.g. DHE or ECDHE) over non-ephemeral DH, for SSL / TLS, is that compromise of the RSA private key (i.e. private ...
Polynomial's user avatar
  • 135k
18 votes
3 answers

Encrypting user data using password and forgot my password

I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database. So,...
Yousf's user avatar
  • 453
7 votes
3 answers

Digital Signature and Verification?

AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it. So public key is used to decrypt ...
Royi Namir's user avatar
167 votes
6 answers

Apple's open letter - they can't or won't backdoor iOS?

Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. Here's a summary: The FBI has an iPhone in ...
TTT's user avatar
  • 9,192
162 votes
7 answers

Why most people use 256 bit encryption instead of 128 bit?

Isn't 128 bit security enough for most practical applications?
H M's user avatar
  • 2,977
62 votes
7 answers

Asymmetric vs Symmetric Encryption

I am currently taking a Principles of Information Security class. While talking about different encryption methods, a large number of my classmates seem to believe that Asymmetric Encryption is better ...
matthew's user avatar
  • 1,080
42 votes
4 answers

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
Joe Enos's user avatar
  • 523
40 votes
6 answers

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
Roger C S Wernersson's user avatar
35 votes
4 answers

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from Gmail, Yahoo or Hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
luben's user avatar
  • 908
30 votes
7 answers

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
Jonas's user avatar
  • 5,183

2 3 4 5