Questions tagged [encryption]
Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
934
questions
182
votes
9
answers
681k
views
How to determine what type of encoding/encryption has been used?
Is there a way to find what type of encryption/encoding is being used?
For example, I am testing a web application which stores the password in the database in an encrypted format (WeJcFMQ/8+8QJ/w0hHh+...
- 2,304
67
votes
21
answers
70k
views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
- 50.7k
173
votes
4
answers
150k
views
Where to store a server side encryption key?
I have some data that is symmetrically encrypted with a single key in my database. Rather than hard coding it into my code, I am looking for a safer way to store the encryption key. Where can I safely ...
- 1,833
418
votes
14
answers
68k
views
How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
- 4,475
79
votes
3
answers
12k
views
Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?
For example, say the following are HTTPS URLs to two websites by one IP over 5 mins:
"A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2".
Would monitoring of packets reveal:
nothing,
reveal only ...
- 5,062
259
votes
12
answers
139k
views
Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
Why can't a password hash be reverse engineered?
I've looked into this ages ago and have read lots on it, but I can't find the explanation of why it can't be done. An example will make it easier to ...
- 2,707
119
votes
6
answers
49k
views
Why should one not use the same asymmetric key for encryption as they do for signing?
In an answer to a question about RSA and PGP, PulpSpy noted this:
It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both). ...
- 27.1k
24
votes
3
answers
2k
views
Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?
From time to time, questions come up in this board concerning web applications that utilize client-side cryptography (or ‘in-browser’ cryptography), where these applications claim to be designed in ...
- 22.7k
56
votes
2
answers
81k
views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
- 811
52
votes
2
answers
10k
views
Digital Certificate deployment: using two certs for each user?
At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs:
One for signing documents, emails, etc. that is ...
- 2,813
105
votes
5
answers
67k
views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
- 1,403
101
votes
5
answers
33k
views
How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]
I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute.
Question
How can my employer be a man-in-the-middle when ...
- 1,144
48
votes
5
answers
70k
views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
22
votes
3
answers
21k
views
Is multiple encryption a good idea?
I know that many encryption algorithms, while secure, have vulnerabilities.
To reduce risks, would multiple encryption like this
Blowfish_CbC ( Rc2_OFB ( AES128_CBC (myfilecontent)))
be a good idea?
...
144
votes
14
answers
48k
views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
- 2,247
33
votes
5
answers
77k
views
Compute the AES-encryption key given the plaintext and its ciphertext?
I'm tasked with creating database tables in Oracle which contain encrypted
strings (i.e., the columns are RAW). The strings are encrypted by the application
(using AES, 128-bit key) and stored in ...
29
votes
6
answers
6k
views
Principle of asymmetric algorithm in plain english
I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
- 393
8
votes
3
answers
10k
views
How to login and encrypt data with the same password/key
I've made a "vault" web app in PHP for storing passwords, credit card numbers, etc. It's mostly just for myself, but I'm practicing building it with multiple users in mind. I use two way encryption to ...
- 191
71
votes
3
answers
126k
views
How to estimate the time needed to crack RSA encryption?
How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
- 961
110
votes
5
answers
26k
views
What kinds of encryption are _not_ breakable via Quantum Computers?
There's the recent article NSA seeks to build quantum computer that could crack most types of encryption. Now I'm not surprised by the NSA trying anything1, but what slightly baffles me is the word "...
- 7,798
76
votes
3
answers
29k
views
symmetric encryption session keys in SSL/TLS
This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
- 1,230
56
votes
5
answers
47k
views
Are phone calls on a GSM network encrypted?
When I make a call on my cellphone (on a GSM network), is it encrypted?
- 2,028
47
votes
3
answers
12k
views
Is there any advantage to splitting a password?
I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm.
The LM hash is computed as follows:
The user’s ASCII password is converted to uppercase.
This ...
- 6,781
39
votes
1
answer
12k
views
Why can't I use the same key for encryption and MAC?
I wrote a simple file encryption program as an example of how to do encryption correctly, but after reading a questions about encryption + MAC, I think I made a mistake by using the same key for both.
...
- 2,908
15
votes
3
answers
5k
views
Encrypt and Authenticate localhost-traffic?
I have some app-components on the same machine but in different languages which need to communicate. I am using socket communication over localhost to do so. The data transferred is confidential.
...
- 153
505
votes
8
answers
508k
views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
- 13.1k
241
votes
6
answers
288k
views
Is Telegram secure?
There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption.
But they store all the messages in their servers and WhatsApp ...
- 2,753
179
votes
8
answers
40k
views
Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?
As far as I understand, the 4 digit passcode is combined (in some fashion) with a key stored in secure read only memory (e.g. secure enclave chip or similar), where it is directly embedded into ...
- 1,689
68
votes
6
answers
29k
views
Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?
Current setup
We have a service that allows users to upload documents through a website and stores the uploaded documents encrypted on disk.
The documents on disk are encrypted with a per-user key, ...
- 1,092
30
votes
4
answers
26k
views
Checklist on building an Offline Root & Intermediate Certificate Authority (CA)
Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite.
Here is an image of the default cryptography settings ...
- 50.7k
25
votes
4
answers
14k
views
Why does PGP use symmetric encryption and RSA?
Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
- 353
23
votes
6
answers
18k
views
Why do you need message authentication in addition to encryption?
I've been reading up on Authenticated Encryption with Associated Data. The linked RFC states:
Authenticated encryption is a form of encryption that, in
addition to providing confidentiality for the ...
- 345
6
votes
1
answer
8k
views
In PSK TLS, how is the key used for encryption derived?
I'm trying to decrypt a message sent over a secure communication channel using TLS_PSK_WITH_3DES_EDE_CBC_SHA. I now have the client random number, server random number, PSK identity and PSK value. My ...
- 163
93
votes
2
answers
86k
views
How secure is Ubuntu's default full-disk encryption?
How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it?
If someone could at least provide a link to some documentation or article regarding that ...
- 1,041
64
votes
3
answers
59k
views
When using AES and CBC, is it necessary to keep the IV secret?
If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key?
...
- 743
52
votes
8
answers
22k
views
Can an open Wi-Fi hotspot be considered "secure" when using a VPN connection?
There are many open Wi-Fi hotspots scattered around from cafes to airports.
I understand that a non-passworded Wi-Fi leaves traffic unencrypted and therefore available for hackers to read. I also ...
- 3,041
50
votes
4
answers
48k
views
Can I use a private key as a public key and vice versa?
I have code to encrypt data using a public key and decrypt it using a private key. This is useful when a client wants to send data to a server and know that only the server can decrypt it.
But say I ...
- 602
41
votes
3
answers
29k
views
Block chaining modes to avoid
Everyone knows that ECB operation mode with a block cipher should be avoided because of clear and obvious weaknesses. But little attention is given to comparison of the other modes in the context of ...
- 83.2k
31
votes
6
answers
39k
views
What ciphers should I use in my web server after I configure my SSL certificate?
There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list.
...
- 50.7k
27
votes
4
answers
3k
views
Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
- 484
27
votes
3
answers
12k
views
How does non-ephemeral Diffie-Hellman key exchange become compromised in SSL when the RSA private key is leaked?
From my understanding, one of the major reasons we recommend Diffie-Hellman Ephemeral (e.g. DHE or ECDHE) over non-ephemeral DH, for SSL / TLS, is that compromise of the RSA private key (i.e. private ...
- 135k
18
votes
3
answers
8k
views
Encrypting user data using password and forgot my password
I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database.
So,...
- 453
7
votes
3
answers
6k
views
Digital Signature and Verification?
AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it.
So public key is used to decrypt ...
- 351
167
votes
6
answers
21k
views
Apple's open letter - they can't or won't backdoor iOS?
Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism.
Here's a summary:
The FBI has an iPhone in ...
- 9,192
162
votes
7
answers
259k
views
Why most people use 256 bit encryption instead of 128 bit?
Isn't 128 bit security enough for most practical applications?
- 2,977
62
votes
7
answers
78k
views
Asymmetric vs Symmetric Encryption
I am currently taking a Principles of Information Security class. While talking about different encryption methods, a large number of my classmates seem to believe that Asymmetric Encryption is better ...
- 1,080
42
votes
4
answers
87k
views
How (in)secure is POP/IMAP/SMTP
I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken:
The ...
- 523
40
votes
6
answers
11k
views
How secure are my passwords in the hands of Firefox using a Master Password?
I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
- 3,120
35
votes
4
answers
20k
views
What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?
I would like to ask what happens when an email is sent from Gmail, Yahoo or Hotmail public web email services?
I don't understand email protocols in details, but as far as I know email traffic is ...
- 908
30
votes
7
answers
4k
views
How to secure a WiFi network?
What do I have to do to secure a WiFi network? Is there any best practices?
I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
- 5,183