Questions tagged [encryption]

Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
114 views

Prevent server MITM attack

I want to create a secure messaging application such that you don't have to trust the server. Register with username and password. -> Generate a pair of PGP keys (RSA). -> Encrypt the private ...
user avatar
  • 1
0 votes
1 answer
67 views

What are the different combinations of public and private keys and what CIA do they provide?

I am preparing for the Sec+, currently reading the book, "Mike Meyers .... Certification Passport"(book in question is irrelevant to the problem), In the cryptography chapter, topic-public ...
user avatar
  • 1
0 votes
1 answer
58 views

When using a user password for client side encryption, do I have to store the salt for the user encryption key on the server?

The password of the user shall be used for client side encryption. A PBKDF and salt shall be used to derive a key from the user password. Do I need to store this salt on the server and deliver it to ...
user avatar
  • 695
0 votes
0 answers
18 views

What is the best method to safely erase Flash Drive, Hard Disk and NAND Flash from Smartphone? [duplicate]

I am consulting here to find out how the content of a storage device can be erased so that it is not recoverable. When I say, that it is not recoverable, I do not mean that methods that are too ...
user avatar
8 votes
3 answers
1k views

What makes a symmetric encryption algorithm cryptographically secure?

I'm trying to learn a bit more about symmetric encryption and found out that basically every symmetric encryption and decryption is (somehow) in the end based on a simple XOR-Byte-Toggle with using a ...
user avatar
2 votes
2 answers
195 views

How can I verify the hash of the plain text without being able to decrypt the cipher text?

I am building an E2EE chat app where there is one asymmetric key pair per group. Each user also has one asymmetric key pair. All messages in a group chat are encrypted with the group public key and ...
user avatar
1 vote
1 answer
111 views

How does a Cipher Suite Work without an Asymmetric Algorithm? [closed]

Using the cipher suite “TLS_AES_128_CCM_SHA256” This example is referring to a self signed certificate If a server uses TLS and uses the cipher suite above? How does the certificate get signed if ...
user avatar
  • 11
1 vote
1 answer
191 views

Key management for End-to-end encryption for Chat application

I want to implement end-to-end encryption on my chat application (available on android, iOS and web). For that I've following mechanism in mind. Generate Key pairs (Private key and Public key) on ...
user avatar
1 vote
1 answer
139 views

Does Re-Encryption make our data more secure?

We are focusing on mobile phone and hard drive encryptions. This idea can be extended to any data encryption also. iPhone and recent Androids are all encrypted. We know that changing the password will ...
user avatar
  • 111
29 votes
5 answers
8k views

Security of hashing and encryption algorithms for 30 years

Assuming a product shelf life of 30 years and the product which is released now in 2021, what is the recommendation/suggestion for hashing or encryption algorithms to use in the product? That means, ...
user avatar
0 votes
0 answers
83 views

Create a vigenere cipher encryption

I have a question about the Vigenere cipher and still do not know how to solve it. A language has an alphabet of only 4 letters with frequencies as follow: Pa=40%, Pb=20%, Pc=10% and Pd=30%. Create ...
user avatar
  • 1
1 vote
2 answers
81 views

"encrypting" a physical copy of a number by remembering a series of mathemtical operations rather than a key. Is this safe?

For example I want to have a hard copy of my backup 2FA codes so that if I lose/destroy/don't have my phone or laptop on me. I, of course, do not want them in plain text. I don't want to encrypt them ...
user avatar
0 votes
1 answer
74 views

Ownership proof scheme

I'm developing a device that will require ownership proof to activate HOTP authorizations. The HOTP codes will be used in the BLE bonding between the device and the owner's phone. I came up with the ...
user avatar
  • 3
0 votes
0 answers
68 views

password manager and key management

I would love to gather some information on how to program my own password manager properly as I'm pretty new to security. Currently, I'm using pythons cryptography module and a sqlite database. The ...
user avatar
0 votes
0 answers
159 views

File encryption with Python and AES

I need to write a Python script to occasionally encrypt some small text files (~10 Kb) in order to store them in an insecure environment. Each file will be encrypted via unique symmetric key and AES ...
user avatar
  • 1
0 votes
0 answers
16 views

Application to archive a file with multiple passwords [duplicate]

Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords? For example the password protected archive "example.7z" can be ...
user avatar
  • 1
1 vote
3 answers
108 views

How can losing 2FA render encrypted data inaccessible?

As per Bitwarden's FAQ If you don’t have your Recovery Code saved somewhere outside of your Vault, there is unfortunately no way for the team to recover the account or data therein. You’ll need to ...
user avatar
0 votes
0 answers
93 views

Encrypting file = Overwriting file?

When thinking of encrypting a file (also how I implemented it in a program of mine), I think of getting the data of a file, encrypting it, and writing it back into the file (overwriting the file). But ...
user avatar
  • 1
0 votes
1 answer
67 views

Benefit of asymmetric encryption vs trivial alternatives in compromised software?

Background information: I have a client application that communicates with a server through a web API. The data being communicated is not personally sensitive (no passwords, credit card details, ...
user avatar
  • 143
0 votes
0 answers
44 views

About password ciphertext [duplicate]

I need to decrypt a password. I have the ciphertext for this however, I have many plain text and encrypted equivalents. This device can only be given passwords with a maximum of 8 characters from the ...
user avatar
  • 1
0 votes
1 answer
132 views

Is it bad practice to store passwords in iCloud notes?

I was wondering something about a day ago when I remembered that Apple stores notes in a database (so you can recover them or view them on icloud.com) - What if Apple stores your notes in plaintext? I'...
user avatar
0 votes
0 answers
69 views

Utilities and apps that bypass Google password/security

How do applications(UnlockGo) that allow one to connect their Android to PC work in removing password? I thought the password also is used to encrypt Android device. Is the data erased? i.e. ...
user avatar
  • 149
12 votes
4 answers
8k views

Is looking for plain text strings on an encrypted disk a good test?

I have a dual boot PC, where the Win10 (uncompressed) partition is encrypted with BitLocker. I was curious about making this test (and also encryption took quite a short time in my opinion), so while ...
user avatar
  • 239
0 votes
2 answers
104 views

How to be sure there are only encrypted data on my backend

I am coding an online password manager as part of my apprenticeship. I have already coded the full backend to synchronize the encrypted data and a frontend that encrypts and decrypts data with AES. So ...
user avatar
1 vote
2 answers
71 views

Is there a minimum safe size of a protocol data unit encrypted with OpenSSL PSK?

I am working on an unusual setup and wonder if OpenSSL can deal with it: Small amounts of data, about 64 bytes per request / response, which I'd like to squeeze into a single protocol data unit (...
user avatar
0 votes
0 answers
23 views

How to identify the type of encryption used here? No key [duplicate]

61-76-126-67-99-74-71-113-81-41-96-103-51-117-55-103-91-69-104-117-84-114-141-134-90-108-90-79-115-95-102-102-98-76-91-57-83-104-92-99-96-78-79-83-132-115-80-106-91-150-114-105-148-144-93-163-83-138-...
user avatar
  • 1
0 votes
1 answer
68 views

mTLS Client Authentication by Signing Arbitrary Message using Browser

this is my first post here in the area of ​​security and encryption. I will try to be succinct, and let you know that I am not an expert in security. Context: My client (visitor) has an X509 ...
user avatar
12 votes
2 answers
4k views

Do I need to use TLS if data is already encrypted and gets decrypted client-side?

We are serving static content over the internet, and have a business requirement that the data must be encrypted at rest. Currently it is stored in AWS S3, where it can be accessed by authorized ...
user avatar
  • 131
0 votes
0 answers
72 views

Acquiring true randomness for generating a key

Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to ...
user avatar
0 votes
1 answer
90 views

Why would FDE miss slack space, swap files and memory?

I'm reviewing a ISO27001 Gap Analysis workbook and under Control A.11.2.7 someone has left the note: If full disk encryption (FDE) is used on a device is there a policy in place to ensure the ...
user avatar
  • 103
4 votes
2 answers
347 views

How does Windows password protect my data?

As far as I know, Windows computers are not encrypted by default in case you are not signed into a Microsoft Account. Considering the aforementioned fact I cannot understand the purpose of the login ...
user avatar
0 votes
0 answers
148 views

Storing a private key in android/ios keychain encrypted or not

In my app, the user must use a private key to sign a transaction (on a blockchain). (It is quite common) I am facing questions regarding how to store my user's private key on the device. I am to use a ...
user avatar
10 votes
1 answer
2k views

Are fingerprints less secure (at a software level) on Android (10+)?

Inspired by this question (and more specifically, this answer to the same): When a passphrase is used, the encryption key is not stored directly in the device. [...] When using biometrics, each ...
user avatar
  • 423
11 votes
2 answers
4k views

Why does an encryption key derived from your lock screen password give you stronger protection (in Android 11)?

Why does an encryption key derived from your lock screen password give you "stronger protection" than a key chosen by the machine (or at any rate not derived from your lock screen password)? ...
user avatar
  • 215
0 votes
2 answers
95 views

Data I/O and decryption when playing a movie file in a device encryption context

What does the storage data I/O and decryption process look like in a device encryption context when you play a random middle portion of a big movie file (e.g. 50 GB). Does the whole file have to be ...
user avatar
  • 215
11 votes
3 answers
2k views

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
user avatar
0 votes
0 answers
83 views

Spoofing a server to intercept my IoT device's data

I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a ...
user avatar
  • 101
1 vote
2 answers
398 views

How is Tor's exit node safe?

If I use Tor over VPN (User -> VPN -> Tor -> Destination), then VPN first encrypts my data and hides my original IP address, and then it goes to Tor's Entry Node. So that Tor's Entry Node can'...
user avatar
  • 33
0 votes
1 answer
102 views

How is re-encryption of a drive after a crash handled? [duplicate]

If you have full-disk (or a partition) encrypted, and your computer crashes, without the opportunity to re-encrypt the data (I'm assuming that happens with a graceful shutdown), isn't that a security ...
user avatar
  • 1,128
0 votes
0 answers
71 views

Step-by-step file encryption/decryption using user-supplied password

Let's say I want to build a dropbox clone. When users upload files they need to be encrypted. Later on, when the user needs to access their files, the application should be able to decrypt them using ...
user avatar
  • 101
-1 votes
2 answers
151 views

Keep encryption password in javascript file hidden from browser debug tool

I'm sort of new to Frontend programming. I'm trying to build a PWA, it stores data (client data i.e: address, name, phones) to be ready in an offline state, for which I'm using localForage. I've ...
user avatar
1 vote
1 answer
83 views

Simple Key Exchange, One Server

Posted this on Cryptography; reposting here in case it's more relevant. I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and ...
user avatar
  • 187
2 votes
1 answer
265 views

Are there any Linux distributions with enabled TPM2 and full disk encryption setups

I have been searching the web to find a Linux distribution, preferrably a rolling release one as I'm otherwise hooked on the concepts in Arch Linux, with automated steps to setup full disk encryption (...
user avatar
  • 121
0 votes
0 answers
120 views

CBC-MAC vulnerability with reused keys

I'm looking at the CBC-MAC vulnerabilities that arise when CBC-MAC is used incorrectly, specifically when the keys for encryption and authentication are reused. The source I'm relying on is the ...
user avatar
0 votes
0 answers
76 views

What kind of security protocols do current NFC or RFID based technologies use?

I have an information security class this semester, and I need to write a paper evaluating how secure NFC and RFID technology is. A lot of questions previously asked here are at least 3 years old, and ...
user avatar
  • 1
0 votes
1 answer
74 views

Encrypting app settings file is secure than encrypting only the app setting contents?

I have a content as shown below I have encrypted the content by running the below command cd C:\Windows\Microsoft.NET\Framework\v4.0.30319 aspnet_regiis.exe -pef "secureAppSettings" "...
user avatar
0 votes
2 answers
271 views

Is end to end encryption over HTTP safe?

If you wrap all your data in an end-to-end encrypted payload is it safe to transmit over HTTP or at worse case self signed HTTPS instead of traditional CA signed SSL?
user avatar
  • 101
0 votes
0 answers
26 views

Help with identifying patterns or cryptographic implement [duplicate]

While I'm pen testing, I came across these values mapping to a store ID. These values are gathered across three different accounts. 0015400000jpjcEAAQ 0015400000jrjH7AAI 0015400000jtDS9AAM It's not a ...
user avatar
  • 11
1 vote
2 answers
252 views

Possible attacks using public key in a certificate

this is purely an exploratory question. If this is not the right place to ask for it, please point me to the right one. TLS version: TLS 1.2 CIPHER SUITE : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (any ...
user avatar
0 votes
1 answer
101 views

How to encrypt/store private key, if login is with biometrics/OTP/Sign in with Google

I am creating a cross-platform application, in which I am encrypting all data using AES-GSM. So my problem is that I want to store private keys locally on the user's device (either Android, IOS, Web, ...
user avatar
  • 103