Questions tagged [encryption]
Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
5,766
questions
1
vote
1
answer
98
views
Is Ansible Vault FIPS 140-2 certified?
What security level of FIPS 140-2 compliance standard would Ansible Vault fall under? Is there a guide or playbook that someone can share? Thank you in advance!
- 27
0
votes
2
answers
76
views
Custom security on top of TCP for a small server
Suppose I want a server to provide some simple, primarily file related functionality and I want to allow access to all users that have a certain public key (server has the private key) and password to ...
- 111
0
votes
0
answers
32
views
SNMPv3 polls with encrypted usernames
When I perform SNMPv3 polls, I still can see the username in plain text in Wireshark. I find that a slight security risk. I mean knowing the username is a little step further ahead compared to not ...
- 101
0
votes
0
answers
30
views
Changing encryption scheme utilized in GNU Privacy Guard (GPG)
I am currently trying to implement my own cryptographic IBE scheme within GPG. I understand that rolling one's own crypto is frowned upon, yet, this is for research purposes only. Is there an easy ...
- 1
0
votes
0
answers
67
views
Need a cross-platform method of generating near truly random numbers
I have been working on an app that uses a combination of different encryption methods; some of them are libraries, and the most important ones are my own implementations. The app is cross-platform ...
2
votes
1
answer
1k
views
CryptoJS AES encryption/decryption problem
A simple encryption/decryption using CryptoJS gives me a weird output. Can anyone point me to where the code is wrong? (I'm looking for the output in the console)
var code = "Testcode";
var ...
- 23
0
votes
0
answers
85
views
CTF Crypto question
The question in a CTF was this:
They used two hydrogen atoms (H2) from the SHA-256 molecule to encrypt
in some form of AES, and the result was as follows:
{mIT+GVt+p0YfgfOltHgqoetTS6h8bRSAScAGKrBE+...
- 101
0
votes
1
answer
81
views
If software use encryption to protect one from ISP providers and other parties from snooping, how does this apply to browser software, esp. on mobile?
I believe the title says it all.
As an example, let's say I use the Brave browser on a phone.
From my understanding, all legitimate apps or computer software that connect to the Internet have some ...
- 1
0
votes
1
answer
50
views
Is having a seperate server to handle encryption operations a secure way to protect a private key for a web application?
Assume I have two servers which are part of a production environment for a web application which handles sensitive user data. The first server is a ruby on rails application, and the second is a ...
- 236
1
vote
1
answer
72
views
can these encryption methods for a text file protect against physical access to machine by adversary?
My threat model is that, the adversary has physical access to the machine and root access.
I don't care about any data on the system other than a couple python scripts that contain sensitive ...
- 15
0
votes
0
answers
364
views
How to fix import private key in GPG?
Since, I am new to gpg I wanted to generate a key pair. So I typed gpg --full-gen-key and inputted the following:
root@kali-linux:~# gpg --full-gen-key
gpg (GnuPG) 2.2.35; Copyright (C) 2022 g10 Code ...
- 101
0
votes
2
answers
366
views
TLS1.3 handshake encryption
I was reading about TLS1.3 and my question is that are the server hello extensions encrypted? Why is it so and how are they encrypted?
- 3
0
votes
0
answers
71
views
Gaussian noise added to image, how secure is it?
Parties A and B know the random noise seed. Assume the seed is perfectly secure. Can the image possibly be recovered by someone who doesn't know the seed, assuming they have the decryption source code?...
1
vote
1
answer
249
views
Best practice to encrypt data on smartphone
What is best practice for the encryption of offline application data?
I have an application where multiple users can log in. The user gets data from an internet API, where the user authenticates. I ...
- 111
2
votes
0
answers
99
views
How are the values of stored firefox credit cards encrypted? And how does one decrypt those?
While researching about the safety of web browsers I made my own program that can decrypt stored credentials, cookies, and other information of different browsers to see for myself how easy it is.
...
- 21
0
votes
0
answers
17
views
how can identify this encryption type? [duplicate]
I found a ciphers that I could not know its type, I want to decipher it but I could not, any advice?
VI8cb5Pu0pO3c1gp5x6gU2TK6JiIPFRT8SB5D1Gj/SAEJNN9eEbC+aoDHJgxGyBl6wwKBXDIpQqHEYF9hA4Elrk3Z37D/...
- 1
0
votes
2
answers
411
views
Is TLS version related to the server in a Java thick client application?
In a recent pentest (Java thick client), it was discovered by the pentesters that TLS version 1.3 is not supported. I'm investigating why it is not supported, so I was looking in the Java code for ...
0
votes
0
answers
290
views
Decrypt HTTP payload at client
I was browsing this website and tried to look at the network calls from the API which retrieves the data.
As you can see, the response payload is encrypted but the browser still shows the necessary ...
- 1,126
0
votes
1
answer
114
views
How secure is a bitlocker startup key on a mountable encrypted container?
Let's say I want to protect the contents of my Desktop PC which I use in quite many occasions remotely.
I want to use Bitlocker with a startup key that only "activates" at a specific moment ...
1
vote
3
answers
136
views
Should deprecated versions of TLS not be used
I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
- 235
0
votes
0
answers
20
views
Storing strings in a Database that are only visible to their owner who stored them when they were logged in
In my application, logged-in users create some strings, and those strings are stored in the Postgres database.
But, because they are in plaintext, their values are visible to me, as I have access to ...
- 101
1
vote
1
answer
178
views
Military-grade encryption on Blu-ray discs?
Another thread addresses the question of what can count as "military-grade encryption." In this case, I see that CyberLink Power2Go software boasts "advanced military-grade 256-bit ...
- 113
0
votes
2
answers
147
views
How does bitlocker work when unlocking a removable drive on another PC using a password?
Here's the scenario:
I have an external harddrive encrypted with bitlocker. I disconnect that drive from the PC that encrypted it, and connect it to a different PC.
Surprisingly, when I do this, all ...
- 125
-1
votes
1
answer
74
views
What are symmetric and asymmetric encryption and what would be a good example from daily life? [duplicate]
I understand that to "encrypt" something means to "code" it, to make it understandable for two parties, giver and receiver and generally only for them, but I don't know what it ...
- 5
0
votes
1
answer
445
views
P-384 vs. SHA384
Forgive my inexperience with encryption, I've been researching this for the better part of the morning and still cannot find a smoking gun answer.
A vendor is requesting that we verify a website we ...
- 1
0
votes
2
answers
157
views
Does my receiver have a public key for email encryption?
I'm using an email service with encryption option and I need to send an encrypted email. So if I need my letter to be sent encrypted, I need to take my receiver's public encryption key and apply it to ...
- 11
0
votes
1
answer
69
views
OS on external drive -- is it safe?
So I'm installing macOS to my external hard drive partition, so I can have a 100% clean environment where I can engage with cryptocurrencies. (Exchanges, stable coins, protocols, putting actual money ...
30
votes
3
answers
5k
views
Why is one-time pad informationally secure?
I am reading "Serious cryptography" and he wrote the following:
Informational security is based not on how hard it is to break a cipher,
but whether it’s conceivable to break it at all. A ...
- 403
0
votes
1
answer
93
views
How is the stream cipher key shared on GSM?
I read that phones encrypt communication (GSM as implemented in 2G,3G..) - particularly voice as SMS are unencrypted - using a stream cipher.
Symmetric Stream ciphers use the flip-flop machinery to ...
- 25
2
votes
2
answers
194
views
Does any real world protocol makes use of the associated data in AEAD?
I'm trying to find evidence of use of the associated data (authenticated cleartext associated with the encrypted and authenticated data) feature offered by AEAD (Authenticated Encryption with ...
- 5,371
2
votes
1
answer
282
views
Always leaking ext4 superblock
An encrypted ext4 container will always leak the superblock information.
So encrypting an unencrypted metadata file system like ext4 is inherently vulnerable because it instaleaks?
Shouldn't it then ...
- 21
1
vote
1
answer
76
views
why is gpg subkey getting a warning
I just begain studying how GPG works on Linux(Ubuntu20.04) and can't get my head around as why my subkey keeps getting a warning when encypting a file using the GPG command. I have also tried signing ...
1
vote
0
answers
32
views
Would adding encryption to an MPLS provide additional protection for application access which is over TLS?
I have users at a remote site who access business application via an MPLS. The applications use HTTPS (TLS). The MPLS connection that we have is non-encrypted. The data is sensitive.
Would adding ...
- 641
0
votes
1
answer
98
views
Are self-signed certificates better for local usage?
When generating a certificate what would more secure - generating a self-signed certificate using PGP or using a public CA like Let's Encrypt? We are using it for signing and encrypting.
What are the ...
- 234
0
votes
0
answers
237
views
Encrypt SVN for passwords
Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
- 1
0
votes
2
answers
106
views
Secure data (+ private key) storage in an insecure public cloud environment
We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure.
The data should be so secure ...
- 234
0
votes
1
answer
36
views
Can third-party authentication yield a static user-specific encryption key?
I'm writing a REST server + frontend with two goals that seem to conflict:
Signing in yields a static, user-specific key (K1) to decrypt a document (D) stored encrypted on the server. The key should ...
20
votes
9
answers
8k
views
Need to leave computer in repair shop. How can I secure solid state drive contents?
I need to take my desktop into a PC repair shop and leave it for a few days. It would be easy for them to copy the drives without me knowing. I am running Windows 10 with a password but this doesn't ...
- 431
0
votes
0
answers
59
views
Import BDK encrypted under the Transport Key KEK on HSM
I received a two-component KEK TDES key and a BDK cryptogram, which is encrypted for this KEK.
Do you have any suggestions on how to load such a key into the HSM device? Eg. Luna HSM
0
votes
0
answers
35
views
Why aren't search engines encrypting search queries? [duplicate]
As you will know most search engines pass the search information url-encoded, i.e a get request with the parameters on it.
But given all the fuzz about security and surveillance, why aren't SEs ...
- 25
0
votes
0
answers
10
views
How to determine type of encoding/encryption has been used? [duplicate]
Is there a way to find what type of encryption/encoding is being used? For example, I am testing a web application which stores the password in the database in an encrypted format for example (...
0
votes
1
answer
376
views
Burp suite: URL encoding of request body - Is this safe?
Analyzing an android app's traffic POST request, it sends some important pieces of data in the form of URL encoding. This is pretty easy to decode and get the data. The data is sent over HTTPS. But is ...
- 7
0
votes
1
answer
68
views
Encryption options when one-way secure channel is available
I would like to ask what encryption options are available for the following real scenario:
There is an unsecure, full-duplex communication channel between a server and client
There is also a secure ...
0
votes
0
answers
22
views
Encrypted/Encoded text in the Burp HTTPS request - Android [duplicate]
I am analyzing the HTTPS traffic from a particular Android app using the Burp proxy. So every 5 minutes, the app hits an endpoint and sends an encrypted/encoded text in its HTTPS request. I tried ...
- 7
2
votes
1
answer
646
views
Veracrypt and Bitlocker VS Bad Sector
Want to know what happen to:
Bitlocker partition
Veracrypt partition
Veracrypt container
If there's bad sector appear in the encryption area.
Can I still mount/open the encryption to save non-...
user276916
2
votes
2
answers
214
views
How would you go about generating fake sensitive-looking file for plausible deniability encryption
I was reading the VeraCrypt documentation about hidden volumes [[1]] (plausible deniability), and they recommend putting "sensitive-looking files that you actually do NOT want to hide" in ...
- 23
8
votes
6
answers
6k
views
What's the point of hashing a password and then sending it to the server?
If the password is hashed and then sent to the server where the hash is compared to the stored hash, this basically means that if someone had that hash they can still log in by sending the hash in the ...
- 229
1
vote
1
answer
280
views
End To End Encryption Model
I have an architecture which requires a certain subset of data to be more heavily secured and encrypted. The main parameters which I believe meet the scope of the project are as follows:
Data should ...
- 113
1
vote
1
answer
554
views
TPM use without secure boot
I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, ...
- 111
5
votes
2
answers
1k
views
What standards should a commercial encryption device meet?
I am trying to build a commercial encryption device. Ok, I know how to write code, how to transform encryption algorithms from the book into code and construct electronics. But my question is: what ...
- 253