Questions tagged [encryption]

Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

Filter by
Sorted by
Tagged with
0
votes
1answer
73 views

How to generate a MSK from IEEE 802.1X-2010

IEEE 802.1X-2010 states: "Generate an MSK of at least 64 octets, as required by IETF RFC 3748 [B14] Section 7.10, of which the first 16 or 32 octets are used by this standard as described in 6.2....
1
vote
3answers
109 views

Does compression level influence security of encryted 7z files?

I want to archive some GB of sensitive data. It is to be stored on an external drive that also includes non sensitive data so i don't want to encrypt the whole drive. For that purpose i want to use ...
0
votes
1answer
107 views

Data Key for Production / Test DB

We are encrypting database fields for PII. For Key Generation and storing it, we are using AWS KMS. Data key we have generated using AWS KMS,for the master key we are using CMKs. Now let's say there ...
0
votes
1answer
43 views

On what basis to create Data Keys

For PII, we have to encrypt some columns in our DB(All of our infra resides on our own DC, not using any cloud provider). Now roughly what we are doing is Created a CMK at AWS. Generate Data Key ...
0
votes
1answer
38 views

What can be added on a proxy server using TLS v1.3 more secure?

i would like to know what can be added to make a proxy server using TLS encryption more secure so that it can bypass censors that are using quantum computational power?
1
vote
1answer
46 views

What are the limitation on encrpyting proxy

i would like to know if i encrypt a proxy server communication with TLS v1.3 is it still possible for a firewall censor to a deep packet scanning to decrypt. Also, what can be done to make the ...
1
vote
2answers
220 views

Searching Encrypted Data from Database

Suppose I have a table with email is stored in one table. I have encrypted it using AES-256 and stored the result in DB Column. For let's say I have one input email and I want to search whether this ...
2
votes
3answers
251 views

AWS KMS Data Key Rotation

I am using AWS KMS as a vault for my encryption key. Now what I am doing is that I am creating one data key, encrypt it using Customer Managed CMKs. Now on every request, I just call AWS KMS Service ...
0
votes
1answer
78 views

Symmetric encryption - given plain text, produce cipher text without key

Suppose Alice and Bob are communicating using a peer-reviewed symmetric encryption algorithm such as AES-256. Bob possesses a private encryption key to decode messages from Alice, but Alice does not ...
0
votes
0answers
34 views

Storing Private Key Files on Android 10 as a User

Say I have a private key as a user of an existing application for SSH, password management, etc. As far as I know if it is in shared storage, any application with storage permissions can access it. If ...
0
votes
1answer
69 views

Save encrypted data in server . With no way for server to read actual data

Hello i am developing an app that collects some private data from my clients. My clients wont like it if i am able to read the data. So the data is encrypted in cleint side with a key say "xyz&...
0
votes
0answers
34 views

How can I find out the encoding/encryption logic that has been used? [duplicate]

Is there a way to find what type of encryption/encoding is being used? Value Input: -8657C021 -C6E29E21 Value Output: -6651FC6C -9F1CBB0F
0
votes
0answers
119 views

Is SECCURE (still) safe enough for public backups

I recently came across the SECCURE tools for simple encryption of data, but I'm uncertain about how up-to-date their security is. On the page, the author points out that the tools have been audited by ...
1
vote
2answers
161 views

What personal data should be encrypted in a database?

I am having trouble answering what seems like a simple question. I was hoping to find a Yep/Nope style list somewhere, but can't seem to find one. What data should be encrypted in a cloud (e.g. AWS/...
0
votes
0answers
59 views

What is the need of HMAC in Diffie-Hellman? [duplicate]

When Alice and Bob both have the same shared secret to encrypt their data (Diffie-Hellman) and Alice encrypts her data with this key and Bob can decrypt it with the same key, then Bob knows that the ...
2
votes
1answer
125 views

Manually sending PIN Change/Unblock Command to IC card

In the EMV documentation (EMV Book 3 Section 6.5.10), the PIN Change/Unblock command provides the option to change or unblock a card's PIN, and also handles resetting the PIN Try Counter (EMV tag ...
1
vote
1answer
48 views

AWS KMS Getting Data Key using AWS Encyption SDK

I am exploring the AWS KMS as a vault for storing the encryption keys. Now I am trying to encrypt the database fields like email. So, issue whenever there is a read/write for email, I don't want to ...
0
votes
2answers
96 views

How does encryption, certificates in an end to end SSO flow?

So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
8
votes
3answers
2k views

What happens when I encrypt something with my RSA Public Key?

I know encrypting something with my private key is used for signing. To prove that the message is indeed coming from me. But what about if I sign something with my public key? That would mean that ...
-1
votes
1answer
61 views

How to secure the key in an offline package

I have a package to be shared to Bob which contains: an encrypted data.zip Application, which will have logic to decrypt the data Bob will run Application and it will decrypt the data.zip. Now for ...
0
votes
0answers
28 views

How does WPA MIC key protect its PSK variable during 4 way handshake process

Background: I had a hard time finding an answer to a simple question, about the very first communication between an AP and a client. In the 2nd packet delivered during the 4 way handshake process (the ...
0
votes
0answers
36 views

2-way encryption of url parameters

My client uses a 3rd party vendor to store contacts and send promotional emails. All of the emails drive the user to various landing pages on their website. occasionally there is a need for ...
0
votes
0answers
38 views

How to perform encryption/decryption in a RESTful system? [duplicate]

I'm not a crypto/security expert and have designed an architecture for encryption/decryption. I'm not sure if its full proof and want to know what people use as industry standard? I'm trying to ...
1
vote
1answer
128 views

How to perform encryption/decryption in a RESTful system?

I'm not a crypto/security expert and have designed an architecture for encryption/decryption. I'm not sure if its full proof and want to know what people use as industry standard? I'm trying to ...
0
votes
0answers
48 views

Is my password database encryption flow secure?

I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it Here are the diagrams of getting/setting the password file from and to the ...
1
vote
2answers
192 views

Encrypt Text Message as Image

Is this a good idea to make the following text message encryption: accept text from the user 1 store the text into a document in the form of some handwritten font convert the document into an image ...
56
votes
10answers
15k views

Is it really safe to use Signal or Telegram on untrusted phone hardware?

How safe are we when we use phone hardware from untrusted manufacturers and use end-to-end encrypted communication like Signal and Telegram? Are our conversations really safe from keyloggers or ...
0
votes
1answer
75 views

Can't Amazon see my files if I use s3cmd/gpg with a complex password?

Since the early days of s3cmd I use it in combination with random generated filenames (uuidgen loop) and a complex passphrase (pwgen -n1 -c 32 -y). On security.stackexchange.com search there is only 1 ...
1
vote
2answers
178 views

Encrypting a password with its own hash

I just found out that an e-commerce platform (similar to Shopify) I was planning on using allows me to see my password. I know I can't assume anything and I should (probably) just run away from it, ...
0
votes
1answer
319 views

Still able to recover files after running cipher.exe on windows 7

After running cipher.exe on my entire C: drive, I'm still able to recover deleted files using recuva. In fact, doing a before and after, I see no discernible difference in the files that are able to ...
0
votes
1answer
101 views

How VPN works internally [closed]

The VPN is used to establish a secure connection (creating a tunnel) to another network over the Internet. It masks our IP address and geographical location and also when the information enters the ...
3
votes
2answers
137 views

Protecting an invitation to join the system

I'm having a debate with a coworker right now about how to design an invitation system. The idea is that the mobile app will be able to send an invitation link to, say, a Whatsapp group, and people ...
0
votes
0answers
47 views

Review of the design of Credentials Manager app

I want to make a mobile app that will act as a Credentials Manager and store all my access information for websites, credit cards, secure notes, and so on on the server encrypted with REST API. The ...
0
votes
1answer
33 views

What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?

I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is. Is it all internal ...
0
votes
0answers
70 views

How to securely design REST API for Password Manager app?

I want to create Password Manager where users can create their accounts and store website passwords. For the frontend, it will be a mobile app, but I need REST API as the backend data where the data ...
0
votes
1answer
59 views

Vulnerabilities and potential scale for sensitive data transferred in plaintext, involving credit card payment information

Regarding the insecure transmission of data over a network. When it comes to plaintext credit card information and payment details being transferred in this manner over HTTPS. What are the possible ...
1
vote
2answers
313 views

How does Telegram's secret-splitting scheme work?

The Telegram FAQ's state that they are not able to comply with court orders from one country alone because they "split the encryption keys and spread them over multiple jurisdictions". To ...
8
votes
1answer
2k views

What does using Cloudflares WARP app offer that HTTPS (websites) alongside DNS over HTTPS / TLS doesn't?

Intoduction to Cloudflare WARP I’ve been looking at Cloudflares WARP app for mobile. It claims to be a VPN but without some of the IP hiding anonymity features normal VPNS have: “Under the covers, ...
14
votes
4answers
604 views

Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?

Edit 2/27/2021 I've developed a small browser extension for Firefox, incorporating many of the ideas in this question and the following answers and responses, aimed at solving this problem. See my ...
2
votes
1answer
83 views

Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?

I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
22
votes
2answers
4k views

How critical is encryption-at-rest for public cloud hosted systems?

I work as a solutions architect for web-based systems on AWS. As part of this role, I often respond to Information Security questionnaires. Nearly all questionnaires request information about data ...
0
votes
0answers
42 views

Is storing passwords in encrypted container still bad practice? [duplicate]

Suppose I need to store a bunch of passwords: storing them in a txt or odt file inside an encrypted container, such as the ones produced by VeraCrypt, is bad practice? Would I put myself at risk? If ...
0
votes
2answers
91 views

Is adding encryption before hashing more secure?

One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value. Does encrypting the password || salt then ...
1
vote
1answer
155 views

Is this a good way to manage encryption keys?

I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything from a leave of absence form to potentially confidential agreements. Being ...
0
votes
0answers
83 views

Which test nikto do to test oracle padding attack?

After running nikto it shows the following message OSVDB-68127: Server may be vulnerable to MS10-070 (based on numeric calculation), thus allowing a cryptographic padding oracle. This vulnerabilty ...
1
vote
0answers
47 views

Backing-up to an untrusted cloud

Not sure if this kind of review/validation question is allowed - please delete if it isn't. Like many before, I'm looking for ways to do cloud backup in a way where I trust that I'm still the only one ...
0
votes
1answer
101 views

How does streaming and downloading work on Zero Knowledge-based cloud storage services?

So there are a few cloud storage services such as mega.nz, syn.com and others which state that they use zero knowledge encryption. This would mean that they don't have access to the private keys which ...
1
vote
1answer
85 views

Does Windows Device Encryption use a new key to encrypt each time?

Say I have a machine running Windows 10 with built in Device Encryption enabled. Say I want to reinstall Windows and sell the machine. I am wondering: after the format and reinstall, is a new key ...
1
vote
0answers
72 views

How would you follow all JavaScript calls after a click?

I'm using Google Chrome developer tools. Let's say I'm performing a bug bounty activity. I found an obfuscated JS. I know user data goes into this JS and goes out encrypted. I found a few files called ...
1
vote
1answer
114 views

What could be recovered after an interrupted ransomware attack?

Four days ago my PC got phobos ransomware. I didn’t notice until three days ago, and the reason is that the attack stopped midway, leaving some of my data as it is and not leaving behind any ransom ...