Questions tagged [encryption]

Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

How to identify the type of encryption used here? No key [duplicate]

61-76-126-67-99-74-71-113-81-41-96-103-51-117-55-103-91-69-104-117-84-114-141-134-90-108-90-79-115-95-102-102-98-76-91-57-83-104-92-99-96-78-79-83-132-115-80-106-91-150-114-105-148-144-93-163-83-138-...
  • 1
0 votes
1 answer
72 views

mTLS Client Authentication by Signing Arbitrary Message using Browser

this is my first post here in the area of ​​security and encryption. I will try to be succinct, and let you know that I am not an expert in security. Context: My client (visitor) has an X509 ...
12 votes
2 answers
4k views

Do I need to use TLS if data is already encrypted and gets decrypted client-side?

We are serving static content over the internet, and have a business requirement that the data must be encrypted at rest. Currently it is stored in AWS S3, where it can be accessed by authorized ...
  • 131
0 votes
0 answers
77 views

Acquiring true randomness for generating a key

Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to ...
0 votes
1 answer
94 views

Why would FDE miss slack space, swap files and memory?

I'm reviewing a ISO27001 Gap Analysis workbook and under Control A.11.2.7 someone has left the note: If full disk encryption (FDE) is used on a device is there a policy in place to ensure the ...
  • 103
4 votes
2 answers
392 views

How does Windows password protect my data?

As far as I know, Windows computers are not encrypted by default in case you are not signed into a Microsoft Account. Considering the aforementioned fact I cannot understand the purpose of the login ...
0 votes
0 answers
303 views

Storing a private key in android/ios keychain encrypted or not

In my app, the user must use a private key to sign a transaction (on a blockchain). (It is quite common) I am facing questions regarding how to store my user's private key on the device. I am to use a ...
10 votes
1 answer
2k views

Are fingerprints less secure (at a software level) on Android (10+)?

Inspired by this question (and more specifically, this answer to the same): When a passphrase is used, the encryption key is not stored directly in the device. [...] When using biometrics, each ...
  • 423
11 votes
2 answers
4k views

Why does an encryption key derived from your lock screen password give you stronger protection (in Android 11)?

Why does an encryption key derived from your lock screen password give you "stronger protection" than a key chosen by the machine (or at any rate not derived from your lock screen password)? ...
  • 215
0 votes
2 answers
106 views

Data I/O and decryption when playing a movie file in a device encryption context

What does the storage data I/O and decryption process look like in a device encryption context when you play a random middle portion of a big movie file (e.g. 50 GB). Does the whole file have to be ...
  • 215
11 votes
3 answers
2k views

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
0 votes
0 answers
88 views

Spoofing a server to intercept my IoT device's data

I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a ...
  • 101
1 vote
2 answers
559 views

How is Tor's exit node safe?

If I use Tor over VPN (User -> VPN -> Tor -> Destination), then VPN first encrypts my data and hides my original IP address, and then it goes to Tor's Entry Node. So that Tor's Entry Node can'...
  • 33
0 votes
1 answer
129 views

How is re-encryption of a drive after a crash handled? [duplicate]

If you have full-disk (or a partition) encrypted, and your computer crashes, without the opportunity to re-encrypt the data (I'm assuming that happens with a graceful shutdown), isn't that a security ...
  • 1,207
0 votes
0 answers
77 views

Step-by-step file encryption/decryption using user-supplied password

Let's say I want to build a dropbox clone. When users upload files they need to be encrypted. Later on, when the user needs to access their files, the application should be able to decrypt them using ...
  • 101
-1 votes
2 answers
429 views

Keep encryption password in javascript file hidden from browser debug tool

I'm sort of new to Frontend programming. I'm trying to build a PWA, it stores data (client data i.e: address, name, phones) to be ready in an offline state, for which I'm using localForage. I've ...
1 vote
1 answer
93 views

Simple Key Exchange, One Server

Posted this on Cryptography; reposting here in case it's more relevant. I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and ...
  • 187
2 votes
1 answer
560 views

Are there any Linux distributions with enabled TPM2 and full disk encryption setups

I have been searching the web to find a Linux distribution, preferrably a rolling release one as I'm otherwise hooked on the concepts in Arch Linux, with automated steps to setup full disk encryption (...
  • 121
0 votes
0 answers
154 views

CBC-MAC vulnerability with reused keys

I'm looking at the CBC-MAC vulnerabilities that arise when CBC-MAC is used incorrectly, specifically when the keys for encryption and authentication are reused. The source I'm relying on is the ...
0 votes
0 answers
79 views

What kind of security protocols do current NFC or RFID based technologies use?

I have an information security class this semester, and I need to write a paper evaluating how secure NFC and RFID technology is. A lot of questions previously asked here are at least 3 years old, and ...
  • 1
0 votes
1 answer
77 views

Encrypting app settings file is secure than encrypting only the app setting contents?

I have a content as shown below I have encrypted the content by running the below command cd C:\Windows\Microsoft.NET\Framework\v4.0.30319 aspnet_regiis.exe -pef "secureAppSettings" "...
0 votes
2 answers
354 views

Is end to end encryption over HTTP safe?

If you wrap all your data in an end-to-end encrypted payload is it safe to transmit over HTTP or at worse case self signed HTTPS instead of traditional CA signed SSL?
  • 101
0 votes
0 answers
26 views

Help with identifying patterns or cryptographic implement [duplicate]

While I'm pen testing, I came across these values mapping to a store ID. These values are gathered across three different accounts. 0015400000jpjcEAAQ 0015400000jrjH7AAI 0015400000jtDS9AAM It's not a ...
  • 11
1 vote
2 answers
323 views

Possible attacks using public key in a certificate

this is purely an exploratory question. If this is not the right place to ask for it, please point me to the right one. TLS version: TLS 1.2 CIPHER SUITE : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (any ...
0 votes
1 answer
176 views

How to encrypt/store private key, if login is with biometrics/OTP/Sign in with Google

I am creating a cross-platform application, in which I am encrypting all data using AES-GSM. So my problem is that I want to store private keys locally on the user's device (either Android, IOS, Web, ...
  • 103
3 votes
0 answers
123 views

Security vs. User Experience – can this Process still be considered to provide proper End-to-End-Encryption?

I am banging my head about this for a while now and would appreciate opinions/different views. tl;dr There is a system that aims to provide full end-to-end encryption for information (text messages, ...
  • 233
0 votes
1 answer
112 views

Storage access permissions before initial unlock upon startup

How do Android devices (at least all the non-enterprise personal devices I remember owning) display the wallpaper (usually chosen from the 'downloads' folder) on the lock screen when it first is ...
0 votes
3 answers
198 views

Naming encrypted files in the cloud, without leaking info about their content

I'm working on a photo sharing app that stores files in the cloud, encrypted, and lets you share those files with others. To do that, as suggested in answers to this previous question: files are ...
0 votes
0 answers
97 views

In what order should you create the partition table and a LUKS container?

My goal is to fully encrypt my USB drive with LUKS. What's the correct order of encryption? Should I create the partition table or the LUKS container first? Motivation behind would be greatly ...
  • 1
0 votes
3 answers
137 views

Is the Initial Public Key Transfer Process in Public Key Encryption Vulnerable to MITM on Public Networks?

(shown in step 1): Is the initial process in public key encryption where the public key is transferred across the network done in plaintext? It seems like it must be, which essentially means that no ...
  • 101
0 votes
1 answer
158 views

How should I securely rsync to a host with a self-signed certificate on a private network?

I have a backup server that has a self-signed certificate (x509) and another server on the same network. I would like to rsync data to the backup server from the other server. However, I prefer not to ...
  • 3
0 votes
1 answer
76 views

Getting Smaller Output From Public Key Cryptography In PHP

I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
  • 743
0 votes
2 answers
129 views

Can a device that connected to malicious network once be compromised even after disconnection from malicious WiFi?

I need to take my personal laptop to the workplace so I will be using their internet that only employees usually use. However, if the network I connected to was malicious, is my data only compromised ...
0 votes
1 answer
315 views

Encryption Algorithm With Separate One-Way (Hashing) And Two-Way (Decryption) Keys

In cryptography, generally we have two ways of handling sensitive information. We can use one-way encryption such as hashing. This is useful when we never need to retrieve it again. In this case, we ...
  • 743
0 votes
1 answer
260 views

What's The Best PHP Encryption For Email Addresses?

I'm storing a list of email addresses and other not personally identifiable information for a mailing list in a database. Since it's for a project related to cryptocurrency, I believe that the ...
  • 743
0 votes
0 answers
83 views

Is it safe to use a Digital Signature created with a PKI certificate's private key as a password

I'm trying to create application-layer encryption for user data in my database, using password derivation function. But there is a problem, that there must be an admin user, who can access all user's ...
0 votes
1 answer
81 views

Authenticationless end to end encrypted server

I was wondering if a server enforces E2EE, should the users provide any kind of authentication? Indeed, if the data is encrypted, any user could access it but the only person who can actually decrypt ...
  • 121
0 votes
2 answers
161 views

Does end to end encryption changes anything on the server code?

while coding a simple to-do list app enhanced with (true) end-to-end encryption as a coding exercise, I was wondering if the server-side API code changes from a plain text storage (excepts passwords) ...
  • 121
1 vote
1 answer
96 views

How can I improve the application administrator's encryption keys security inside database

I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak. It was decided to use the following encryption chain: User data is ...
0 votes
0 answers
103 views

Dealing with particular clients wrt TLS support in postfix?

External (other) Mail clients have started to deny/de-list anonymous ciphersuites. But the TLS support is often spotty. Worse, some clients (mainly Windows, which does not care one whit about your RFC ...
  • 273
4 votes
2 answers
839 views

Web-based secret manager using CryptoJS

I'm building an application, part of which will allow businesses to store secrets. I'm looking at using CryptoJS (https://www.npmjs.com/package/crypto-js). This would encrypt everything on the client ...
0 votes
1 answer
107 views

Contact form encryption

Currently we have an email address and in certain cases we receive sensitive data via email. The goal is protecting this sensitive data. We have a website with SSL too so we thought that the website ...
  • 487
1 vote
0 answers
65 views

Constraints on the password imposed by m209 on first password management

I was going through the paper Password Security: A Case History By Robert Morris and Ken Thompson on authentication. It has been mentioned in the First Scheme that the first encryption used m209, in ...
0 votes
3 answers
269 views

Can a drive in locked state (via BitLocker) be over-encrypted/over-locked by ransomware?

Can a drive (system or external) that is already Bitlocker encrypted and locked, be able to be attacked and encrypted by ransomware? We need prevention from over-encryption, not destruction or ...
4 votes
2 answers
2k views

Is it less secure to encrypt an hexadecimal encoded string?

I'm implementing RSA public-private key encryption and decryption and the input of these functions is encoded as hexadecimal. The library I use (react-native-rsa) however only accepts plain strings ...
  • 751
0 votes
1 answer
135 views

Taking encrypted devices across borders

I am moving to a country where the government can compel you to reveal passwords for your devices at the border, rendering the full disk encryption on my linux laptop useless. Other than uploading ...
1 vote
2 answers
224 views

Irreversible encryption - difference to hash?

I keep reading the term "reversibly encrypted" and that confuses me because I thought that is kind of the point of encryption, that it can be decrypted. I googled it, as a good student, and ...
  • 35
2 votes
0 answers
166 views

Is there any way to de-link a secure messenger (Telegram/Signal/WhatsApp) from phone number?

I understand, that mobile phone verification is probably the most convenient way to validate real users and avoid spam, but those "secure/private" messengers are afterward still bound to ...
  • 2,677
0 votes
0 answers
22 views

MITM attack on public wi-fi and ISP wired connection [duplicate]

I know how MITM attacks work (theory/videos on the subject etc), but I am a bit confused and not sure what are the worst-case scenarios that can happen. If I'm using a public VPN and someone is indeed ...
2 votes
3 answers
218 views

Is using random salt to pbkdf2 for every request to Rest API good/bad?

Here are my conditions: My Rest API must accept username and plain password. But, that's very bad. That's why the client must encrypt the password first and my rest API will decrypt it to get the ...

1
3 4
5
6 7
114