Skip to main content

Questions tagged [encryption]

Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

494 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1 vote
0 answers
309 views

Weak ciphers in TLS VPN

We have a firewall out of our firm network and administrators connect to this firewall by VPN over TLS. Scanning this firewall, the vulnerability scanner get us some warning as the 443 port allow weak ...
Whysmerhill's user avatar
1 vote
0 answers
326 views

Enclosed FDE, Bridge & chipset FDE. what is the difference to SED

I was reading hardware based encryption, and found out that they are basically of 3 types. 1) SED - Encryption/Decryption done by the drive circuitry. Unlocked via Pre boot authentication. Can use ...
Haris's user avatar
  • 113
1 vote
0 answers
114 views

Is distributing software with KeyStores as resource secure?

I'm working on a client / server application. I want to encrypt the communication between the two. This GitHub project served as a starting point for me. It uses SSLEngine to establish a secure ...
rougemarsrover's user avatar
1 vote
0 answers
228 views

HTTP body E2E encryption protocol

I have 2 servers that communicate each other in HTTP and they are both behind an API gateway. Between the servers and their API gateways the communication is in HTTPS with mutual authentication using ...
Fabio's user avatar
  • 121
1 vote
0 answers
124 views

Where to store encryption based tokens in Encryption based Token Pattern?

Reading OWASP encrypted tokens pattern they describe the flow as follow: After successful authentication, the server generates a unique token comprised of the user's ID, a timestamp value and a ...
Adelin's user avatar
  • 111
1 vote
0 answers
139 views

Is decryption in the Browser or on the Server better?

I am wondering if it is better to send encrypted data to the browser from the database and have javascript decrypt the data or send a password to a php file (that verifies it with a salt and hash) ...
StormsEngineering's user avatar
1 vote
0 answers
118 views

Sharing individually encrypted elements between users of a system

I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file. For simplicity, lets say the unique keys are the file names. I'd ...
David Goldbarsht's user avatar
1 vote
2 answers
314 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
Sterling Beason's user avatar
1 vote
0 answers
207 views

Help me understand Encryptpad and 7-zip for encryption

I was looking to encrypt some text files (containing sensitive data) so I could safely keep them online (e.g. Google drive). I have found three options: 7-zip, which does AES-256 Encryptpad, which ...
get_going's user avatar
  • 123
1 vote
0 answers
82 views

3rd party verification of separately encrypted files

I'm trying to figure out how to verify whether a file's contents are unchanged even though it has been re-encrypted and the 3rd party cannot know what is inside of the file. A contrived example to ...
Lfod's user avatar
  • 111
1 vote
1 answer
206 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
Tuomas Toivonen's user avatar
1 vote
0 answers
226 views

Client Side Encryption - The Last Mile

Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...
TommyF's user avatar
  • 111
1 vote
0 answers
106 views

Using the same passphrase for files and filenames with filesystem-level encryption such as eCryptfs

In filesystem-level encryption schemes where files are encrypted and stored individually, filenames may or may not be encrypted. eCryptfs allows to encrypt filenames with a different key than the one ...
Arcturus B's user avatar
1 vote
0 answers
501 views

Can BitLocker simply be bypassed by just "waiting long enough" till it auto suspends due an update?

When you get an automatic feature or even only cumulative Windows 10 update with an activated BitLocker (password protected) system partition BitLocker will prompt you afterwards from the system tray ...
Jey DWork's user avatar
  • 230
1 vote
0 answers
91 views

How large is AppEngine's Private Key?

AppEngine provides methods for signing binary data - e.g. via the Go language's SignBytes[1] However, it doesn't specify any information about how large the private key is. Is this published ...
davidkomer's user avatar
1 vote
0 answers
98 views

Hadoop Transparent Data Encryption: protection from interference of EDEK, EZK and DEK

I am preparing a response to a security auditor. They have presented a generic question about the protection from substitution of KEK and DEK in a "normal" encryption mechanism. What protection ...
user2195559's user avatar
1 vote
0 answers
112 views

Is creating a derived password safe?

I need to store really sensitive data in a client-hosted database. Since there's no way I can protect this database (because I don't own it), my idea was to encrypt it by using the user's password, so ...
Victor Oliva's user avatar
1 vote
0 answers
656 views

BadPaddingException when using the textbook cipher

I'm using an implementation as below to do an encryption where the bouncycastle is used as the crypto provider. So the ciphertext for a particular plaintext will not be dynamic as the RSA from ...
Prakhash's user avatar
  • 203
1 vote
0 answers
302 views

Password protected secrets on Vault

We're currently improving our custom secrets management system and I'm looking into different solutions such as Hashicorp Vault or AWS KMS. So far Vault seems to meet most of our current requirements,...
MarcSitges's user avatar
1 vote
0 answers
624 views

Decrypt to memory for editing

I am looking for a secure way to edit sensitive text data, using Git and Vim in the process. An ideal solution would be: clone the encrypted git repository into memory; decrypt into memory; do the ...
Mussé Redi's user avatar
1 vote
1 answer
438 views

Server pagination with key in response to fetch next page

I want to introduce pagination in one of my server endpoints. The endpoint will have an option to include in the parameter the last index of the previous page, and if included, the "page" returned ...
Nadav96's user avatar
  • 193
1 vote
0 answers
171 views

Encrypting Geographical Data

I have an address table with human-readable columns like street, city, state, zip - and also columns with spatial data (the SQL Server geography type). Technically, this violates 3rd Normal form (i.e. ...
Michael Arner's user avatar
1 vote
0 answers
425 views

Secure local database or service

I’m trying to secure a database of questions and I wonder if it’s actually possible. There are 2 ways the client (mobile App) can get questions: Local DB within the app. Service that returns ...
Udi Idan's user avatar
  • 133
1 vote
0 answers
318 views

Best way to store AES keys (web api) while dealing with multi tenants (key per tenant)

I have some data to encrypt on my database and every tenant will have his own database so surely every tenant will have a different key. I'm searching for the best way to store the key for every ...
Ali_Nass's user avatar
  • 131
1 vote
0 answers
1k views

Check the signature algorithm of RDP certificate

I received a Nessus warning of RDP as following, The following certificates were part of the certificate chain sent by the remote host, but contain hashes that are considered to be weak. |-Subject ...
Edmund Lo's user avatar
1 vote
0 answers
4k views

Is Crypto-JS AES library still considered secure?

My company has to send out passwords to employees. We want to do so by using the Crypto-JS AES library to locally create the encrypted message and then send the encrypted message to the employee so ...
ComputerWhiz's user avatar
1 vote
0 answers
226 views

What are the security implications of storing user-uploaded files on a third-party server versus your own managed webserver?

I'm working on a web platform which will contain some rather sensitive personal information, and obviously this raises the problem of how secure this data will be. Users can upload some files, and I ...
Buno's user avatar
  • 111
1 vote
0 answers
159 views

Security practices to securely poll authenticated 3rd party API on behalf of clients

It turns out there is a need for our application to be able to poll data at a specific schedule from external API on behalf of clients. The API can be any rest API that the client would choose. We ...
Varun Dave's user avatar
1 vote
0 answers
141 views

How would encrypted search engine work, a search engine where it doesn't know what was searched for

I took course on cryptography on coursera, and the instructor said that it's possible to create search engine as so that even search engine wont know what you searched for but it will be able to find ...
Muhammad Umer's user avatar
1 vote
0 answers
364 views

Veracrypt Sufficient Enough for Firefox Profile

I was doing some reading about Firefox and using the password manager with a master password(1,2,3). Suppose I want to protect my entire Firefox profile, is using Veracrypt to create a container ...
user avatar
1 vote
0 answers
339 views

How Secure Would Client Side Sha-512 Be In JavaScript

I've created an Capture The Flag challenge for me and a few of my mates, and for the final challenge, you're goal is to log in as admin to a site. Now the site doesn't use any server side languages (...
The Gamer King's user avatar
1 vote
0 answers
281 views

Is volume level encryption enough to satisfy compliance requirements?

We are implement a cloud application and using nosql technology. We know there are quite a few compliance requirements out there require doing data encryption at rest. However, we would like to know ...
William's user avatar
  • 41
1 vote
0 answers
366 views

Using TLS Certificates in IoT Devices

I am not sure whether this is the exact forum to ask this question. If not please transfer it to another. Domain As we know the IoT is growing rapidly and millions of devices are invading our ...
user3496510's user avatar
  • 1,297
1 vote
0 answers
543 views

How secure is my MLab Shared Cluster MongoDB database?

I have deployed a Meteor application to Meteor Galaxy. I've also created an Mlab.com Shared Cluster MongoDB. Link to the plan features. My application has an SSL certificate installed on the domain. ...
Sean's user avatar
  • 111
1 vote
0 answers
113 views

What is the current standard for complete encryption of user information?

If one were to design a social media service, but with guaranteed encrypted privacy of all aspects of one's data, what are the proper technologies to employ for all of 1.) On disk storage 2.) ...
Alex Hill's user avatar
  • 111
1 vote
0 answers
5k views

Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes

I am looking for your help with one Exception we are getting while setting up our Kerberos SSO. I will briefly give an overview of our setup and things we tried till now and exception we are getting: ...
Gaurav Jain's user avatar
1 vote
1 answer
945 views

Are there any DUKPT / AES standards or recommendations?

Are there any standards or industry practices with respect to the implementation of DUKPT with AES (as opposed to DUKPT / TDEA which is covered by ANSI X9.24-1:2009)? Understanding that DUKPT is a ...
Bjorn Loftis's user avatar
1 vote
0 answers
1k views

How is the Apple FairPlay Server Playback Context (SPC) message generated?

I'm researching encryption tools that use OS-verified hardware such as a TPM or Secure Element. Given that FairPlay only works on iOS and certain Mac hardware, I suspect there is some interaction ...
makerofthings7's user avatar
1 vote
0 answers
646 views

Cancel OpenSSL RSA key generation via command line

I'm running macOS 10.12.1 with OpenSSL 0.9.8zh 14 Jan 2016 When generating an RSA key with the OpenSSL cli you are prompted to enter your passphrase. With most command-line interfaces pressing C-d ...
mbigras's user avatar
  • 173
1 vote
0 answers
131 views

Secure upload/download design with malicious storage server

Assume we have a malicious storage server (a user-agnostic key-value store, supporting server.put(key, value) and server.get(key)) that we want to use for per-user based secure file storage. The two ...
Zizheng Tai's user avatar
1 vote
0 answers
121 views

Is encryption in-flight synonymous to encryption on/over-the-wire?

I hear both used interchangeably, but I figured over-the-wire implied some physical medium. Clarification would be much appreciated, thank you!
mattyb's user avatar
  • 111
1 vote
0 answers
645 views

Can RC4 ciphers be disabled in Windows Server 2008?

Having some difficulty with disabling RC4 ciphers in Windows Server 2008 SP2. All the guidance I'm seeing for doing this is specific to Windows Server 2008 R2, including the creation of registry keys ...
Ryan's user avatar
  • 11
1 vote
0 answers
471 views

Unattended generation of "the perfect keypair"

I'm trying to generate a "perfect keypair" akin to https://linuxich.wordpress.com/short-manual-for-a-perfect-gpg-keypair-using-gpg-v2/ but I want to do it semi-automatized, in gpg2 terms that would be ...
Flavius's user avatar
  • 111
1 vote
0 answers
177 views

Does KillDisk use existing commands on a server to encrypt the data?

I've been reading up on this KillDisk exploit for Linux. https://www.bleepingcomputer.com/news/security/killdisk-ransomware-now-targets-linux-prevents-boot-up-has-faulty-encryption/ Does anyone ...
user53029's user avatar
  • 2,757
1 vote
0 answers
156 views

Does using Oracle TDE guarantees compliance to HIPAA, for persisting sensitive data?

Persisting sensitive customer pharma data is becoming more challenging with stricter HIPAA compliance guidelines, wondering if TDE solves it entirely or are there any gaps that a developer/dba should ...
bluefalcon's user avatar
1 vote
0 answers
146 views

For a web application which employs application layer encryption, is there anyway to modify post parameters which is captured encrypted in burp.?

There is client side javascript controls in place which restricts malicious characters. All form data is transmitted via POST requests. In burp, I can see that all parameters are encrypted into one ...
arju's user avatar
  • 11
1 vote
0 answers
173 views

Implementation of SQL "LIKE" Operator in Database Outsourcing

Recently, I read some papers about DB Outsourcing that implement aggregate functions over encrypted data. What I want to know, is there a method in DB Outsourcing to implement SQL LIKE operator that ...
ThisIsMe's user avatar
1 vote
0 answers
329 views

No authentication, AES encrypted JSON over UDP

I was recently assigned the task of testing a new hardware device which communicates with a JSON API over UDP. For some reason or another, it was decided that AES-CBC-128 should be used to encrypt ...
Stereoblind's user avatar
1 vote
0 answers
5k views

IPSec - Configuration best practices, performance, and realistic tradeoffs for my chosen Ciphers

I understand the term "best" is subjective but I would like to try to keep this discussion as objective as possible and get the opinion of other security professionals for my chosen cipher suite ...
SecureFirewall's user avatar
1 vote
0 answers
247 views

how to secure sensitive data from IT administrators?

My team is outsourcing some of its IT management, including the administrative role. Since our income is based on data we store in the DB, I would like to avoid sharing access to it with the ...
Sergey Malych's user avatar

1
3 4
5
6 7
10