Questions tagged [encryption]

Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

Filter by
Sorted by
Tagged with
44
votes
2answers
18k views

Is “real salt” the same as “initialization vectors”?

In the question about real vs. fake salt, the answers describe how real salt 'perturbs the encryption algorithm.' I know roughly how initialization vectors work; is this the same concept, or something ...
43
votes
7answers
11k views

Is layered encryption more secure than long passwords?

The comments in this question debate about the added security of multi-layered encryption. There seems to be some disagreement, and I thought a proper question would be helpful here. So, to provide ...
43
votes
3answers
50k views

What is the best home wireless network encryption algorithm to use?

What is the best home wireless network encryption algorithm to use? I realize the best answer will probably change over time, and hopefully people can provide updated answers as new standards come ...
43
votes
4answers
41k views

Can I use a private key as a public key and vice versa?

I have code to encrypt data using a public key and decrypt it using a private key. This is useful when a client wants to send data to a server and know that only the server can decrypt it. But say I ...
43
votes
4answers
78k views

How secure is 7z encryption?

I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters: Compression parameters: Archive format: 7z Compression level: Ultra ...
42
votes
3answers
11k views

Is it safe to use Dropbox in its present state?

For the record, I understand that absolutely no service is safe, and "the only way to keep a computer from getting hacked is to never connect it to the network". So, we've got that out of the way. I ...
41
votes
4answers
36k views

Is it possible to tell if hard drive is encrypted?

Is it possible to tell if a hard drive is encrypted, regardless of what software was used, i.e., Truecrypt / VeraCrypt / Bitlocker for AES-256? Just the other day, I thought it could be possible to ...
41
votes
3answers
3k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
41
votes
1answer
18k views

Is all data sent over SSH encrypted?

When you are connected to another computer over SSH, is all data transferred between the two computers encrypted? Or is any data sent in plaintext or any other "easy to intercept" format?
41
votes
5answers
57k views

How secure is a Windows password protected zip file?

I need to send some sensitive information to a client. I thought I would email a password protected zip file I created using Windows XP and then call them with the password. Presuming I pick a good ...
40
votes
7answers
21k views

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

We want to protect a game that is basically sold with the computer containing it. The security is done this way: The HDD is encrypted using hardware TPM 1.2, which holds a unique key to decrypt the ...
40
votes
4answers
79k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
39
votes
3answers
7k views

Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?

A common saying among people in the field of cryptography and security is that when providing a back door to law enforcement, you also provide a back door for hackers. I was trying to examine the ...
39
votes
2answers
11k views

How do email clients “send later” without storing a password?

Email clients like Spark for macOS have a feature where a user can send an email later, at any given time, even when the computer is turned off. An SMTP server needs a password based authentication, ...
39
votes
2answers
107k views

Is it possible to decrypt a satellite TV signal without using a smart card?

And if it is possible, why has it been decided to keep using a smart card for this task? I will be grateful if you can provide some practical examples on how to bypass the use of a smart card (if ...
39
votes
5answers
76k views

SHA, RSA and the relation between them

SHA is the hashing mechanism. However, RSA is the encryption algorithm. So does RSA algorithm use SHA hashing mechanism to generate hashing keys which in turn is used to encrypt the message?? ...
39
votes
4answers
44k views

GnuPG decryption not asking for passphrase

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away. Does it store the secret key somewhere and uses it (I ...
39
votes
5answers
3k views

Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?

I've been worried about this password manager, PasswordBox that seems to be gathering quite a bit of steam lately. They seem to have raised VC funding and are offering a free password management and ...
38
votes
4answers
6k views

Is there an encryption algorithm that is fully secure?

Is there an encryption algorithm that is completely secure and isn't based on difficult computational algorithms? If such an algorithm exists, why we don't we use it in SSL/SSH?
38
votes
6answers
9k views

Schemes/ Mechanisms that could provide one time decryption?

I am quite familiar with most of the common undergrad/grad security foundations; but I couldn't find anything related to this scenario: A scheme/system where a piece of data can only be 'decrypted' ...
38
votes
7answers
10k views

How dangerous might be publishing a public key? [duplicate]

Maybe this question sounds obvious, but I wonder how dangerous might be publishing a public key for an asymmetric encryption system? I know public keys are meant for encrypting messages by anyone who'...
38
votes
3answers
26k views

Block chaining modes to avoid

Everyone knows that ECB operation mode with a block cipher should be avoided because of clear and obvious weaknesses. But little attention is given to comparison of the other modes in the context of ...
38
votes
5answers
10k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
37
votes
8answers
5k views

Share certain information only after death

After your death, you want to make sure that a special someone gets a vital piece of information (like the password to your bank account), but: You don't want anyone else to be able to get that ...
37
votes
7answers
13k views

Encrypting With Passwords - Encryption of Key vs. Data

Many password-based encryption utilities (e.g.: KeePass, TrueCrypt) do something along the lines of... Encrypt data with super-strong random-generated key, "data key". Encrypt data key with another ...
37
votes
1answer
9k views

Why can't I use the same key for encryption and MAC?

I wrote a simple file encryption program as an example of how to do encryption correctly, but after reading a questions about encryption + MAC, I think I made a mistake by using the same key for both. ...
37
votes
3answers
10k views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
36
votes
5answers
17k views

What is the use case for using TLS on an internal network?

If there are admin consoles on the internal network and TLS has been disabled what is the use case for enabling it? The only use case I can think of is when you have untrusted users on the network ...
36
votes
1answer
14k views

Why does AES encryption take more time than decryption?

While I was studying the time consumed by some methods I found that encryption take more time than decryption. Is this right? I am using AES (the same steps will be taken during the enc and dec)
36
votes
2answers
41k views

What changed between TLS and DTLS

What did the DTLS (TLS over UDP) authors have to change so that it could run without TCP? Bonus points: Do any of the protocol difference affect the way it should be used, both in terms of interface ...
36
votes
3answers
11k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
35
votes
5answers
7k views

Eduroam requires installation of a CA Certificate - can they decrypt TLS traffic?

Eduroam is an organization that provides free WiFi to educational institutions and around some cities. I don't fully understand how the authentication works, but in order to connect you have to ...
35
votes
4answers
20k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
35
votes
3answers
2k views

Why do WordPress installations retrieve the crypto secrets remotely on installation?

It seems that WordPress retrieves all the crypto constants remotely (via HTTPS): // setup-config.php $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' ); Are there any ...
35
votes
4answers
22k views

Which SSL/TLS ciphers can be considered secure?

The OpenSSL website provides a long list of different ciphers available for SSL and TLS. My question is, which of those ciphers can be considered secure nowadays. I am especially interested in HTTPS, ...
34
votes
8answers
86k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
34
votes
3answers
11k views

Why can a Tor exit node decrypt data, but not the entry node?

Me -> Node A -> Node B -> Node C -> destination The documentation on Tor always states that only the exit node C can see plain text data. How is this possible without me talking to Node C ...
34
votes
2answers
90k views

RSA public key and private key lengths

I'm having a problem understanding the size of an RSA public key and its private key pair. I saw different key sizes for RSA algorithm (512, 1024,... for example), but is this the length of public ...
34
votes
3answers
95k views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
33
votes
6answers
12k views

What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?

I've been learning about PGP, and I asked myself, "Why?" For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used? I can ...
33
votes
6answers
3k views

Is C a good choice for security-related software any longer? [closed]

C is a rock-solid and widespread programming language that is very popular especially in the FOSS community. Many security-related software (such as encryption libraries) are written in C and will ...
33
votes
4answers
8k views

Does KRACK break TLS?

Apologies if this is already answered in the whitepaper, I'm not going to get chance to read it for a few days due to a hectic schedule, but I am already fielding questions from non-techies reading ...
33
votes
6answers
34k views

How secure is NTFS encryption?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? (The encryption option under file|folder -> properties -> advanced -> encrypt.) If the user uses a decent password, can this ...
33
votes
4answers
13k views

HTTPS but NOT encrypted?

I'm accessing Bing (https://www.bing.com) from within China. I got the following information: How could this happen? HTTPS but not encrypted, and with SSL certificate? Here is the packet capture ...
33
votes
2answers
18k views

Which protocols exist for end-to-end encrypted group chat?

I am looking for existing protocols for a group chat with two things: End to end encrypted. Just what you would expect: messages are only decipherable by the chat members and message tampering is ...
33
votes
11answers
94k views

Is Windows BitLocker secure?

Naturally I feel that I have to ask this question, since it's a built-in feature in Windows. Let's say someone has physical access to my PC, is there an easy way for them to access a BitLocker ...
32
votes
3answers
4k views

Should I be able to see patterns in a HS256 encoded JWT?

I was fiddling with https://jwt.io/ using this header { "alg": "HS256", "typ": "JWT" } when I realized that replacing the payload name with something repetitive like AAAAAAAAAAAAAAAAAAAA would ...
32
votes
5answers
67k views

Compute the AES-encryption key given the plaintext and its ciphertext?

I'm tasked with creating database tables in Oracle which contain encrypted strings (i.e., the columns are RAW). The strings are encrypted by the application (using AES, 128-bit key) and stored in ...
32
votes
2answers
5k views

When could 256 bit encryption be brute forced?

Assuming quantum computing continues to improve and continues to perform like this: ... quantum computer completes 2.5-billion-year task in minutes is it reasonable to expect that 256 bit encryption ...
32
votes
1answer
42k views

What key exchange mechanism should be used in TLS?

There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...