Hot answers tagged

226 votes

Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?

Yes, it is possible. However, that runs the risk of destroying the device without getting the data off first, which is undesirable. It also does not achieve the political goals of forcing Apple to ...
Xander's user avatar
  • 35.8k
116 votes

Will quantum computers render AES obsolete?

Quantum computing will change the encryption game, but it is not yet clear how much it will change. It's not clear because we are not yet certain what sorts of problems quantum computers can solve. ...
Cort Ammon's user avatar
  • 9,256
103 votes

Why has the NSA had a hand in deciding on encryption standards?

The NSA is a composite organization, that comprises several sub-entities called "directorates" with various scopes and goals. The NSA, as a whole, is supposed to have a multitude of roles; its signal ...
Thomas Pornin's user avatar
94 votes

Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?

What makes you think that they haven't already? This case is about setting a precedent to obtain access whenever the government desires. They chose this case because America's fear of terrorism will ...
erickson's user avatar
  • 1,782
85 votes

Is it safe to use Dropbox in its present state?

It does not matter much how the data are encrypted as long as the owner of the data is not the only one in control of the encryption key. This in effect means that data encryption and decryption ...
Steffen Ullrich's user avatar
78 votes

Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?

It doesn't scale While the general consensus is that such technology exists and would be available to FBI, it's not an appropriate general solution because it might be applicable to this case but (...
Peteris's user avatar
  • 8,429
73 votes

How is WhatsApp sending end-to-end encrypted messages in push notifications?

WhatsApp could be using VOIP background mode along with PushKit for solving this problem. Voip pushes are: delivered directly to the app. considered high-priority notifications and are delivered ...
Abhay Singh's user avatar
71 votes

Use multiple computers for faster brute force

Sure it's possible, but it doesn't really help. The number of possibilities is just too large. Consider that a 256-bit key has 2256 possible values. That's 12✕1076, or 12 followed by 76 zeroes. If we ...
Neil Smithline's user avatar
67 votes

Why would I ever use AES-256-CBC if AES-256-GCM is more secure?

CBC and GCM are quite different. Both are secure when used correctly, but CBC isn't as parallelizable and lacks built-in authentication. Due to this, CBC is only really practical for encrypting local ...
Therac - Peace for Palestine's user avatar
57 votes

Encrypting text file with AES 256 instead of password manager

Considering those compromises you mention, do you think that encrypting files yourself will be easy? How do you know you won't get into those same pitfalls that resulted in compromises of password ...
Dmitry Grigoryev's user avatar
45 votes

Do I need to use TLS if data is already encrypted and gets decrypted client-side?

You should serve this data over HTTPS regardless. As Gh0stFish pointed out, you can simply use an S3 bucket policy to require this. There are a couple reasons for this: Using plain HTTP makes it ...
bk2204's user avatar
  • 9,294
44 votes

Pseudorandom vs. True Random

There is a (common) misconception in this question that there is such a thing as “true” randomness and that this matters for security. In fact, whether “true” randomness exists is a philosophical ...
Gilles 'SO- stop being evil''s user avatar
40 votes

Use multiple computers for faster brute force

I did a calculation on this one once. Let's assume AES can only be broken using brute force. Clearly we are going to need a counter, which counts from 0 to 2256-1, and on average it will need to ...
Cort Ammon's user avatar
  • 9,256
35 votes

Why does IV not need to be secret in AES CBC encryption?

I think it's easier to split this into its component parts, and consider them as separate entities: AES and CBC. AES itself does not "basically consist of XORing together chunks of the block" - it's ...
Polynomial's user avatar
  • 135k
35 votes

What is the difference between JWT and encrypting some json manually with AES?

JSON Web Tokens (= JWTs) are based on the RFC 7519 and all differences will be extensively described there. If you take a look at this, you will see, that they are much more than what you seem to have ...
Tom K.'s user avatar
  • 7,955
35 votes

Can I recover a lost AES key?

Realistically, no you cannot. AES is very resistant to known plaint text attacks like most block ciphers. It's lucky you didn't lose any information and have the original database backup because your ...
Aide's user avatar
  • 311
33 votes

Sql database password encryption opinion needed

No, this is not a good idea! As Lukas pointed out in an comment, you want to hash a password, never encrypt it! With your schema, it would be possible to get the plaintext passwords from an database ...
Josef's user avatar
  • 5,973
29 votes

Why would I ever use AES-256-CBC if AES-256-GCM is more secure?

Big nitpick: GCM = CBC + Authentication. Nope, GCM = CTR + Authentication. But in general you are right; CBC is an older mode that was invented back in the dark ages cryptographically speaking (...
Luis Casillas's user avatar
24 votes

Why did TLS 1.3 drop AES-CBC?

The problem here is not so much with CBC, but with alternatives that are easier to implement safely, without losing mathematical security.In fact, AES-CBC turned out to be notoriously difficult to ...
J.A.K.'s user avatar
  • 4,823
23 votes

AES use same Nonce security risk?

When using AES-GCM, using the same nonce and key pair for multiple messages is catastrophic. You lose all of the security guarantees AES is supposed to provide. This is the worse possible scenario ...
Xander's user avatar
  • 35.8k
21 votes

Can I use SHA-512 hash as AES key?

Technically, not as stated. AES-256 requires a 256bit key. SHA-512 will output 512 bits so unless you chop off half of the digest it will not work. A better solution is to use a standard and well ...
d1str0's user avatar
  • 2,348
21 votes

Is openssl aes-256-cbc encryption safe for offsite backup

You should never use OpenSSL's command line utility for general purpose encryption. It is actually designed only as a test of the library's internal encryption routines. Because of this, there are a ...
forest's user avatar
  • 66.5k
20 votes

Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?

You are assuming the problem is technical. It might be political / legal. Let's assume the government already has the technical capability of extracting this information from phones, without Apple ...
Otheus's user avatar
  • 667
20 votes

How secure is AES-256-CBC with user provided password and initialization vector

My suspicion is: you're doing it wrong™. This is why I think so, from the top of my head: The variable holding the ciphertext is called hash. You are encrypting the user name. This looks like an XY-...
Tobi Nary's user avatar
  • 14.4k
20 votes

Is encryption of passwords needed for an HTTPS website?

Encrypting the password before sending it over HTTPS probably doesn't add more security. Consider: how is the password encrypted by the sender, and how is it decrypted by the receiver? If you use a ...
S.L. Barth is on's user avatar
20 votes

RSA key exchange

TL;DR: Skip to "Using result of DH". Because you started with "I want to create a message exchange program" together with "I don’t know how to use DH", a tedious preface: ...
Z.T.'s user avatar
  • 8,434
19 votes

Is ccrypt 'AES 256' file encryption fundamentally flawed

Password-based encryption is inherently vulnerable to dictionary attacks. Indeed, when you have the encrypted file, you can always try to decrypt it (or parts of it) with a given password and see if ...
Thomas Pornin's user avatar
19 votes

Designing my own HSM using an Arduino

First, Apple's Secure Enclave is a module which ensures that the boot loader only runs code signed by Apple. That's not what you're doing, you are trying to build a Hardware Security Module (HSM). ...
Mike Ounsworth's user avatar
18 votes encryption claims revisited with their proprietary, patented "xAES" algorithm

From what you describe, what they do is that they tunnel data in some SSL (this is reasonable) but add an extra encryption layer in Javascript (this is not reasonable). The whole reasoning is faulty. ...
Thomas Pornin's user avatar
17 votes

What is the impact of the reported weak IV in 7 Zip?

In CBC mode, the Initialization Vector (IV) has to meet two properties: Uniqueness: Here the IV is very likely unique because of time(NULL) and gettimeofday() which are basically the current time of ...
Faulst's user avatar
  • 368

Only top scored, non community-wiki answers of a minimum length are eligible