226
votes
Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?
Yes, it is possible. However, that runs the risk of destroying the device without getting the data off first, which is undesirable. It also does not achieve the political goals of forcing Apple to ...
- 35.8k
116
votes
Accepted
Will quantum computers render AES obsolete?
Quantum computing will change the encryption game, but it is not yet clear how much it will change. It's not clear because we are not yet certain what sorts of problems quantum computers can solve. ...
- 9,256
103
votes
Why has the NSA had a hand in deciding on encryption standards?
The NSA is a composite organization, that comprises several sub-entities called "directorates" with various scopes and goals. The NSA, as a whole, is supposed to have a multitude of roles; its signal ...
- 326k
94
votes
Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?
What makes you think that they haven't already?
This case is about setting a precedent to obtain access whenever the government desires. They chose this case because America's fear of terrorism will ...
- 1,782
85
votes
Is it safe to use Dropbox in its present state?
It does not matter much how the data are encrypted as long as the owner of the data is not the only one in control of the encryption key. This in effect means that data encryption and decryption ...
- 198k
78
votes
Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?
It doesn't scale
While the general consensus is that such technology exists and would be available to FBI, it's not an appropriate general solution because it might be applicable to this case but (...
- 8,429
73
votes
Accepted
How is WhatsApp sending end-to-end encrypted messages in push notifications?
WhatsApp could be using VOIP background mode along with PushKit for solving this problem.
Voip pushes are:
delivered directly to the app.
considered high-priority notifications and are delivered ...
- 716
71
votes
Accepted
Use multiple computers for faster brute force
Sure it's possible, but it doesn't really help. The number of possibilities is just too large.
Consider that a 256-bit key has 2256 possible values. That's 12✕1076, or 12 followed by 76 zeroes. If we ...
- 14.8k
67
votes
Accepted
Why would I ever use AES-256-CBC if AES-256-GCM is more secure?
CBC and GCM are quite different. Both are secure when used correctly, but CBC isn't as parallelizable and lacks built-in authentication. Due to this, CBC is only really practical for encrypting local ...
57
votes
Accepted
Encrypting text file with AES 256 instead of password manager
Considering those compromises you mention, do you think that encrypting files yourself will be easy? How do you know you won't get into those same pitfalls that resulted in compromises of password ...
- 10.2k
45
votes
Accepted
Do I need to use TLS if data is already encrypted and gets decrypted client-side?
You should serve this data over HTTPS regardless. As Gh0stFish pointed out, you can simply use an S3 bucket policy to require this.
There are a couple reasons for this:
Using plain HTTP makes it ...
- 9,294
44
votes
Accepted
Pseudorandom vs. True Random
There is a (common) misconception in this question that there is such a thing as “true” randomness and that this matters for security. In fact, whether “true” randomness exists is a philosophical ...
40
votes
Use multiple computers for faster brute force
I did a calculation on this one once. Let's assume AES can only be broken using brute force. Clearly we are going to need a counter, which counts from 0 to 2256-1, and on average it will need to ...
- 9,256
35
votes
Accepted
Why does IV not need to be secret in AES CBC encryption?
I think it's easier to split this into its component parts, and consider them as separate entities: AES and CBC.
AES itself does not "basically consist of XORing together chunks of the block" - it's ...
- 135k
35
votes
What is the difference between JWT and encrypting some json manually with AES?
JSON Web Tokens (= JWTs) are based on the RFC 7519 and all differences will be extensively described there. If you take a look at this, you will see, that they are much more than what you seem to have ...
- 7,955
35
votes
Can I recover a lost AES key?
Realistically, no you cannot. AES is very resistant to known plaint text attacks like most block ciphers.
It's lucky you didn't lose any information and have the original database backup because your ...
- 311
33
votes
Sql database password encryption opinion needed
No, this is not a good idea!
As Lukas pointed out in an comment, you want to hash a password, never encrypt it!
With your schema, it would be possible to get the plaintext passwords from an database ...
- 5,973
29
votes
Why would I ever use AES-256-CBC if AES-256-GCM is more secure?
Big nitpick:
GCM = CBC + Authentication.
Nope, GCM = CTR + Authentication.
But in general you are right; CBC is an older mode that was invented back in the dark ages cryptographically speaking (...
- 10.6k
24
votes
Accepted
Why did TLS 1.3 drop AES-CBC?
The problem here is not so much with CBC, but with alternatives that are easier to implement safely, without losing mathematical security.In fact, AES-CBC turned out to be notoriously difficult to ...
- 4,823
23
votes
Accepted
AES use same Nonce security risk?
When using AES-GCM, using the same nonce and key pair for multiple messages is catastrophic. You lose all of the security guarantees AES is supposed to provide. This is the worse possible scenario ...
- 35.8k
21
votes
Can I use SHA-512 hash as AES key?
Technically, not as stated. AES-256 requires a 256bit key. SHA-512 will output 512 bits so unless you chop off half of the digest it will not work.
A better solution is to use a standard and well ...
- 2,348
21
votes
Is openssl aes-256-cbc encryption safe for offsite backup
You should never use OpenSSL's command line utility for general purpose encryption. It is actually designed only as a test of the library's internal encryption routines. Because of this, there are a ...
- 66.5k
20
votes
Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?
You are assuming the problem is technical. It might be political / legal. Let's assume the government already has the technical capability of extracting this information from phones, without Apple ...
- 667
20
votes
How secure is AES-256-CBC with user provided password and initialization vector
My suspicion is: you're doing it wrong™.
This is why I think so, from the top of my head:
The variable holding the ciphertext is called hash.
You are encrypting the user name.
This looks like an XY-...
- 14.4k
20
votes
Accepted
Is encryption of passwords needed for an HTTPS website?
Encrypting the password before sending it over HTTPS probably doesn't add more security.
Consider: how is the password encrypted by the sender, and how is it decrypted by the receiver?
If you use a ...
20
votes
Accepted
RSA key exchange
TL;DR: Skip to "Using result of DH".
Because you started with "I want to create a message exchange program" together with "I don’t know how to use DH", a tedious preface:
...
- 8,434
19
votes
Is ccrypt 'AES 256' file encryption fundamentally flawed
Password-based encryption is inherently vulnerable to dictionary attacks. Indeed, when you have the encrypted file, you can always try to decrypt it (or parts of it) with a given password and see if ...
- 326k
19
votes
Designing my own HSM using an Arduino
First, Apple's Secure Enclave is a module which ensures that the boot loader only runs code signed by Apple. That's not what you're doing, you are trying to build a Hardware Security Module (HSM).
...
- 58.8k
18
votes
Unseen.is encryption claims revisited with their proprietary, patented "xAES" algorithm
From what you describe, what they do is that they tunnel data in some SSL (this is reasonable) but add an extra encryption layer in Javascript (this is not reasonable). The whole reasoning is faulty. ...
- 326k
17
votes
Accepted
What is the impact of the reported weak IV in 7 Zip?
In CBC mode, the Initialization Vector (IV) has to meet two properties:
Uniqueness: Here the IV is very likely unique because of time(NULL) and gettimeofday() which are basically the current time of ...
- 368
Only top scored, non community-wiki answers of a minimum length are eligible