Skip to main content
6 votes

Omit IV for AES128-CBC when requiring to always get the same ciphertext encrypting random IDs

This approach looks very awkward. The fact that you need strange workarounds like this “halfway-CBC” mode to make it work shows that there's definitely something wrong. The solution to only allowing ...
Ja1024's user avatar
  • 9,235
4 votes

Omit IV for AES128-CBC when requiring to always get the same ciphertext encrypting random IDs

Yes, you can set the IV to a fixed value. Of course, using CBC does not provide many advantages, and it has some disadvantages. CBC is vulnerable to bit flip attacks, where flipping a bit in the ...
Sjoerd's user avatar
  • 30.9k
3 votes
Accepted

Is Homomorphic SQL Query Encryption a good idea - and should I use It?

There are all kinds of experimental approaches that try to prevent SQL injection attacks, some of which are quite clever. It's possible that you've found some paper or article where somebody claims ...
Ja1024's user avatar
  • 9,235
2 votes
Accepted

Why does the Signal Protocol use a symmetric key for encryption- when asymmetric keys are more secure?

You have downsides on both modes. Asymmetric encryption is much, much slower, so you would never encrypt anything larger than a key with it, and it can only encrypt data smaller than the key plus ...
ThoriumBR's user avatar
  • 54.5k
2 votes

Is Homomorphic SQL Query Encryption a good idea - and should I use It?

I want to know whether it’s highly recommended, or not? No, it's not recommended for all applications. It has its niche use cases, but if you are not sure you need it, you probably don't need it. I ...
Sjoerd's user avatar
  • 30.9k
1 vote

Is Homomorphic SQL Query Encryption a good idea - and should I use It?

Don't roll-you-own-encryption. Leaving aside the most common reason this advice is cited (because you'll do it wrong and your implementation will have vulnerabilties) and your concerns regarding ...
symcbean's user avatar
  • 18.7k
1 vote
Accepted

Refresh tokens for impersonating user credentials: how to implement them?

The difference between both options is not as big as it may seem. If an attacker has managed to obtain the token encryption key from the server (which should be one of the best-protected assets), then ...
Ja1024's user avatar
  • 9,235

Only top scored, non community-wiki answers of a minimum length are eligible