New answers tagged encryption
1
vote
How to properly migrate authentication cookies to using a new encryption scheme on a website while being backwards compatible?
Broadly, the approach makes sense. You should delete (set to expire in the past) any "old_cookie" you receive at the same time you set the new one to move users over as quickly as possible ...
- 45.4k
0
votes
Is deploying a web application to a customer's encrypted drive a secure solution against code theft?
Its a complicated question since the customer is the owner of the drive. I do not know if he would give permision to you encrypt his drive. Furthermore, depending of the country it would not work well ...
0
votes
Risks of encryption keys contained in a memory dump after a crash?
Memory dump may contain “Key material”, i.e. not the key as an array of bytes for AES_Init() API but the key expanded to memory structures. For example, a “Key material” can be a mapping of encryption ...
- 49
2
votes
Accepted
How to avoid performance issues with envelope encryption when using separate DEK's for each piece of data?
Yes, that's a valid approach to use a single DEK in multiple cases and rotate periodically. However, note that the same applies to the KMS key too: you've to rotate periodically.
I'd consider ...
- 36
1
vote
AES mode for reusing same keyset
The entire point of the IV is that it's not secret and not tied to the key, so you can generate a new one for each message. It is important that you never, ever re-use it for multiple messages with ...
- 45.4k
2
votes
AES mode for reusing same keyset
Am I delusional, or is 64bits entropy enough to counter the reuse?
In CTR mode, the entropy contained within the plaintext doesn't get incorporated into the key generation or permutation algorithms. ...
- 341
1
vote
AES mode for reusing same keyset
You should look at existing solutions like the Cryptographic Message Syntax defined in PKCS#7 instead of trying to design your own crypto. With CMS you can
avoid key reuse: every message has its own ...
- 576
0
votes
Accepted
Securely transfer encrypted file and private key from server to phone to offline device
Let us assume, for the moment, the phone is just being used as a USB-stick, rather than anything more clever.
Generate a public/private key-pair on the offline device.
Transfer the public key from ...
- 1,974
0
votes
Is DPAPI usable when only being able to read the file directory?
Not for files encrypted to a user, unless you have (or crack) the user's password. DPAPI (either generation) keys are wrapped using a key derived from the user's password, so if you don't have the ...
- 45.4k
Top 50 recent answers are included