New answers tagged

0

Try this: # gpg -d your_encrypted_file > /dev/null gpg: encrypted with 2048-bit ELG key, ID 245AC23E80C4A478, created 2005-12-17] "Bobby - bobby@gmail.com" gpg: encrypted with 4096-bit RSA key, ID CB6D005B993F02AB, created 2020-04-08 "Mary - Mary@gmail.com" gpg: encrypted with 4096-bit RSA key, ID 8AB5B9CEB6F0B2D2, created 2018-11-29 "...


0

No. tls_ecdhe_rsa_with_aes_128_gcm_sha256 would use an RSA certificate and tls_ecdhe_ecdsa_with_aes_128_gcm_sha256 would use an ECDSA certificate. Read again about how TLS works, what Diffie Hellman key exchange does, what digital signatures do, etc.


0

Here's how I understand LUKS works: A LUKS volume is encrypted by a single key. A LUKS volume has a number of keyslots. Each keyslot stores an encrypted version of the key, protected by a (key derived from a) keyphrase. Do you want to prevent access to: The key that's actually used to perform the disk encryption. The passphrases that are used to encrypt ...


2

The simplest answer would be to use a symmetric cipher (e.g. AES). You are the only user, so you only have to keep the AES key securely stored. Symmetrical algorithms are generally faster than asymmetrical ones (but probably not by much for text though). You use only one operation at encryption/decryption time. Now for your questions: Is this safe? ...


1

0xFF, not zeroes. One wipe is adequate, three wipes are more than enough on NAND. Some software may cheat you when doing this type of write, however (for speed). True, some data may be left in discarded blocks, but accessing those blocks is not trivial. SSDs discard a lot more blocks than spinning drives (HDDs), perhaps 10-20% of total capacity in the ...


2

This is a recurring question on this site. I've written several details answers. How to make data in hard disk unrecoverable on linux What can be recovered? Securely deleted files The tricky part is SSD drives that do wear leveling in hardware. That means that some of the data will be in "hidden" sectors that you can't access / wipe from the operating ...


5

This is a recurring question, and it comes with a bunch of caveats. Threat level is a factor. If this is government classified data the official answer is "Destroy the Drives!" That said, in the commercial world there is a lot more tolerance. Running DBAN or dd with zeroes against the entire drive will sufficiently wipe it. You should of course VERIFY ...


2

Once particular user find him positive for covid-19 he will upload his private key to the server. A private key is supposed to be kept private and uploading it to a server will defeat this requirement. I'm very much concern about user's privacy. So I need to make a user completely anonymous. in my case I don't want the server to find out UUID of A....


0

Disclaimer: This is from memory, I haven not looked this up. Maybe if I have time later today, I will come back and update this answer. I don't believe that the behaviour that you're seeing necessarily means that private keys are stored on the cloud; it could also mean that new devices are automatically sent the chat history from other devices. The mental ...


1

KeePass specifically has a chrome extension, so other Chrome extensions could read the same memory that KeePass is using. The OS memory protections are not going to help in that case. Hence the encryption. Another family of reasons for memory encryption, in general, is because there are hardware attacks where someone can access memory: Cold boot attacks ...


0

On AWS, ACM and ELB are integrated and ACM and KMS are integrated such that the private key is stored in KMS. So that is secure and what you want to do.


1

A nonce doesn't have to be secret or unpredictable; it just can't be reused. It's perfectly fine to use an all-zero nonce one time with a given key. You just have to make sure you never reuse it, just as with any other nonce value you'd use. To be clear, this means a maximum of one message.


4

We need more information about exactly what do you mean in your question, whether you're asking about TLS 1.3 or older versions, from SSLv3 up to TLS 1.2, which worked a little differently, and what kind of thing you would like to do that is currently impossible. If you only intend to use primitives already specified for TLS and just want to mix and match ...


3

I have created a visual explanation of the firefox algorithm, not very pretty but I hope it helps.


1

This is very weak security on all fronts! The user's password is P4$$w0rdP4$$w0rd and it's encrypted using XOR encryption, with the key CdZ4MLMPgYtAE9gQ80gMtg==. This produces the ciphertext posted by the OP above, WeJcFMQ/8+8QJ/w0hHh+0g==. To verify: First, use xxd to get the underlying binary of the plaintext password: echo -n 'P4$$w0rdP4$$w0rd' | xxd ...


0

Like many things in life, the answer is yes and no. Per your questions: You're right, there's no problem about the world knowing your public key - that's why it is called Public Key No, you're wrong on that. Since your service provider controls your service, it can act as a perfect Man In The Middle and intercept all your corresponding with Joe. Now, if ...


0

A lot of answers here only provided information about LUKS1 (released in 2004), so I thought I'd add a reference to LUKS2 (released in 2017). The LUKS header necessarily contains unencrypted metadata as well as your one or more symmetrically encrypted "keyslots" containing your master key and salts necessary for decrypting the data on your LUKS volume. In ...


10

The trick is that it's the payload of the packet that's encapsulated, not the whole TCP packet. Therefore, when the packet leaves the tor exit node unencrypted, it is sent with the return address of the tor exit node. So a service will know that a packet came from a tor exit node and is being anonymized, but unless there's information in the packet payload ...


7

How Tor protects anonymity The anonymity happens because while the Tor exit node knows the final packet and its destination, it doesn't know where the packet originated from. Similarly, the entry node knows where the packet originated from, but it doesn't know the packet contents or where it is destined for. As a result (theoretically), none of the nodes ...


0

PGP (Pretty Good Privacy) is the closest alternative to your proposal. This mechanism generates a strong random symmetric key for encrypting the data and cyphers that key asymmetrically. So you have the symmetric key encrypted ONLY with the public key and then the data is ONLY encrypted with the symmetrical key. My suggestion is: If you can reach both PC’s ...


0

Yes, there are several potential ways to find out, what algorithm was used. But lets analyze what is actually happening first. Unrestricted file uploads are dangerous. Therefore, several different measures are suggested to protect against the different threats, including the following (quoted from the linked OWASP page): It is recommended to use an ...


3

Unfortunately, the answer is "It depends". But first, we need to clear up that KMS keys and Buckets are mutually independent, one KMS key (called a CMK) can be tied to multiple buckets, and one bucket can have objects encrypted by multiple CMKs. Secondly, because of the tight integration between KMS and S3, the only real access control we have is via key ...


1

IMHO, you should examine the whole thing in terms of costs/benefits and risk/mitigation. As you store data in non controled storage, you store it in encrypted form. Ok: the risk is that someone (possibly a staff member of the hosting service) can access the data the mitigation is to encrypt the data the cost is to implement encryption and maintain the ...


Top 50 recent answers are included