Questions tagged [encryption]

For questions about encryption and decryption of data, which is the process of encoding data in such a way that adversaries cannot read or tamper with it. Technical questions about encryption (e.g. how does algorithm X work?) are off-topic but might be in scope for our sister sites about Information Security and/or Cryptography.

Filter by
Sorted by
Tagged with
1 vote
1 answer
116 views

Why does Tor need to use onion routing instead of decrypting then re-encrypting when passing to the next node? [closed]

I understand why Tor needs many nodes in each relay, although in the case of connecting a hidden server, the packet is encrypted end to end. So why then must there be multiple layers of encryption on ...
user avatar
3 votes
4 answers
2k views

How to store a password so that it can be passed to another site/service which is expecting a plaintext input

I am developing a website and I would like to allow users to use XMPP for live chat. I would like users to have the option use an existing XMPP account if they wish and store their XMPP username and ...
user avatar
0 votes
0 answers
45 views

How should I handle keys in production

I'm creating an authorisation service, which does signing using a key. For local development I was randomly generating a key on application start-up. Now I'm deploying to the cloud (currently going ...
user avatar
0 votes
0 answers
30 views

Looking for suggestions while implementing JWT token with encryption for webhooks

I need to start providing webhook support for some of my apps, and I was looking at how github seems to implement it on their website and they include a "secret" that one can include in ...
user avatar
  • 287
0 votes
3 answers
144 views

Is offline secure two party computation possible?

Is there a solution for the following problem? We have a function f(x,y) where the inputs are secret an cannot be known by anyone besides the party that submitted them. The output of f is public and ...
user avatar
  • 9
-2 votes
1 answer
63 views

Automated Encryption Keys

A question that I have been wondering for quite some time now, is how do two devices send encrypted data over the internet know the encryption keys to encrypt and decrypt the data, or more importantly ...
user avatar
3 votes
1 answer
93 views

Designing a privnote clone - security considerations

I'd like to build a simple privnote-type clone for fun. The idea is this: User A writes a note in their browser, browser encrypts it client-side Server saves the pre-encrypted note without knowing ...
user avatar
  • 75
-5 votes
2 answers
124 views

Library protection in C++

We have developed an algorithm that processes some data at runtime and is slight efficient in terms of time and computing compared with other solutions out there. Though we sure anyone can develop a ...
user avatar
0 votes
1 answer
257 views

designing a secure/encrypted file storage for a multi-tenant saas app with local and cloud storage in mind

as the title suggest, I need to handle the tenant files in a multi-tenant saas app. fairly common scenario I believe and should have been solved by the gurus already. right now the app is in infancy ...
user avatar
  • 143
1 vote
1 answer
58 views

What is the threat model for deciding between unencrypted vs. encrypted EBS volumes?

Let me start by saying that I'm not questioning the utility of encrypting EBS volumes, nor asking how it works. I'm just wondering what specifically encrypting EBS volumes is protecting against? For ...
user avatar
1 vote
1 answer
77 views

Encryption using a nonstandard-IV

So i got a few xml files that need to be encrypted and it works, no problems here. Now since the latest update of the CodeAnalyzers i got a new warning ( CA5401 ) that tells me, that it is a bad idea ...
user avatar
1 vote
0 answers
142 views

How can i implement two way asymmetric encryption for my app and backend server?

I'm planning to setup a hybrid encryption procedure in my app. So basically i did encryption for data send from client to server using this method, now i'm confused on how to encrypt data send from ...
user avatar
0 votes
2 answers
96 views

How to increase difficulty of intercepting resources downloaded from developer console

I have a web application that allows user view our data that front-end in JavaScript fetches the data via a Restful request to back-end, then render it in the application. The size of each data can ...
user avatar
  • 165
-3 votes
1 answer
65 views

Protecting research source from spyware/data mining

My question is simple: What steps should you take to protect research from the vast amount of spyware or insecure applications on a given device? Background: I do research into developing new models ...
user avatar
-2 votes
1 answer
135 views

How to encrypt player's cards in a Poker client/server architecture in NodeJS?

I am making an online poker server in NodeJS. Currently, the state of the game is being sent to each client. So using debugging tools a client can see all the other player's card IDs. I would like to ...
user avatar
  • 27
4 votes
1 answer
352 views

How can social security numbers be safely stored in databases and retrieved?

How can personal information that needs to be retrieved at a later date be stored securely in a database? For instance when companies store social security numbers and use them for taxation purposes. ...
user avatar
  • 151
2 votes
4 answers
4k views

Is there a way to store a secret API key to my backend, which the frontend can safely ask for?

I'm using the google maps API, which has a secret key that I need to use on the client side. I was thinking of some alternatives to store it safely. One of them is storing it in my flask database. ...
user avatar
1 vote
1 answer
199 views

Encryption key on passwordless authentication

A PHP based webshop running on a shared hosting stores libsodium encrypted personal data in it's MySQL database. To let users have access to their own data, a design very similar to the one discussed ...
user avatar
  • 21
-1 votes
1 answer
224 views

Pattern to encrypt / decrypt data to / from a server without entering the secret key each time?

The title maybe it's a little bit confusing but I am certain that what I want to achieve is a common pattern, even if I didn't found anything on internet. I'm developing a web app that store ...
user avatar
0 votes
1 answer
240 views

Strategies for Rotating MYSQL Encryption Keys

I have a web app that connects to a MYSQL database which has some encrypted data in it. The encrypted data is encrypted using the the mysql AES_ENCRYPT function and a key. Now, this key has been ...
user avatar
  • 9
0 votes
2 answers
217 views

How is there no hit in performance with MongoDB's new FLE?

MongoDB recently announced their new field-level-encryption method for helping tackle DB breaches. (https://www.wired.com/story/field-level-encryption-databases-mongobd/) In other articles it is ...
user avatar
1 vote
2 answers
2k views

Live encryption and decryption of audio

So I am trying to mix my software skills with my electronics skills, and I want to try something a bit different. Basically: buy a walkie talkie, take it apart, remove the microphone and put a rasp pi ...
user avatar
2 votes
1 answer
109 views

Is it possible to create once loadable files?

I know very little about encryption, so I figured I'd ask the internet if it's possible to do the following (and if so, what kind of algorithm should I be looking at): Write some code that saves data ...
user avatar
0 votes
1 answer
80 views

More explicit explanation for password authenticated key retriveal

How can i realize password authenticated key retrieval? I found some description of PAKR: A PAKR (Password-Authenticated Key Retrieval) protocol and its multi-server system allow one party (say, ...
user avatar
  • 11
0 votes
1 answer
74 views

Encrypted Network Traffic in local Network for IoT Devices

I didn't find any helpful questions to this topic, so I am just asking a new question, correct me if I am wrong. I am looking to build my own little smarthome stuff, e.g. a doorlock with an rfid ...
user avatar
  • 3
3 votes
3 answers
1k views

Best approach to creating a secure offline login system in C#?

I'm rather new at programming so I'm still getting a grip on things. I'm creating an offline login system in C# that will have the ability add/remove users. The computer will not be connected to the ...
user avatar
0 votes
1 answer
57 views

Encrypted ID to 3rd party application

I would like to ask you a questions that arose these days with GDPR new rules. What I have is a payments service which use BrainTree to make the payments. In my side I store some information ...
user avatar
  • 345
1 vote
2 answers
192 views

securely store credentials for an unsecure API

I'm writing a slack bot that interfaces end users with an API. That API only method of identification is the raw "login:password" encoded to base64 (it doesn't answer back a token) ... Currently in ...
user avatar
  • 113
0 votes
2 answers
876 views

Open source desktop application and security

I'm currently working on a desktop application in Java (using JavaFX). This application stores some user information, parts of which are sensitive. For example, if the user configures a proxy, it ...
user avatar
1 vote
2 answers
3k views

Keeping sensitive data encrypted in memory

I'm working in a Electronic Funds Transfer (EFT) system and need be very careful with sensitive data like credit card numbers. We need this information do mount the ISO 8583 data before sending to ...
user avatar
0 votes
1 answer
105 views

Thoughts on Data Encryption Strategy for Large Number of Records MongoDB and Azure Key Vault

I have previously implement Client Side Data Encryption using Azure Key Vault using the following approach: Encryption Approach: Every record that needs to be encrypted gets a Content Encryption Key ...
user avatar
1 vote
1 answer
767 views

encrypting a string with public key in client side and decrypt it in backend using private key

I have a client side android app which needs to send an encrypted string to a server implemented in PHP. For this I have chosen an asymmetric algorithm (RSA). Should I: Save a public key in client ...
user avatar
6 votes
3 answers
7k views

Easy Licensing enforcement techniques for C++ Program in Windows

I am developing software in Window 10 and Visual Studio in C++. I would like to restrict the use of the software to a set of computers, by implementing a license control. My thought is to query a ...
user avatar
  • 225
0 votes
1 answer
110 views

On an encrypted connection, are packets' destinations visible to a third-party?

Example: I'm in a coffee shop in Maine, using a VPN whose physical location is in Berlin. I know that my packets between Maine and Berlin are encrypted, so someone snooping on that coffee shop's ...
user avatar
  • 303
-2 votes
1 answer
82 views

How to let users send to a link

I'm building for a client's service that allows developers to build client side forms, similar to formspree.io, etc. Basically, developers can set an action to their HTML forms which send the POST ...
user avatar
  • 63
1 vote
1 answer
391 views

Should I encrypt my cookies using AES?

I'm going to encrypt the following data (server side): email, IP, username { *IP*: { email: *email at this IP* username: *username of email IP* } *IP2*: { email: ...
user avatar
  • 220
1 vote
2 answers
2k views

Encrypt data in code or stored procedures?

I'm working on a Web App where the data is quite sensitive and is required to be encrypted before it is stored in the database. Now there are two ways through which I can achieve this: Encrypt data ...
user avatar
4 votes
5 answers
2k views

Should I encrypt mobile number and otp when sending to backend

I have a login page, where user logs in via his mobile number, He gets an OTP send via backend server, once he enters a One-Time Passcode (OTP), we hit an API like this: https://backend.com/api/login?...
user avatar
  • 151
-1 votes
1 answer
197 views

Can RSA be used to secure client data before sending to server? [closed]

So one day i was reading about RSA and over there it was written that we can secure the data using the public key. So as an idea can I secure the data on the client itself before sending it to the ...
user avatar
  • 51
2 votes
0 answers
212 views

RSA Private key renewal - How often?

Let's say I am using a RSA keypair to encrypt and decrypt a large amount of traffic over a public network. Assume all traffic is padded and the key is 2048 bits, how often would you recommend renewing ...
user avatar
  • 39
4 votes
3 answers
1k views

Saving Passwords for autologin

I know I should encrypt the password whenever I save passwords for security. But I don't know how should I encrypt password that when I save for autologin. If the password was just for checking user,...
user avatar
5 votes
4 answers
1k views

Whats safest way to tell if decryption was successful?

I'm making a C program that uses GTK3 (best documentation ever) and OpenSSL (worst documentation ever) to simply encrypt/decrypt a file using a password. The encryption and decryption functions are ...
user avatar
  • 498
1 vote
1 answer
4k views

Encrypting my data and keeping it safe in Unity

I have a RPG kit in the Unity Store and I wanted to add some protection for the consumers for when they want to save pretty much any information. From the gear the character is wearing to inventory, ...
user avatar
  • 113
0 votes
1 answer
51 views

Managing encryption keys in an application with add-on components

I am developing a product that uses custom hardware with accompanying software. It requires additional components which are sold separately to make the overall application work. Using these ...
user avatar
  • 121
2 votes
2 answers
74 views

Encrypting a folder used for serving images?

I have a Node.js application that reads and writes images from a server. The images are stored in a directory on an Ubuntu operating system. Express static routes serve images from that folder when ...
user avatar
  • 139
5 votes
2 answers
166 views

Is it possible to validate code execution from a remote server?

I'm looking for a way to achieve some kind of code execution validation, so for example if I have a server and a client, I want the client to execute some code (assembly) and send the server ...
user avatar
0 votes
2 answers
1k views

How to prevent copy of my Java application's local multimedia content?

I have recently started a project where I need to make extensive use of videos and books. And all of them are needed to be stored locally. I want to be able to search all these books and get access ...
user avatar
0 votes
1 answer
436 views

Secure communication between a mobile app and a microcontroller

I have a MCU-based design that essentially controls other hardware and this MCU is controlled through an app. I was hoping someone could help me figure out how to secure this communication between the ...
user avatar
  • 1
4 votes
2 answers
206 views

How to add users to a mapping table?

In the accepted answer to "Encrypting stored data for multiple unique users to access information", @lserni describes a mapping table for users. But among the operations for the table, they didn't ...
user avatar
  • 43
-1 votes
1 answer
669 views

ASP.NET - Data Encryption & Decryption framework designs

I have the following app scenario where i would need to implement the cell-level encryption. Database - MS SQL Server Web Technology - ASP.net MVC Existing app scenario:- Currently the web ...
user avatar
  • 366