Questions tagged [database]
A structured set of data held in a computer, esp. one that is accessible in various ways.
78
questions
4
votes
1answer
226 views
Risks of Using SHA1 Instead of SHA256 for RSA with OAEP Padding
I'm presently implementing a simple RSA-based encryption as follows in PHP (using openssl_public_encrypt):
...
1
vote
1answer
56 views
Differential Privacy: Gaussian Mechanism when $\epsilon >1$, Laplace Mechanism when $\epsilon = 0$
In Differential Privacy resources, the limiting cases of $\epsilon, \delta$ are not justified well enough.
For example, on Wikipedia, it is said that Gaussian mechanism only works when $\epsilon < ...
0
votes
1answer
73 views
Should I protect the salt before storing it in a database or use a pepper (secret salt) instead?
If I protected the salt or used a pepper (secret salt) and an attacker got access to the database he can't do a rainbow table attack on a targeted user (a famous or important person).
Should I use a ...
0
votes
1answer
61 views
Authentication Fold-In in Oracle Database
The Oracle database has a feature known as "Native Network Encryption".
It is a protocol described as a 4-step procedure.
Step 1 : Negotiate parameters for following steps
Step 2 : Exchange ...
1
vote
0answers
30 views
Securing a local database
I am a member of a sports association and I am developping a simple JavaFX application for managing member's license.
This application will be used on a notebook without any connection, it has to be ...
0
votes
0answers
129 views
Is AES/CBC/PKCS5Padding vulnerable if used for store data on a db
Is padding oracle attack applicable to data stored on a DB in AES/CBC/PKCS5Padding?
Specifically I would like to be able to use Postgres with pgcrypto https://www.postgresql.org/docs/13/pgcrypto.html#...
2
votes
2answers
47 views
What is $z_b$ in this introduction to Private Information Retrieval?
I was trying to read this introduction to private information retrieval. On page 12 of the document, a scheme for 1-DB private information retrieval is discussed. I was unable to understand one of the ...
0
votes
0answers
38 views
Homomorphic encryption in social networks
I want to gain some experience with homomorphic encryption, specifically possible applications in social networks.
I am thinking about using a HE library (such as Microsoft SEAL) with a graph database ...
0
votes
0answers
36 views
Mechanisms for masking identifying unique IDs with non-identifying unique IDs to protect privacy?
I need to suggest mechanisms for masking unique codes in a database with different unique codes that are not derived from the original unique codes, but are equivalently unique in that they could ...
0
votes
2answers
69 views
Is this method of salting effective?
So this is my first post on this forum, so bear with me if I sound stupid. I am creating my own web application with JavaScript and MongoDB. I am storing all user information in a Mongo table, and ...
0
votes
0answers
73 views
Is this a reasonable design for encrypting records in a key/value database?
A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
2
votes
1answer
51 views
Crypto scheme to map data to users in a way that is anonymous to database server
I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for ...
0
votes
0answers
20 views
Is my password database encryption flow secure?
I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it
Things I know/think are problematic
using base64 digest + getting the first 32 ...
2
votes
1answer
50 views
End-to-end photo storage
I've been tasked with developing an app that will need to store photos a user takes securely, and I've been struggling to think up a method to do this.
What I was thinking so far is as follows:
When ...
1
vote
1answer
175 views
Advanced Composition (Differential Privacy)
I have a problem understanding the proof of the corollary of Advanced Composition
Theorem Advanced Composition:
For all $\varepsilon,\delta,\delta' \geq 0$ the class of $(\varepsilon,\delta)$-...
2
votes
3answers
139 views
How to devise cryptographic system with data-sharing ability and password reset
I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question.
I am writing a C# .NET application. For my application the ...
3
votes
1answer
123 views
Lemma KL-Divergence (Differential Privacy)
I am studying differential privacy and I got stuck again in proof of a lemma. Which is:
$D_{\infty}^\delta(Y||Z) \leq \epsilon$ if and only if there exists a random variable $Y'$ such that $\Delta(Y,...
2
votes
1answer
135 views
Calculating the privacy that Renyi ($\epsilon, \delta$) Differential Privacy satisfies
I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: $\epsilon$ and $\delta $. I know that the $\epsilon$ tells us something about ...
2
votes
1answer
144 views
Differential Privacy: What is the 'game' between data holder and adversary?
I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
0
votes
1answer
402 views
Can you correct my understanding of Argon2? [closed]
I'm a bit new to the cryptography field (completely new), and could really use your guidance.
Please, correct my understanding, as defined by the following statements.
The ...
1
vote
0answers
33 views
Integrity for mixture of encrypted/unencrypted database fields
I have multiple blobs each (symmetrically) encrypted with its own randomly generated key.
Now I want to encrypt these blob keys with user keys and store them in a database.
A table could have the ...
0
votes
1answer
356 views
A multi-target attack on 128-bit ECDSA private keys
I'm thinking about doing this as a project, but I'm not sure how I'm supposed to proceed.
So I have an 128-bit ECDSA, which would provide about 128 bits of security (if we do not use special methods ...
0
votes
0answers
136 views
Encrypting conversation messages stored in database (symmetric encryption)
I have a chatting application like Slack/Discord.
In this chat application there chat groups and messages sent by users need to be encrypted in the database.
I do not need features like E2E encryption,...
0
votes
1answer
239 views
Security of using constant salt when saving encrypted data to database
Let's say that I want to save some encrypted data to a database through a Spring Boot microservice. For that I will be using Spring Security Crypto that, as the documentation says it uses AES256 with ...
0
votes
0answers
42 views
Prevent everyone except customer to read DB data
We are planning an application that must store sensitive data.
Data is coming from other sources, the application will be a "collector" of third party data.
We need to encrypt database data so no one ...
0
votes
1answer
65 views
Is it possible to construct dataset for only another party to consult?
Is it possible to construct a dataset made of some kind of probabilistic encrypted indexes such that anyone can update the information contained in the set but only the one with a secret key could be ...
4
votes
2answers
2k views
End to end encrypted web chat app with stored messages in database
I am working on a web app with an integrated chat. All chats can only occur between two users - not more, not less.
I am very concerned with security, so I would like to encrypt all chat messages with ...
2
votes
0answers
35 views
Is it possible to encrypt a user’s email in a zero-knowledge way and still send them emails?
This is kind of hypothetical, but let’s say I have a web app and I want to store a user’s email for sending notifications to.
Is there any zero-knowledge way to hide their email from ourselves and ...
1
vote
1answer
127 views
Frequency Attacks on Encrypted Database
I'm trying to build an encrypted database where we can't trust on the database manager. And since encrypt data in a deterministic way is bad, attackers can recover information doing frequency attacks, ...
2
votes
2answers
257 views
Search Over Encrypted Data
I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted ...
2
votes
1answer
367 views
Is an IV useless for encrypting database IDs?
In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
2
votes
2answers
340 views
How secure is a system that retrieves encrypted private keys from a public database?
The system in question is one with multiple users. Each user has a password associated with their account, and each user owns several public-private keypairs. A user's private keys are encrypted using ...
2
votes
1answer
165 views
Encrypting the relationship between two database tables
I'm not a cryptography expert myself, and know enough to know that I shouldn't design my own crypto schemes, so I thought I'd seek advice here.
In an application, let's say we have two database ...
2
votes
0answers
131 views
P2P Website/Database Encryption Process
Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find ...
-1
votes
2answers
392 views
Encrypt login id in database
I am developing a solution where each user is identified with a social security number (SSN). So they log in with their SSN and a password.
I would like to encrypt the SSN somehow (client-side) ...
3
votes
1answer
2k views
Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?
Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue?
Practical example:
...
1
vote
1answer
103 views
how to efficiently prove the query result is empty?
Consider a simplified scenario.
Suppose an untrusted server holds a set of data $A=\{ a_1,a_2,\cdots,a_n\}$.
A client issues a query $b$ to the server and wants to decide if $b\in A$. The server ...
4
votes
2answers
2k views
Hash function used to find duplicate data, at what point is the risk of a chance match sufficient to switch to a stronger hash or bytewise verifying?
In a lot of data management systems, a hash is used as a kind of data fingerprint, with the intent not to cryptographically defeat an opponent, but to quickly identify duplicate data by seeing if ...
3
votes
1answer
991 views
Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)
I am trying to secure user's profile in database (data at rest). This user's profile is downloaded only after successful authentication at server (based on user's entered password and user name).
The ...
2
votes
2answers
258 views
Is the statement true in the context of AES-256 encrypted data stored on a hacked server?
I'm writing a document and I am making an important statement in it, which may be used for strategic decision regarding data-management (possibly from never handling sensitive information online to ...
3
votes
1answer
1k views
Database and End-to-End Encryption
I'm currently designing a mobile/desktop application to synchronize some messages or notes. I'm searching for a way to secure it and to avoid letting the server be able to read the messages.
My goal ...
2
votes
1answer
1k views
AES Key Generation based on database guid
I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since ...
9
votes
1answer
3k views
Encrypting user data with their password?
I had an idea once that all of the user data (including the username) could be encrypted with the user's password. Obviously, most sites would store different data, so using the same password and ...
2
votes
0answers
410 views
CryptDB data re-encryption and onion layers
From the CryptDB paper , I understood that the onion layers once decrypted are not re-encrypted. Only columns which are queried infrequently will be re-encrypted to higher onion layers. But if we know ...
1
vote
1answer
122 views
What are the possible security issues when exporting a plaintext database to a file like this?
Say I have plaintext database with key-value pairs of usernames and passwords. Then I iterate through the database, encrypt the passwords, and write the username and encrypted password pairs to file ...
1
vote
1answer
116 views
Secure way to hash a lookup value
I want to securely store a database table that consists of an account ID and a few columns of sensitive data. The data only has value if it can be associated with the account ID. My thinking is to ...
2
votes
1answer
461 views
What is the best current way to cryptographically secure databases?
I'm currently working on a proposal for some secure complete system and one of the things currently lacking is the database security.
However I don't want to roll my own crypto there and thereby need ...
0
votes
1answer
405 views
Backdoorable hash function in password database
I want to use a (preferably established) hash function that is backdoorable in a password database. I want to do so because I need password escrow (being able to get the cleartext back. I want to ...
5
votes
2answers
3k views
Public key crypto instead of hashing passwords in a database
Suppose I want to keep a client's password database secure (not in plaintext), while still having access to the plaintext password.
Now I generates a public/private keypair. Then I send the public ...
3
votes
1answer
342 views
Secure method of encrypting data within a database
I'm designing a program which makes queries to a database stored locally which could potentially contain a lot of sensitive information. As such the information must be kept secure as possible from ...
