Questions tagged [database]

A structured set of data held in a computer, esp. one that is accessible in various ways.

Filter by
Sorted by
Tagged with
0 votes
1 answer
159 views

How many bits should change in a password salt?

In https://crypto.stackexchange.com/a/27828/79037, it's indicated that one can "save space" by using something globally-unique, like an application-wide "pepper", together with ...
ManRow's user avatar
  • 323
0 votes
1 answer
38 views

Utility Guarantee of Small Data Base Mechanism in Differential Privacy

I am reading Section 4.1 (An offline algorithm: SmallDB) of The Algorithmic Foundations of Differential Privacy by Dwork and Roth. I am stuck at the proof of Proposition 4.4, which is about the ...
KRWTS's user avatar
  • 101
1 vote
0 answers
76 views

AES-GCM for sensitive database field - good solution?

I have been researching the best encryption to use in a .NET application for managing a sensitive database field (column). This encryption is on top of e.g. AWS at-rest encryption applied to the whole ...
MFL's user avatar
  • 11
2 votes
1 answer
53 views

Does anyone know of how I would authenticate the data my algorithm generates?

I have a pytorch model that generates bond trade pairs that have a high probability of reverting to the mean in a 30 day time period. I want to sell the signals, but I do not want them to be ...
John Shelburne's user avatar
1 vote
2 answers
178 views

Derive related universally unique identifier (UUID) from a main UUID

Given a list of base entities (B) with each of them having a universally unique identifier (UUID) of 128 bits. I want to attach to them a list of ≤ 7 related entities (TE, UE, ..., ZE) with each of ...
DurandA's user avatar
  • 453
3 votes
1 answer
191 views

How is the Unix / PostgreSQL crypt function a trapdoor function?

I am looking at this in the context of password hashing in PostgreSQL, specifically, the crypt function of the pgcrypto ...
ahron's user avatar
  • 133
0 votes
1 answer
53 views

Is there any way to ensure that a network merge, after a parition, never causes disagreements?

Background: A cryptocurrency, such as Bitcoin, have a global order of all transactions that is guaranteed to be agreed by all participating nodes. With Bitcoin, this is ensured by making the longest ...
caveman's user avatar
  • 563
2 votes
1 answer
90 views

Approximate differential privacy: avoiding composition in vector-queries

Assume we have an $n$-dimensional real-valued function $f$ whose $\ell_1$ sensitivity is equal to $GS(f) = 1$. We can also assume the sensitivity of each dimension is also $\Delta f = 1$. For pure ...
independentvariable's user avatar
0 votes
2 answers
576 views

Password encryption in database

I want to store passwords in a database in a way I can reuse them to authenticate users (symmetrical encryption). I read some good information here: https://cheatsheetseries.owasp.org/cheatsheets/...
Merinorus's user avatar
1 vote
1 answer
346 views

Best way to encrypt sensitive data on server with HSM and symmetric keys

I need to store sensitive data (like customer photos) in a SQL database in the most secure way in case of security breaches. The data won't be accessed by the clients, only by internal processes that ...
F.C.'s user avatar
  • 11
0 votes
1 answer
268 views

Compressing SHA256 to be a viable database id?

Don't know a lot about cryptography, so need some help on this. I would like to use a SHA256 string as a unique id in my database for users, but scaling that would be difficult. Is it possible to ...
0a6c42bb1c2f8058's user avatar
6 votes
1 answer
2k views

Risks of Using SHA1 Instead of SHA256 for RSA with OAEP Padding

I'm presently implementing a simple RSA-based encryption as follows in PHP (using openssl_public_encrypt): ...
azoundria's user avatar
  • 173
1 vote
1 answer
631 views

Differential Privacy: Gaussian Mechanism when $\epsilon >1$, Laplace Mechanism when $\epsilon = 0$

In Differential Privacy resources, the limiting cases of $\epsilon, \delta$ are not justified well enough. For example, on Wikipedia, it is said that Gaussian mechanism only works when $\epsilon < ...
independentvariable's user avatar
0 votes
1 answer
104 views

Should I protect the salt before storing it in a database or use a pepper (secret salt) instead?

If I protected the salt or used a pepper (secret salt) and an attacker got access to the database he can't do a rainbow table attack on a targeted user (a famous or important person). Should I use a ...
Mohammed Rady's user avatar
0 votes
1 answer
168 views

Authentication Fold-In in Oracle Database

The Oracle database has a feature known as "Native Network Encryption". It is a protocol described as a 4-step procedure. Step 1 : Negotiate parameters for following steps Step 2 : Exchange ...
user avatar
1 vote
0 answers
39 views

Securing a local database

I am a member of a sports association and I am developping a simple JavaFX application for managing member's license. This application will be used on a notebook without any connection, it has to be ...
F4T4liS's user avatar
  • 11
0 votes
0 answers
981 views

Is AES/CBC/PKCS5Padding vulnerable if used for store data on a db

Is padding oracle attack applicable to data stored on a DB in AES/CBC/PKCS5Padding? Specifically I would like to be able to use Postgres with pgcrypto https://www.postgresql.org/docs/13/pgcrypto.html#...
Fabio Bonfante's user avatar
2 votes
2 answers
54 views

What is $z_b$ in this introduction to Private Information Retrieval?

I was trying to read this introduction to private information retrieval. On page 12 of the document, a scheme for 1-DB private information retrieval is discussed. I was unable to understand one of the ...
Sidharth Ghoshal's user avatar
0 votes
0 answers
53 views

Homomorphic encryption in social networks

I want to gain some experience with homomorphic encryption, specifically possible applications in social networks. I am thinking about using a HE library (such as Microsoft SEAL) with a graph database ...
User2123's user avatar
0 votes
0 answers
59 views

Mechanisms for masking identifying unique IDs with non-identifying unique IDs to protect privacy?

I need to suggest mechanisms for masking unique codes in a database with different unique codes that are not derived from the original unique codes, but are equivalently unique in that they could ...
Dinosaur Reporter's user avatar
0 votes
2 answers
184 views

Is this method of salting effective?

So this is my first post on this forum, so bear with me if I sound stupid. I am creating my own web application with JavaScript and MongoDB. I am storing all user information in a Mongo table, and ...
cardinalsfan13's user avatar
0 votes
0 answers
136 views

Is this a reasonable design for encrypting records in a key/value database?

A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
theory's user avatar
  • 101
2 votes
1 answer
63 views

Crypto scheme to map data to users in a way that is anonymous to database server

I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for ...
skydanc3r's user avatar
0 votes
0 answers
24 views

Is my password database encryption flow secure?

I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it Things I know/think are problematic using base64 digest + getting the first 32 ...
CodingKiwi's user avatar
2 votes
1 answer
69 views

End-to-end photo storage

I've been tasked with developing an app that will need to store photos a user takes securely, and I've been struggling to think up a method to do this. What I was thinking so far is as follows: When ...
George Herbert's user avatar
2 votes
1 answer
425 views

Advanced Composition (Differential Privacy)

I have a problem understanding the proof of the corollary of Advanced Composition Theorem Advanced Composition: For all $\varepsilon,\delta,\delta' \geq 0$ the class of $(\varepsilon,\delta)$-...
Miguel Gutierrez's user avatar
2 votes
3 answers
179 views

How to devise cryptographic system with data-sharing ability and password reset

I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question. I am writing a C# .NET application. For my application the ...
csstudent1418's user avatar
3 votes
1 answer
186 views

Lemma KL-Divergence (Differential Privacy)

I am studying differential privacy and I got stuck again in proof of a lemma. Which is: $D_{\infty}^\delta(Y||Z) \leq \epsilon$ if and only if there exists a random variable $Y'$ such that $\Delta(Y,...
Miguel Gutierrez's user avatar
2 votes
1 answer
407 views

Calculating the privacy that Renyi ($\epsilon, \delta$) Differential Privacy satisfies

I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: $\epsilon$ and $\delta $. I know that the $\epsilon$ tells us something about ...
user80982's user avatar
3 votes
1 answer
201 views

Differential Privacy: What is the 'game' between data holder and adversary?

I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
independentvariable's user avatar
0 votes
1 answer
662 views

Can you correct my understanding of Argon2? [closed]

I'm a bit new to the cryptography field (completely new), and could really use your guidance. Please, correct my understanding, as defined by the following statements. The ...
Ideator's user avatar
1 vote
0 answers
35 views

Integrity for mixture of encrypted/unencrypted database fields

I have multiple blobs each (symmetrically) encrypted with its own randomly generated key. Now I want to encrypt these blob keys with user keys and store them in a database. A table could have the ...
darkdragon's user avatar
0 votes
1 answer
927 views

A multi-target attack on 128-bit ECDSA private keys

I'm thinking about doing this as a project, but I'm not sure how I'm supposed to proceed. So I have an 128-bit ECDSA, which would provide about 128 bits of security (if we do not use special methods ...
Anonymous's user avatar
0 votes
0 answers
220 views

Encrypting conversation messages stored in database (symmetric encryption)

I have a chatting application like Slack/Discord. In this chat application there chat groups and messages sent by users need to be encrypted in the database. I do not need features like E2E encryption,...
Kaka you's user avatar
  • 101
0 votes
1 answer
567 views

Security of using constant salt when saving encrypted data to database

Let's say that I want to save some encrypted data to a database through a Spring Boot microservice. For that I will be using Spring Security Crypto that, as the documentation says it uses AES256 with ...
Jose Antonio's user avatar
0 votes
0 answers
42 views

Prevent everyone except customer to read DB data

We are planning an application that must store sensitive data. Data is coming from other sources, the application will be a "collector" of third party data. We need to encrypt database data so no one ...
Claudio's user avatar
0 votes
1 answer
68 views

Is it possible to construct dataset for only another party to consult?

Is it possible to construct a dataset made of some kind of probabilistic encrypted indexes such that anyone can update the information contained in the set but only the one with a secret key could be ...
Afonso Delgado's user avatar
4 votes
2 answers
3k views

End to end encrypted web chat app with stored messages in database

I am working on a web app with an integrated chat. All chats can only occur between two users - not more, not less. I am very concerned with security, so I would like to encrypt all chat messages with ...
KingOfDog's user avatar
2 votes
0 answers
40 views

Is it possible to encrypt a user’s email in a zero-knowledge way and still send them emails?

This is kind of hypothetical, but let’s say I have a web app and I want to store a user’s email for sending notifications to. Is there any zero-knowledge way to hide their email from ourselves and ...
aroooo's user avatar
  • 183
1 vote
1 answer
165 views

Frequency Attacks on Encrypted Database

I'm trying to build an encrypted database where we can't trust on the database manager. And since encrypt data in a deterministic way is bad, attackers can recover information doing frequency attacks, ...
Simão Dolores's user avatar
2 votes
2 answers
300 views

Search Over Encrypted Data

I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted ...
Simão Dolores's user avatar
2 votes
1 answer
434 views

Is an IV useless for encrypting database IDs?

In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
masciugo's user avatar
  • 123
2 votes
2 answers
465 views

How secure is a system that retrieves encrypted private keys from a public database?

The system in question is one with multiple users. Each user has a password associated with their account, and each user owns several public-private keypairs. A user's private keys are encrypted using ...
ExecutionByFork's user avatar
2 votes
1 answer
245 views

Encrypting the relationship between two database tables

I'm not a cryptography expert myself, and know enough to know that I shouldn't design my own crypto schemes, so I thought I'd seek advice here. In an application, let's say we have two database ...
Chiubaka's user avatar
  • 121
2 votes
0 answers
149 views

P2P Website/Database Encryption Process

Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find ...
thebronsonite's user avatar
-1 votes
2 answers
429 views

Encrypt login id in database

I am developing a solution where each user is identified with a social security number (SSN). So they log in with their SSN and a password. I would like to encrypt the SSN somehow (client-side) ...
HelloWorld's user avatar
3 votes
1 answer
3k views

Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?

Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue? Practical example: ...
antak's user avatar
  • 133
1 vote
1 answer
107 views

how to efficiently prove the query result is empty?

Consider a simplified scenario. Suppose an untrusted server holds a set of data $A=\{ a_1,a_2,\cdots,a_n\}$. A client issues a query $b$ to the server and wants to decide if $b\in A$. The server ...
Paradox's user avatar
  • 477
4 votes
2 answers
3k views

Hash function used to find duplicate data, at what point is the risk of a chance match sufficient to switch to a stronger hash or bytewise verifying?

In a lot of data management systems, a hash is used as a kind of data fingerprint, with the intent not to cryptographically defeat an opponent, but to quickly identify duplicate data by seeing if ...
Stilez's user avatar
  • 211
3 votes
1 answer
1k views

Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)

I am trying to secure user's profile in database (data at rest). This user's profile is downloaded only after successful authentication at server (based on user's entered password and user name). The ...
smile.al.d.way's user avatar