Questions tagged [database]
A structured set of data held in a computer, esp. one that is accessible in various ways.
80
questions
0
votes
1
answer
87
views
Best way to encrypt sensitive data on server with HSM and symmetric keys
I need to store sensitive data (like customer photos) in a SQL database in the most secure way in case of security breaches. The data won't be accessed by the clients, only to internal processes that ...
- 1
0
votes
1
answer
94
views
Compressing SHA256 to be a viable database id?
Don't know a lot about cryptography, so need some help on this.
I would like to use a SHA256 string as a unique id in my database for users, but scaling that would be difficult.
Is it possible to ...
4
votes
1
answer
611
views
Risks of Using SHA1 Instead of SHA256 for RSA with OAEP Padding
I'm presently implementing a simple RSA-based encryption as follows in PHP (using openssl_public_encrypt):
...
- 153
1
vote
1
answer
135
views
Differential Privacy: Gaussian Mechanism when $\epsilon >1$, Laplace Mechanism when $\epsilon = 0$
In Differential Privacy resources, the limiting cases of $\epsilon, \delta$ are not justified well enough.
For example, on Wikipedia, it is said that Gaussian mechanism only works when $\epsilon < ...
0
votes
1
answer
76
views
Should I protect the salt before storing it in a database or use a pepper (secret salt) instead?
If I protected the salt or used a pepper (secret salt) and an attacker got access to the database he can't do a rainbow table attack on a targeted user (a famous or important person).
Should I use a ...
- 107
0
votes
1
answer
76
views
Authentication Fold-In in Oracle Database
The Oracle database has a feature known as "Native Network Encryption".
It is a protocol described as a 4-step procedure.
Step 1 : Negotiate parameters for following steps
Step 2 : Exchange ...
user92099
1
vote
0
answers
32
views
Securing a local database
I am a member of a sports association and I am developping a simple JavaFX application for managing member's license.
This application will be used on a notebook without any connection, it has to be ...
- 11
0
votes
0
answers
270
views
Is AES/CBC/PKCS5Padding vulnerable if used for store data on a db
Is padding oracle attack applicable to data stored on a DB in AES/CBC/PKCS5Padding?
Specifically I would like to be able to use Postgres with pgcrypto https://www.postgresql.org/docs/13/pgcrypto.html#...
- 101
2
votes
2
answers
49
views
What is $z_b$ in this introduction to Private Information Retrieval?
I was trying to read this introduction to private information retrieval. On page 12 of the document, a scheme for 1-DB private information retrieval is discussed. I was unable to understand one of the ...
- 177
0
votes
0
answers
43
views
Homomorphic encryption in social networks
I want to gain some experience with homomorphic encryption, specifically possible applications in social networks.
I am thinking about using a HE library (such as Microsoft SEAL) with a graph database ...
- 1
0
votes
0
answers
40
views
Mechanisms for masking identifying unique IDs with non-identifying unique IDs to protect privacy?
I need to suggest mechanisms for masking unique codes in a database with different unique codes that are not derived from the original unique codes, but are equivalently unique in that they could ...
0
votes
2
answers
77
views
Is this method of salting effective?
So this is my first post on this forum, so bear with me if I sound stupid. I am creating my own web application with JavaScript and MongoDB. I am storing all user information in a Mongo table, and ...
0
votes
0
answers
78
views
Is this a reasonable design for encrypting records in a key/value database?
A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
- 101
2
votes
1
answer
53
views
Crypto scheme to map data to users in a way that is anonymous to database server
I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for ...
- 21
0
votes
0
answers
22
views
Is my password database encryption flow secure?
I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it
Things I know/think are problematic
using base64 digest + getting the first 32 ...
- 101
2
votes
1
answer
52
views
End-to-end photo storage
I've been tasked with developing an app that will need to store photos a user takes securely, and I've been struggling to think up a method to do this.
What I was thinking so far is as follows:
When ...
1
vote
1
answer
216
views
Advanced Composition (Differential Privacy)
I have a problem understanding the proof of the corollary of Advanced Composition
Theorem Advanced Composition:
For all $\varepsilon,\delta,\delta' \geq 0$ the class of $(\varepsilon,\delta)$-...
- 132
2
votes
3
answers
151
views
How to devise cryptographic system with data-sharing ability and password reset
I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question.
I am writing a C# .NET application. For my application the ...
- 121
3
votes
1
answer
153
views
Lemma KL-Divergence (Differential Privacy)
I am studying differential privacy and I got stuck again in proof of a lemma. Which is:
$D_{\infty}^\delta(Y||Z) \leq \epsilon$ if and only if there exists a random variable $Y'$ such that $\Delta(Y,...
- 132
2
votes
1
answer
187
views
Calculating the privacy that Renyi ($\epsilon, \delta$) Differential Privacy satisfies
I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: $\epsilon$ and $\delta $. I know that the $\epsilon$ tells us something about ...
- 21
2
votes
1
answer
151
views
Differential Privacy: What is the 'game' between data holder and adversary?
I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
0
votes
1
answer
483
views
Can you correct my understanding of Argon2? [closed]
I'm a bit new to the cryptography field (completely new), and could really use your guidance.
Please, correct my understanding, as defined by the following statements.
The ...
- 3
1
vote
0
answers
33
views
Integrity for mixture of encrypted/unencrypted database fields
I have multiple blobs each (symmetrically) encrypted with its own randomly generated key.
Now I want to encrypt these blob keys with user keys and store them in a database.
A table could have the ...
- 157
0
votes
1
answer
465
views
A multi-target attack on 128-bit ECDSA private keys
I'm thinking about doing this as a project, but I'm not sure how I'm supposed to proceed.
So I have an 128-bit ECDSA, which would provide about 128 bits of security (if we do not use special methods ...
- 41
0
votes
0
answers
156
views
Encrypting conversation messages stored in database (symmetric encryption)
I have a chatting application like Slack/Discord.
In this chat application there chat groups and messages sent by users need to be encrypted in the database.
I do not need features like E2E encryption,...
- 101
0
votes
1
answer
321
views
Security of using constant salt when saving encrypted data to database
Let's say that I want to save some encrypted data to a database through a Spring Boot microservice. For that I will be using Spring Security Crypto that, as the documentation says it uses AES256 with ...
0
votes
0
answers
42
views
Prevent everyone except customer to read DB data
We are planning an application that must store sensitive data.
Data is coming from other sources, the application will be a "collector" of third party data.
We need to encrypt database data so no one ...
- 1
0
votes
1
answer
66
views
Is it possible to construct dataset for only another party to consult?
Is it possible to construct a dataset made of some kind of probabilistic encrypted indexes such that anyone can update the information contained in the set but only the one with a secret key could be ...
4
votes
2
answers
3k
views
End to end encrypted web chat app with stored messages in database
I am working on a web app with an integrated chat. All chats can only occur between two users - not more, not less.
I am very concerned with security, so I would like to encrypt all chat messages with ...
- 43
2
votes
0
answers
39
views
Is it possible to encrypt a user’s email in a zero-knowledge way and still send them emails?
This is kind of hypothetical, but let’s say I have a web app and I want to store a user’s email for sending notifications to.
Is there any zero-knowledge way to hide their email from ourselves and ...
- 193
1
vote
1
answer
132
views
Frequency Attacks on Encrypted Database
I'm trying to build an encrypted database where we can't trust on the database manager. And since encrypt data in a deterministic way is bad, attackers can recover information doing frequency attacks, ...
2
votes
2
answers
270
views
Search Over Encrypted Data
I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted ...
2
votes
1
answer
386
views
Is an IV useless for encrypting database IDs?
In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
- 123
2
votes
2
answers
371
views
How secure is a system that retrieves encrypted private keys from a public database?
The system in question is one with multiple users. Each user has a password associated with their account, and each user owns several public-private keypairs. A user's private keys are encrypted using ...
- 123
2
votes
1
answer
183
views
Encrypting the relationship between two database tables
I'm not a cryptography expert myself, and know enough to know that I shouldn't design my own crypto schemes, so I thought I'd seek advice here.
In an application, let's say we have two database ...
- 121
2
votes
0
answers
135
views
P2P Website/Database Encryption Process
Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find ...
-1
votes
2
answers
401
views
Encrypt login id in database
I am developing a solution where each user is identified with a social security number (SSN). So they log in with their SSN and a password.
I would like to encrypt the SSN somehow (client-side) ...
- 99
3
votes
1
answer
3k
views
Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?
Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue?
Practical example:
...
- 133
1
vote
1
answer
104
views
how to efficiently prove the query result is empty?
Consider a simplified scenario.
Suppose an untrusted server holds a set of data $A=\{ a_1,a_2,\cdots,a_n\}$.
A client issues a query $b$ to the server and wants to decide if $b\in A$. The server ...
- 457
4
votes
2
answers
2k
views
Hash function used to find duplicate data, at what point is the risk of a chance match sufficient to switch to a stronger hash or bytewise verifying?
In a lot of data management systems, a hash is used as a kind of data fingerprint, with the intent not to cryptographically defeat an opponent, but to quickly identify duplicate data by seeing if ...
- 211
3
votes
1
answer
1k
views
Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)
I am trying to secure user's profile in database (data at rest). This user's profile is downloaded only after successful authentication at server (based on user's entered password and user name).
The ...
- 133
2
votes
2
answers
264
views
Is the statement true in the context of AES-256 encrypted data stored on a hacked server?
I'm writing a document and I am making an important statement in it, which may be used for strategic decision regarding data-management (possibly from never handling sensitive information online to ...
- 123
3
votes
1
answer
1k
views
Database and End-to-End Encryption
I'm currently designing a mobile/desktop application to synchronize some messages or notes. I'm searching for a way to secure it and to avoid letting the server be able to read the messages.
My goal ...
- 133
2
votes
1
answer
1k
views
AES Key Generation based on database guid
I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since ...
- 21
9
votes
1
answer
3k
views
Encrypting user data with their password?
I had an idea once that all of the user data (including the username) could be encrypted with the user's password. Obviously, most sites would store different data, so using the same password and ...
- 222
2
votes
0
answers
426
views
CryptDB data re-encryption and onion layers
From the CryptDB paper , I understood that the onion layers once decrypted are not re-encrypted. Only columns which are queried infrequently will be re-encrypted to higher onion layers. But if we know ...
- 355
1
vote
1
answer
124
views
What are the possible security issues when exporting a plaintext database to a file like this?
Say I have plaintext database with key-value pairs of usernames and passwords. Then I iterate through the database, encrypt the passwords, and write the username and encrypted password pairs to file ...
- 13
1
vote
1
answer
133
views
Secure way to hash a lookup value
I want to securely store a database table that consists of an account ID and a few columns of sensitive data. The data only has value if it can be associated with the account ID. My thinking is to ...
- 113
2
votes
1
answer
479
views
What is the best current way to cryptographically secure databases?
I'm currently working on a proposal for some secure complete system and one of the things currently lacking is the database security.
However I don't want to roll my own crypto there and thereby need ...
- 44.6k
0
votes
1
answer
414
views
Backdoorable hash function in password database
I want to use a (preferably established) hash function that is backdoorable in a password database. I want to do so because I need password escrow (being able to get the cleartext back. I want to ...
- 197