Questions tagged [database]
A structured set of data held in a computer, esp. one that is accessible in various ways.
1
vote
1answer
56 views
Encrypted Database
I'm trying to build a encrypted database where we cant trust on the database manager. And since encrypt data in a deterministic way is bad, attackers can recover information doing frequency attacks, I ...
2
votes
2answers
74 views
Search Over Encrypted Data
I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted ...
2
votes
1answer
117 views
Is an IV useless for encrypting database IDs?
In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
1
vote
2answers
109 views
How secure is a system that retrieves encrypted private keys from a public database?
The system in question is one with multiple users. Each user has a password associated with their account, and each user owns several public-private keypairs. A user's private keys are encrypted using ...
2
votes
1answer
48 views
Encrypting the relationship between two database tables
I'm not a cryptography expert myself, and know enough to know that I shouldn't design my own crypto schemes, so I thought I'd seek advice here.
In an application, let's say we have two database ...
2
votes
0answers
72 views
P2P Website/Database Encryption Process
Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find ...
-1
votes
2answers
60 views
Encrypt login id in database
I am developing a solution where each user is identified with a social security number (SSN). So they log in with their SSN and a password.
I would like to encrypt the SSN somehow (client-side) ...
1
vote
1answer
256 views
Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?
Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue?
Practical example:
...
1
vote
1answer
86 views
how to efficiently prove the query result is empty?
Consider a simplified scenario.
Suppose an untrusted server holds a set of data $A=\{ a_1,a_2,\cdots,a_n\}$.
A client issues a query $b$ to the server and wants to decide if $b\in A$. The server ...
5
votes
2answers
884 views
Hash function used to find duplicate data, at what point is the risk of a chance match sufficient to switch to a stronger hash or bytewise verifying?
In a lot of data management systems, a hash is used as a kind of data fingerprint, with the intent not to cryptographically defeat an opponent, but to quickly identify duplicate data by seeing if ...
3
votes
1answer
433 views
Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)
I am trying to secure user's profile in database (data at rest). This user's profile is downloaded only after successful authentication at server (based on user's entered password and user name).
The ...
3
votes
2answers
201 views
Is the statement true in the context of AES-256 encrypted data stored on a hacked server?
I'm writing a document and I am making an important statement in it, which may be used for strategic decision regarding data-management (possibly from never handling sensitive information online to ...
2
votes
1answer
642 views
AES Key Generation based on database guid
I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since ...
8
votes
1answer
2k views
Encrypting user data with their password?
I had an idea once that all of the user data (including the username) could be encrypted with the user's password. Obviously, most sites would store different data, so using the same password and ...
2
votes
0answers
304 views
CryptDB data re-encryption and onion layers
From the CryptDB paper , I understoond that the onion layers once decrypted are not re-encrypted. Only columns which are queried infrequently will be re-encrypted to higher onion layers. But if we ...
1
vote
1answer
107 views
What are the possible security issues when exporting a plaintext database to a file like this?
Say I have plaintext database with key-value pairs of usernames and passwords. Then I iterate through the database, encrypt the passwords, and write the username and encrypted password pairs to file ...
1
vote
1answer
70 views
Secure way to hash a lookup value
I want to securely store a database table that consists of an account ID and a few columns of sensitive data. The data only has value if it can be associated with the account ID. My thinking is to ...
2
votes
1answer
335 views
What is the best current way to cryptographically secure databases?
I'm currently working on a proposal for some secure complete system and one of the things currently lacking is the database security.
However I don't want to roll my own crypto there and thereby need ...
0
votes
1answer
307 views
Backdoorable hash function in password database
I want to use a (preferably established) hash function that is backdoorable in a password database. I want to do so because I need password escrow (being able to get the cleartext back. I want to ...
5
votes
2answers
2k views
Public key crypto instead of hashing passwords in a database
Suppose I want to keep a client's password database secure (not in plaintext), while still having access to the plaintext password.
Now I generates a public/private keypair. Then I send the public ...
3
votes
1answer
255 views
Secure method of encrypting data within a database
I'm designing a program which makes queries to a database stored locally which could potentially contain a lot of sensitive information. As such the information must be kept secure as possible from ...
-1
votes
2answers
618 views
SQL-Like queries in CRYPTDB doesn't work [closed]
I have downloaded and built Cryptdb and it works well. Most of queries on encrypted database run without any issue but, the query with LIKE key word receives an ...
2
votes
1answer
84 views
Join Datasets While Protecting Anonymity
I've run into this issue a couple of times in my career. I'll see if I can explain with an example (please ignore the fact that this is implausible in the real-world).
Suppose I sell computers, and I ...
1
vote
1answer
1k views
Creating unique keys with md5
The project I'm working on requires me to find a way to create a unique key based on data stored in a table. The table in question consists of x columns and y rows.
In order to create the key I want ...
1
vote
1answer
158 views
How to store and use a Cryptographic Seed in a database [closed]
Companies such as Barclays use cryptographic seeds (for their PINsentry system), RSA do the same for RSA SecurID, but how do they safely secure the seeds in the database.
With passwords you just hash ...
2
votes
2answers
293 views
Is this a valid “fix” for deterministic encryption in encrypted databases?
It appears (after doing some light research) that for encrypted databases to be practical enough to be usable, deterministic encryption is required, specifically with regard to the type of encryption ...
0
votes
2answers
648 views
Database row level encryption scheme
I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
2
votes
0answers
215 views
Encrypted database: how to deal with general queries?
My question is quite related to the concept of homomorphic encryption, which is not practical at all nowadays.
In short, I would like to know how to query encrypted databases. Simple queries which ...
5
votes
3answers
659 views
Cryptographic data structure: sparse array without membership test
I would like a data structure supporting two operations: $\mathsf{set}(k,v)$ and $\mathsf{get}(k)$, with the following properties:
$k$ can be any number between $0$ and something impressively large, ...
1
vote
1answer
164 views
Privacy-Preserving relational databases: checking the existence of a record (or multiple records)
I would like to know if there exists a protocol which performs the following operation in a privacy-preserving fashion:
User $U$ wants to know whether a record is stored in the database. The primary ...
7
votes
1answer
754 views
Adi Shamir's secret database of all primes
I was going through these presentation slides (PDF) on Crypto 2013.
It summarizes the paper, Factoring RSA keys from certified smart cards: Coppersmith in the wild.
In the last slide, it was ...
3
votes
2answers
2k views
Generate a unique 64 bit numeric database key without collisions at $2^{32}$ birthday threshold?
What is the best way to generate a unique 64 bit numeric database key from a string?
For example: if the string is a URL, you could generate a 64 bit key using SipHash or by truncating a SHA256 hash ...
2
votes
1answer
373 views
Can I use asymmetric encryption for more powerful write-protection?
I have a game that I am developing which uses a locally-stored internal database. It does not matter to me whether a user can read the file (which, to me, means I don't need a symmetric cipher), but I ...
2
votes
1answer
520 views
Do companies like CipherCloud really have the option to use homomorphic encryption?
I was reading How is CipherCloud doing homomorphic encryption? and was wondering:
Is there a technically feasible way for companies like CipherCloud to use homomorphic encryption (HE) while ...
4
votes
1answer
1k views
Alternatives to HMAC + CBC?
I'm looking at using HMAC + CBC. The combination looks like this:
ciphertext = AES256(text, k1)
data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext
Where:
...
6
votes
2answers
570 views
A lower bound on the insecurity of CipherCloud?
CipherCloud claims to support , among other things, searchable encryption. A bunch of speculation seems to suggest they did this via some breathtakingly incompetent means( unfortunately such ...
4
votes
1answer
2k views
Hashing passwords with a salt - why use different salt for everyone?
Given a database where we have usernames and passwords, we want to secure users' passwords by hashing them. We should not use only username and passwords in this hash, as someone having data from ...
5
votes
1answer
329 views
Two way encryption with random IV
I'm attempting to encrypt some information into our database to be later pulled back out and displayed to the user. Searching and reading up on different methods I found a post over at stack exchanged ...
4
votes
3answers
1k views
Searching over encrypted data [duplicate]
Is there any library/tool available which can allow me to search over encrypted data?
I would like to encrypt data on client side, send it to cloud and perform search in cloud.
I've been reading ...
85
votes
8answers
26k views
How is CipherCloud doing homomorphic encryption?
Much of the literature and latest papers suggest that homomorphic encryption is still not practical yet.
How is CipherCloud able to achieve this? Does anyone have an idea? Their website does not ...
4
votes
2answers
754 views
Detect tampering of data
I have the following problem:
There are $n$ users and each users fills in three data points per day, this are three integers between say $-10$ and $10$. I have access to the database and hence I am ...
11
votes
1answer
827 views
Why x00 is usually avoided in salt?
In .NET Framework, there is a cryptographic Random Number Generator (RNG) provider which enables to generate a cryptographically strong sequence of random bytes. This provider contain, among others, ...
1
vote
1answer
5k views
AES GCM symmetric encryption of data at rest in c#, ciphertext much longer than plaintext
I've written encryption/decryption routines using AES GCM. Code can be found here.
I recently realized that the cipher text is longer than I believe it should be. It should add the tag and IV onto ...
6
votes
3answers
4k views
Which of these 3 AES 128 symmetric encrypt/decrypt routines is most secure?
I am developing a symmetric en-/decryption routine written in c# for a database containing user-specific, sensitive information.
I have narrowed down the implementation to 3 different approaches, ...
1
vote
1answer
138 views
Tips on conceiving safe software messaging platform
I have a personal project in mind in which I plan to use cryptography in order to let the users be confident in the fact that, even if all data get's stolen, it would be virtually impossible to crack ...
5
votes
1answer
766 views
Are there any Implementations of Secure Indexes? [closed]
There are several papers about Secure Indexes, for Example "Searchable Symmetric Encryption:
Improved Definitions and Efficient Constructions" and "Secure Indexes". ...
5
votes
1answer
463 views
How can I store confident data with OpenID?
I want to make a system that needs to store some confident user information in a database. I intend on using OpenID for user authentication.
I would like encrypt the data in a way that it can only be ...
3
votes
1answer
236 views
A set of key pairs and one hash to secure them
I have a simple problem: I have a set of users' ECDSA key pairs, and say I want to encrypt them with a simple algorithm. I have access to one variable that uniquely identifies the user, so I hash it ...
12
votes
3answers
2k views
Salting when encrypting?
I was attending a database encryption session at a developers conference. The presenter (who was a published author on the subject) said that MS SQL Server did not support salted hashes in the ...
