Questions tagged [database]
A structured set of data held in a computer, esp. one that is accessible in various ways.
89
questions
0
votes
1
answer
159
views
How many bits should change in a password salt?
In https://crypto.stackexchange.com/a/27828/79037, it's indicated that one can "save space" by using something globally-unique, like an application-wide "pepper", together with ...
- 323
0
votes
1
answer
38
views
Utility Guarantee of Small Data Base Mechanism in Differential Privacy
I am reading Section 4.1 (An offline algorithm: SmallDB) of The Algorithmic Foundations of Differential Privacy by Dwork and Roth. I am stuck at the proof of Proposition 4.4, which is about the ...
- 101
1
vote
0
answers
76
views
AES-GCM for sensitive database field - good solution?
I have been researching the best encryption to use in a .NET application for managing a sensitive database field (column). This encryption is on top of e.g. AWS at-rest encryption applied to the whole ...
- 11
2
votes
1
answer
53
views
Does anyone know of how I would authenticate the data my algorithm generates?
I have a pytorch model that generates bond trade pairs that have a high probability of reverting to the mean in a 30 day time period.
I want to sell the signals, but I do not want them to be ...
1
vote
2
answers
178
views
Derive related universally unique identifier (UUID) from a main UUID
Given a list of base entities (B) with each of them having a universally unique identifier (UUID) of 128 bits.
I want to attach to them a list of ≤ 7 related entities (TE, UE, ..., ZE) with each of ...
- 453
3
votes
1
answer
191
views
How is the Unix / PostgreSQL crypt function a trapdoor function?
I am looking at this in the context of password hashing in PostgreSQL, specifically, the crypt function of the pgcrypto ...
- 133
0
votes
1
answer
53
views
Is there any way to ensure that a network merge, after a parition, never causes disagreements?
Background: A cryptocurrency, such as Bitcoin, have a global order of all transactions that is guaranteed to be agreed by all participating nodes. With Bitcoin, this is ensured by making the longest ...
- 563
2
votes
1
answer
90
views
Approximate differential privacy: avoiding composition in vector-queries
Assume we have an $n$-dimensional real-valued function $f$ whose $\ell_1$ sensitivity is equal to $GS(f) = 1$. We can also assume the sensitivity of each dimension is also $\Delta f = 1$.
For pure ...
0
votes
2
answers
576
views
Password encryption in database
I want to store passwords in a database in a way I can reuse them to authenticate users (symmetrical encryption).
I read some good information here: https://cheatsheetseries.owasp.org/cheatsheets/...
1
vote
1
answer
346
views
Best way to encrypt sensitive data on server with HSM and symmetric keys
I need to store sensitive data (like customer photos) in a SQL database in the most secure way in case of security breaches. The data won't be accessed by the clients, only by internal processes that ...
- 11
0
votes
1
answer
268
views
Compressing SHA256 to be a viable database id?
Don't know a lot about cryptography, so need some help on this.
I would like to use a SHA256 string as a unique id in my database for users, but scaling that would be difficult.
Is it possible to ...
6
votes
1
answer
2k
views
Risks of Using SHA1 Instead of SHA256 for RSA with OAEP Padding
I'm presently implementing a simple RSA-based encryption as follows in PHP (using openssl_public_encrypt):
...
- 173
1
vote
1
answer
631
views
Differential Privacy: Gaussian Mechanism when $\epsilon >1$, Laplace Mechanism when $\epsilon = 0$
In Differential Privacy resources, the limiting cases of $\epsilon, \delta$ are not justified well enough.
For example, on Wikipedia, it is said that Gaussian mechanism only works when $\epsilon < ...
0
votes
1
answer
104
views
Should I protect the salt before storing it in a database or use a pepper (secret salt) instead?
If I protected the salt or used a pepper (secret salt) and an attacker got access to the database he can't do a rainbow table attack on a targeted user (a famous or important person).
Should I use a ...
- 107
0
votes
1
answer
168
views
Authentication Fold-In in Oracle Database
The Oracle database has a feature known as "Native Network Encryption".
It is a protocol described as a 4-step procedure.
Step 1 : Negotiate parameters for following steps
Step 2 : Exchange ...
user92099
1
vote
0
answers
39
views
Securing a local database
I am a member of a sports association and I am developping a simple JavaFX application for managing member's license.
This application will be used on a notebook without any connection, it has to be ...
- 11
0
votes
0
answers
981
views
Is AES/CBC/PKCS5Padding vulnerable if used for store data on a db
Is padding oracle attack applicable to data stored on a DB in AES/CBC/PKCS5Padding?
Specifically I would like to be able to use Postgres with pgcrypto https://www.postgresql.org/docs/13/pgcrypto.html#...
- 101
2
votes
2
answers
54
views
What is $z_b$ in this introduction to Private Information Retrieval?
I was trying to read this introduction to private information retrieval. On page 12 of the document, a scheme for 1-DB private information retrieval is discussed. I was unable to understand one of the ...
- 187
0
votes
0
answers
53
views
Homomorphic encryption in social networks
I want to gain some experience with homomorphic encryption, specifically possible applications in social networks.
I am thinking about using a HE library (such as Microsoft SEAL) with a graph database ...
- 1
0
votes
0
answers
59
views
Mechanisms for masking identifying unique IDs with non-identifying unique IDs to protect privacy?
I need to suggest mechanisms for masking unique codes in a database with different unique codes that are not derived from the original unique codes, but are equivalently unique in that they could ...
0
votes
2
answers
184
views
Is this method of salting effective?
So this is my first post on this forum, so bear with me if I sound stupid. I am creating my own web application with JavaScript and MongoDB. I am storing all user information in a Mongo table, and ...
0
votes
0
answers
136
views
Is this a reasonable design for encrypting records in a key/value database?
A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
- 101
2
votes
1
answer
63
views
Crypto scheme to map data to users in a way that is anonymous to database server
I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for ...
- 21
0
votes
0
answers
24
views
Is my password database encryption flow secure?
I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it
Things I know/think are problematic
using base64 digest + getting the first 32 ...
- 101
2
votes
1
answer
69
views
End-to-end photo storage
I've been tasked with developing an app that will need to store photos a user takes securely, and I've been struggling to think up a method to do this.
What I was thinking so far is as follows:
When ...
2
votes
1
answer
425
views
Advanced Composition (Differential Privacy)
I have a problem understanding the proof of the corollary of Advanced Composition
Theorem Advanced Composition:
For all $\varepsilon,\delta,\delta' \geq 0$ the class of $(\varepsilon,\delta)$-...
- 152
2
votes
3
answers
179
views
How to devise cryptographic system with data-sharing ability and password reset
I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question.
I am writing a C# .NET application. For my application the ...
- 121
3
votes
1
answer
186
views
Lemma KL-Divergence (Differential Privacy)
I am studying differential privacy and I got stuck again in proof of a lemma. Which is:
$D_{\infty}^\delta(Y||Z) \leq \epsilon$ if and only if there exists a random variable $Y'$ such that $\Delta(Y,...
- 152
2
votes
1
answer
407
views
Calculating the privacy that Renyi ($\epsilon, \delta$) Differential Privacy satisfies
I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: $\epsilon$ and $\delta $. I know that the $\epsilon$ tells us something about ...
- 21
3
votes
1
answer
201
views
Differential Privacy: What is the 'game' between data holder and adversary?
I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
0
votes
1
answer
662
views
Can you correct my understanding of Argon2? [closed]
I'm a bit new to the cryptography field (completely new), and could really use your guidance.
Please, correct my understanding, as defined by the following statements.
The ...
- 3
1
vote
0
answers
35
views
Integrity for mixture of encrypted/unencrypted database fields
I have multiple blobs each (symmetrically) encrypted with its own randomly generated key.
Now I want to encrypt these blob keys with user keys and store them in a database.
A table could have the ...
- 157
0
votes
1
answer
927
views
A multi-target attack on 128-bit ECDSA private keys
I'm thinking about doing this as a project, but I'm not sure how I'm supposed to proceed.
So I have an 128-bit ECDSA, which would provide about 128 bits of security (if we do not use special methods ...
- 41
0
votes
0
answers
220
views
Encrypting conversation messages stored in database (symmetric encryption)
I have a chatting application like Slack/Discord.
In this chat application there chat groups and messages sent by users need to be encrypted in the database.
I do not need features like E2E encryption,...
- 101
0
votes
1
answer
567
views
Security of using constant salt when saving encrypted data to database
Let's say that I want to save some encrypted data to a database through a Spring Boot microservice. For that I will be using Spring Security Crypto that, as the documentation says it uses AES256 with ...
0
votes
0
answers
42
views
Prevent everyone except customer to read DB data
We are planning an application that must store sensitive data.
Data is coming from other sources, the application will be a "collector" of third party data.
We need to encrypt database data so no one ...
- 1
0
votes
1
answer
68
views
Is it possible to construct dataset for only another party to consult?
Is it possible to construct a dataset made of some kind of probabilistic encrypted indexes such that anyone can update the information contained in the set but only the one with a secret key could be ...
4
votes
2
answers
3k
views
End to end encrypted web chat app with stored messages in database
I am working on a web app with an integrated chat. All chats can only occur between two users - not more, not less.
I am very concerned with security, so I would like to encrypt all chat messages with ...
- 43
2
votes
0
answers
40
views
Is it possible to encrypt a user’s email in a zero-knowledge way and still send them emails?
This is kind of hypothetical, but let’s say I have a web app and I want to store a user’s email for sending notifications to.
Is there any zero-knowledge way to hide their email from ourselves and ...
- 183
1
vote
1
answer
165
views
Frequency Attacks on Encrypted Database
I'm trying to build an encrypted database where we can't trust on the database manager. And since encrypt data in a deterministic way is bad, attackers can recover information doing frequency attacks, ...
2
votes
2
answers
300
views
Search Over Encrypted Data
I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted ...
2
votes
1
answer
434
views
Is an IV useless for encrypting database IDs?
In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
- 123
2
votes
2
answers
465
views
How secure is a system that retrieves encrypted private keys from a public database?
The system in question is one with multiple users. Each user has a password associated with their account, and each user owns several public-private keypairs. A user's private keys are encrypted using ...
- 123
2
votes
1
answer
245
views
Encrypting the relationship between two database tables
I'm not a cryptography expert myself, and know enough to know that I shouldn't design my own crypto schemes, so I thought I'd seek advice here.
In an application, let's say we have two database ...
- 121
2
votes
0
answers
149
views
P2P Website/Database Encryption Process
Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find ...
-1
votes
2
answers
429
views
Encrypt login id in database
I am developing a solution where each user is identified with a social security number (SSN). So they log in with their SSN and a password.
I would like to encrypt the SSN somehow (client-side) ...
- 99
3
votes
1
answer
3k
views
Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?
Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue?
Practical example:
...
- 133
1
vote
1
answer
107
views
how to efficiently prove the query result is empty?
Consider a simplified scenario.
Suppose an untrusted server holds a set of data $A=\{ a_1,a_2,\cdots,a_n\}$.
A client issues a query $b$ to the server and wants to decide if $b\in A$. The server ...
- 477
4
votes
2
answers
3k
views
Hash function used to find duplicate data, at what point is the risk of a chance match sufficient to switch to a stronger hash or bytewise verifying?
In a lot of data management systems, a hash is used as a kind of data fingerprint, with the intent not to cryptographically defeat an opponent, but to quickly identify duplicate data by seeing if ...
- 211
3
votes
1
answer
1k
views
Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)
I am trying to secure user's profile in database (data at rest). This user's profile is downloaded only after successful authentication at server (based on user's entered password and user name).
The ...
- 133