Questions tagged [database]

A structured set of data held in a computer, esp. one that is accessible in various ways.

Filter by
Sorted by
Tagged with
0 votes
1 answer
87 views

Best way to encrypt sensitive data on server with HSM and symmetric keys

I need to store sensitive data (like customer photos) in a SQL database in the most secure way in case of security breaches. The data won't be accessed by the clients, only to internal processes that ...
user avatar
  • 1
0 votes
1 answer
94 views

Compressing SHA256 to be a viable database id?

Don't know a lot about cryptography, so need some help on this. I would like to use a SHA256 string as a unique id in my database for users, but scaling that would be difficult. Is it possible to ...
user avatar
4 votes
1 answer
611 views

Risks of Using SHA1 Instead of SHA256 for RSA with OAEP Padding

I'm presently implementing a simple RSA-based encryption as follows in PHP (using openssl_public_encrypt): ...
user avatar
  • 153
1 vote
1 answer
135 views

Differential Privacy: Gaussian Mechanism when $\epsilon >1$, Laplace Mechanism when $\epsilon = 0$

In Differential Privacy resources, the limiting cases of $\epsilon, \delta$ are not justified well enough. For example, on Wikipedia, it is said that Gaussian mechanism only works when $\epsilon < ...
user avatar
0 votes
1 answer
76 views

Should I protect the salt before storing it in a database or use a pepper (secret salt) instead?

If I protected the salt or used a pepper (secret salt) and an attacker got access to the database he can't do a rainbow table attack on a targeted user (a famous or important person). Should I use a ...
user avatar
0 votes
1 answer
76 views

Authentication Fold-In in Oracle Database

The Oracle database has a feature known as "Native Network Encryption". It is a protocol described as a 4-step procedure. Step 1 : Negotiate parameters for following steps Step 2 : Exchange ...
user avatar
1 vote
0 answers
32 views

Securing a local database

I am a member of a sports association and I am developping a simple JavaFX application for managing member's license. This application will be used on a notebook without any connection, it has to be ...
user avatar
  • 11
0 votes
0 answers
270 views

Is AES/CBC/PKCS5Padding vulnerable if used for store data on a db

Is padding oracle attack applicable to data stored on a DB in AES/CBC/PKCS5Padding? Specifically I would like to be able to use Postgres with pgcrypto https://www.postgresql.org/docs/13/pgcrypto.html#...
user avatar
2 votes
2 answers
49 views

What is $z_b$ in this introduction to Private Information Retrieval?

I was trying to read this introduction to private information retrieval. On page 12 of the document, a scheme for 1-DB private information retrieval is discussed. I was unable to understand one of the ...
user avatar
0 votes
0 answers
43 views

Homomorphic encryption in social networks

I want to gain some experience with homomorphic encryption, specifically possible applications in social networks. I am thinking about using a HE library (such as Microsoft SEAL) with a graph database ...
user avatar
0 votes
0 answers
40 views

Mechanisms for masking identifying unique IDs with non-identifying unique IDs to protect privacy?

I need to suggest mechanisms for masking unique codes in a database with different unique codes that are not derived from the original unique codes, but are equivalently unique in that they could ...
user avatar
0 votes
2 answers
77 views

Is this method of salting effective?

So this is my first post on this forum, so bear with me if I sound stupid. I am creating my own web application with JavaScript and MongoDB. I am storing all user information in a Mongo table, and ...
user avatar
0 votes
0 answers
78 views

Is this a reasonable design for encrypting records in a key/value database?

A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
user avatar
  • 101
2 votes
1 answer
53 views

Crypto scheme to map data to users in a way that is anonymous to database server

I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for ...
user avatar
0 votes
0 answers
22 views

Is my password database encryption flow secure?

I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it Things I know/think are problematic using base64 digest + getting the first 32 ...
user avatar
2 votes
1 answer
52 views

End-to-end photo storage

I've been tasked with developing an app that will need to store photos a user takes securely, and I've been struggling to think up a method to do this. What I was thinking so far is as follows: When ...
user avatar
1 vote
1 answer
216 views

Advanced Composition (Differential Privacy)

I have a problem understanding the proof of the corollary of Advanced Composition Theorem Advanced Composition: For all $\varepsilon,\delta,\delta' \geq 0$ the class of $(\varepsilon,\delta)$-...
user avatar
2 votes
3 answers
151 views

How to devise cryptographic system with data-sharing ability and password reset

I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question. I am writing a C# .NET application. For my application the ...
user avatar
3 votes
1 answer
153 views

Lemma KL-Divergence (Differential Privacy)

I am studying differential privacy and I got stuck again in proof of a lemma. Which is: $D_{\infty}^\delta(Y||Z) \leq \epsilon$ if and only if there exists a random variable $Y'$ such that $\Delta(Y,...
user avatar
2 votes
1 answer
187 views

Calculating the privacy that Renyi ($\epsilon, \delta$) Differential Privacy satisfies

I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: $\epsilon$ and $\delta $. I know that the $\epsilon$ tells us something about ...
user avatar
2 votes
1 answer
151 views

Differential Privacy: What is the 'game' between data holder and adversary?

I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
user avatar
0 votes
1 answer
483 views

Can you correct my understanding of Argon2? [closed]

I'm a bit new to the cryptography field (completely new), and could really use your guidance. Please, correct my understanding, as defined by the following statements. The ...
user avatar
1 vote
0 answers
33 views

Integrity for mixture of encrypted/unencrypted database fields

I have multiple blobs each (symmetrically) encrypted with its own randomly generated key. Now I want to encrypt these blob keys with user keys and store them in a database. A table could have the ...
user avatar
0 votes
1 answer
465 views

A multi-target attack on 128-bit ECDSA private keys

I'm thinking about doing this as a project, but I'm not sure how I'm supposed to proceed. So I have an 128-bit ECDSA, which would provide about 128 bits of security (if we do not use special methods ...
user avatar
0 votes
0 answers
156 views

Encrypting conversation messages stored in database (symmetric encryption)

I have a chatting application like Slack/Discord. In this chat application there chat groups and messages sent by users need to be encrypted in the database. I do not need features like E2E encryption,...
user avatar
  • 101
0 votes
1 answer
321 views

Security of using constant salt when saving encrypted data to database

Let's say that I want to save some encrypted data to a database through a Spring Boot microservice. For that I will be using Spring Security Crypto that, as the documentation says it uses AES256 with ...
user avatar
0 votes
0 answers
42 views

Prevent everyone except customer to read DB data

We are planning an application that must store sensitive data. Data is coming from other sources, the application will be a "collector" of third party data. We need to encrypt database data so no one ...
user avatar
0 votes
1 answer
66 views

Is it possible to construct dataset for only another party to consult?

Is it possible to construct a dataset made of some kind of probabilistic encrypted indexes such that anyone can update the information contained in the set but only the one with a secret key could be ...
user avatar
4 votes
2 answers
3k views

End to end encrypted web chat app with stored messages in database

I am working on a web app with an integrated chat. All chats can only occur between two users - not more, not less. I am very concerned with security, so I would like to encrypt all chat messages with ...
user avatar
2 votes
0 answers
39 views

Is it possible to encrypt a user’s email in a zero-knowledge way and still send them emails?

This is kind of hypothetical, but let’s say I have a web app and I want to store a user’s email for sending notifications to. Is there any zero-knowledge way to hide their email from ourselves and ...
user avatar
  • 193
1 vote
1 answer
132 views

Frequency Attacks on Encrypted Database

I'm trying to build an encrypted database where we can't trust on the database manager. And since encrypt data in a deterministic way is bad, attackers can recover information doing frequency attacks, ...
user avatar
2 votes
2 answers
270 views

Search Over Encrypted Data

I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted ...
user avatar
2 votes
1 answer
386 views

Is an IV useless for encrypting database IDs?

In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
user avatar
  • 123
2 votes
2 answers
371 views

How secure is a system that retrieves encrypted private keys from a public database?

The system in question is one with multiple users. Each user has a password associated with their account, and each user owns several public-private keypairs. A user's private keys are encrypted using ...
user avatar
2 votes
1 answer
183 views

Encrypting the relationship between two database tables

I'm not a cryptography expert myself, and know enough to know that I shouldn't design my own crypto schemes, so I thought I'd seek advice here. In an application, let's say we have two database ...
user avatar
  • 121
2 votes
0 answers
135 views

P2P Website/Database Encryption Process

Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find ...
user avatar
-1 votes
2 answers
401 views

Encrypt login id in database

I am developing a solution where each user is identified with a social security number (SSN). So they log in with their SSN and a password. I would like to encrypt the SSN somehow (client-side) ...
user avatar
3 votes
1 answer
3k views

Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?

Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue? Practical example: ...
user avatar
  • 133
1 vote
1 answer
104 views

how to efficiently prove the query result is empty?

Consider a simplified scenario. Suppose an untrusted server holds a set of data $A=\{ a_1,a_2,\cdots,a_n\}$. A client issues a query $b$ to the server and wants to decide if $b\in A$. The server ...
user avatar
  • 457
4 votes
2 answers
2k views

Hash function used to find duplicate data, at what point is the risk of a chance match sufficient to switch to a stronger hash or bytewise verifying?

In a lot of data management systems, a hash is used as a kind of data fingerprint, with the intent not to cryptographically defeat an opponent, but to quickly identify duplicate data by seeing if ...
user avatar
  • 211
3 votes
1 answer
1k views

Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)

I am trying to secure user's profile in database (data at rest). This user's profile is downloaded only after successful authentication at server (based on user's entered password and user name). The ...
user avatar
2 votes
2 answers
264 views

Is the statement true in the context of AES-256 encrypted data stored on a hacked server?

I'm writing a document and I am making an important statement in it, which may be used for strategic decision regarding data-management (possibly from never handling sensitive information online to ...
user avatar
  • 123
3 votes
1 answer
1k views

Database and End-to-End Encryption

I'm currently designing a mobile/desktop application to synchronize some messages or notes. I'm searching for a way to secure it and to avoid letting the server be able to read the messages. My goal ...
user avatar
2 votes
1 answer
1k views

AES Key Generation based on database guid

I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since ...
user avatar
9 votes
1 answer
3k views

Encrypting user data with their password?

I had an idea once that all of the user data (including the username) could be encrypted with the user's password. Obviously, most sites would store different data, so using the same password and ...
user avatar
  • 222
2 votes
0 answers
426 views

CryptDB data re-encryption and onion layers

From the CryptDB paper , I understood that the onion layers once decrypted are not re-encrypted. Only columns which are queried infrequently will be re-encrypted to higher onion layers. But if we know ...
user avatar
  • 355
1 vote
1 answer
124 views

What are the possible security issues when exporting a plaintext database to a file like this?

Say I have plaintext database with key-value pairs of usernames and passwords. Then I iterate through the database, encrypt the passwords, and write the username and encrypted password pairs to file ...
user avatar
  • 13
1 vote
1 answer
133 views

Secure way to hash a lookup value

I want to securely store a database table that consists of an account ID and a few columns of sensitive data. The data only has value if it can be associated with the account ID. My thinking is to ...
user avatar
  • 113
2 votes
1 answer
479 views

What is the best current way to cryptographically secure databases?

I'm currently working on a proposal for some secure complete system and one of the things currently lacking is the database security. However I don't want to roll my own crypto there and thereby need ...
user avatar
  • 44.6k
0 votes
1 answer
414 views

Backdoorable hash function in password database

I want to use a (preferably established) hash function that is backdoorable in a password database. I want to do so because I need password escrow (being able to get the cleartext back. I want to ...
user avatar
  • 197