Questions tagged [database]
A structured set of data held in a computer, esp. one that is accessible in various ways.
56
questions
0
votes
0answers
26 views
Blockcipher operation mode pros/cons when used on a database?
say i have a database with multiple independent entries, which i want to encrypt using a block cipher like AES. Which operation mode would be suited for that purpose?
I assume entries can't be ...
0
votes
0answers
9 views
How do I store Argon2 passwords in my database? [migrated]
I'm trying to store user passwords in my DB using Argon2 algorithm.
This is what I obtain by using it:
...
0
votes
1answer
49 views
Is it possible to construct dataset for only another party to consult?
Is it possible to construct a dataset made of some kind of probabilistic encrypted indexes such that anyone can update the information contained in the set but only the one with a secret key could be ...
1
vote
1answer
117 views
End to end encrypted web chat app with stored messages in database
I am working on a web app with an integrated chat. All chats can only occur between two users - not more, not less.
I am very concerned with security, so I would like to encrypt all chat messages with ...
0
votes
0answers
24 views
Does it make sense to try CP-ABE in a database for a individual database records?
I'm almost ready for my graduation research project, and I'm looking for an interesting crypto-related topic. I came across CP-ABE, and since I'm working in infosec it caught my attention.
Will it ...
2
votes
0answers
30 views
Is it possible to encrypt a user’s email in a zero-knowledge way and still send them emails?
This is kind of hypothetical, but let’s say I have a web app and I want to store a user’s email for sending notifications to.
Is there any zero-knowledge way to hide their email from ourselves and ...
1
vote
1answer
93 views
Frequency Attacks on Encrypted Database
I'm trying to build an encrypted database where we can't trust on the database manager. And since encrypt data in a deterministic way is bad, attackers can recover information doing frequency attacks, ...
2
votes
2answers
133 views
Search Over Encrypted Data
I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted ...
2
votes
1answer
212 views
Is an IV useless for encrypting database IDs?
In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
1
vote
2answers
132 views
How secure is a system that retrieves encrypted private keys from a public database?
The system in question is one with multiple users. Each user has a password associated with their account, and each user owns several public-private keypairs. A user's private keys are encrypted using ...
2
votes
1answer
79 views
Encrypting the relationship between two database tables
I'm not a cryptography expert myself, and know enough to know that I shouldn't design my own crypto schemes, so I thought I'd seek advice here.
In an application, let's say we have two database ...
2
votes
0answers
95 views
P2P Website/Database Encryption Process
Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find ...
-1
votes
2answers
185 views
Encrypt login id in database
I am developing a solution where each user is identified with a social security number (SSN). So they log in with their SSN and a password.
I would like to encrypt the SSN somehow (client-side) ...
2
votes
1answer
665 views
Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?
Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue?
Practical example:
...
1
vote
1answer
94 views
how to efficiently prove the query result is empty?
Consider a simplified scenario.
Suppose an untrusted server holds a set of data $A=\{ a_1,a_2,\cdots,a_n\}$.
A client issues a query $b$ to the server and wants to decide if $b\in A$. The server ...
4
votes
2answers
1k views
Hash function used to find duplicate data, at what point is the risk of a chance match sufficient to switch to a stronger hash or bytewise verifying?
In a lot of data management systems, a hash is used as a kind of data fingerprint, with the intent not to cryptographically defeat an opponent, but to quickly identify duplicate data by seeing if ...
3
votes
1answer
578 views
Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)
I am trying to secure user's profile in database (data at rest). This user's profile is downloaded only after successful authentication at server (based on user's entered password and user name).
The ...
2
votes
2answers
231 views
Is the statement true in the context of AES-256 encrypted data stored on a hacked server?
I'm writing a document and I am making an important statement in it, which may be used for strategic decision regarding data-management (possibly from never handling sensitive information online to ...
2
votes
1answer
785 views
Database and End-to-End Encryption
I'm currently designing a mobile/desktop application to synchronize some messages or notes. I'm searching for a way to secure it and to avoid letting the server be able to read the messages.
My goal ...
2
votes
1answer
872 views
AES Key Generation based on database guid
I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since ...
9
votes
1answer
2k views
Encrypting user data with their password?
I had an idea once that all of the user data (including the username) could be encrypted with the user's password. Obviously, most sites would store different data, so using the same password and ...
2
votes
0answers
368 views
CryptDB data re-encryption and onion layers
From the CryptDB paper , I understoond that the onion layers once decrypted are not re-encrypted. Only columns which are queried infrequently will be re-encrypted to higher onion layers. But if we ...
1
vote
1answer
110 views
What are the possible security issues when exporting a plaintext database to a file like this?
Say I have plaintext database with key-value pairs of usernames and passwords. Then I iterate through the database, encrypt the passwords, and write the username and encrypted password pairs to file ...
1
vote
1answer
81 views
Secure way to hash a lookup value
I want to securely store a database table that consists of an account ID and a few columns of sensitive data. The data only has value if it can be associated with the account ID. My thinking is to ...
2
votes
1answer
386 views
What is the best current way to cryptographically secure databases?
I'm currently working on a proposal for some secure complete system and one of the things currently lacking is the database security.
However I don't want to roll my own crypto there and thereby need ...
0
votes
1answer
348 views
Backdoorable hash function in password database
I want to use a (preferably established) hash function that is backdoorable in a password database. I want to do so because I need password escrow (being able to get the cleartext back. I want to ...
5
votes
2answers
2k views
Public key crypto instead of hashing passwords in a database
Suppose I want to keep a client's password database secure (not in plaintext), while still having access to the plaintext password.
Now I generates a public/private keypair. Then I send the public ...
3
votes
1answer
271 views
Secure method of encrypting data within a database
I'm designing a program which makes queries to a database stored locally which could potentially contain a lot of sensitive information. As such the information must be kept secure as possible from ...
-1
votes
2answers
678 views
SQL-Like queries in CRYPTDB doesn't work [closed]
I have downloaded and built Cryptdb and it works well. Most of queries on encrypted database run without any issue but, the query with LIKE key word receives an ...
2
votes
1answer
98 views
Join Datasets While Protecting Anonymity
I've run into this issue a couple of times in my career. I'll see if I can explain with an example (please ignore the fact that this is implausible in the real-world).
Suppose I sell computers, and I ...
1
vote
1answer
2k views
Creating unique keys with md5
The project I'm working on requires me to find a way to create a unique key based on data stored in a table. The table in question consists of x columns and y rows.
In order to create the key I want ...
1
vote
1answer
190 views
How to store and use a Cryptographic Seed in a database [closed]
Companies such as Barclays use cryptographic seeds (for their PINsentry system), RSA do the same for RSA SecurID, but how do they safely secure the seeds in the database.
With passwords you just hash ...
2
votes
2answers
331 views
Is this a valid “fix” for deterministic encryption in encrypted databases?
It appears (after doing some light research) that for encrypted databases to be practical enough to be usable, deterministic encryption is required, specifically with regard to the type of encryption ...
0
votes
2answers
772 views
Database row level encryption scheme
I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
2
votes
0answers
216 views
Encrypted database: how to deal with general queries?
My question is quite related to the concept of homomorphic encryption, which is not practical at all nowadays.
In short, I would like to know how to query encrypted databases. Simple queries which ...
5
votes
3answers
730 views
Cryptographic data structure: sparse array without membership test
I would like a data structure supporting two operations: $\mathsf{set}(k,v)$ and $\mathsf{get}(k)$, with the following properties:
$k$ can be any number between $0$ and something impressively large, ...
1
vote
1answer
167 views
Privacy-Preserving relational databases: checking the existence of a record (or multiple records)
I would like to know if there exists a protocol which performs the following operation in a privacy-preserving fashion:
User $U$ wants to know whether a record is stored in the database. The primary ...
8
votes
1answer
874 views
Adi Shamir's secret database of all primes
I was going through these presentation slides (PDF) on Crypto 2013.
It summarizes the paper, Factoring RSA keys from certified smart cards: Coppersmith in the wild.
In the last slide, it was ...
3
votes
2answers
2k views
Generate a unique 64 bit numeric database key without collisions at $2^{32}$ birthday threshold?
What is the best way to generate a unique 64 bit numeric database key from a string?
For example: if the string is a URL, you could generate a 64 bit key using SipHash or by truncating a SHA256 hash ...
2
votes
1answer
401 views
Can I use asymmetric encryption for more powerful write-protection?
I have a game that I am developing which uses a locally-stored internal database. It does not matter to me whether a user can read the file (which, to me, means I don't need a symmetric cipher), but I ...
2
votes
1answer
529 views
Do companies like CipherCloud really have the option to use homomorphic encryption?
I was reading How is CipherCloud doing homomorphic encryption? and was wondering:
Is there a technically feasible way for companies like CipherCloud to use homomorphic encryption (HE) while ...
4
votes
1answer
1k views
Alternatives to HMAC + CBC?
I'm looking at using HMAC + CBC. The combination looks like this:
ciphertext = AES256(text, k1)
data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext
Where:
...
6
votes
2answers
572 views
A lower bound on the insecurity of CipherCloud?
CipherCloud claims to support , among other things, searchable encryption. A bunch of speculation seems to suggest they did this via some breathtakingly incompetent means( unfortunately such ...
4
votes
1answer
3k views
Hashing passwords with a salt - why use different salt for everyone?
Given a database where we have usernames and passwords, we want to secure users' passwords by hashing them. We should not use only username and passwords in this hash, as someone having data from ...
5
votes
1answer
348 views
Two way encryption with random IV
I'm attempting to encrypt some information into our database to be later pulled back out and displayed to the user. Searching and reading up on different methods I found a post over at stack exchanged ...
4
votes
3answers
2k views
Searching over encrypted data [duplicate]
Is there any library/tool available which can allow me to search over encrypted data?
I would like to encrypt data on client side, send it to cloud and perform search in cloud.
I've been reading ...
89
votes
8answers
26k views
How is CipherCloud doing homomorphic encryption?
Much of the literature and latest papers suggest that homomorphic encryption is still not practical yet.
How is CipherCloud able to achieve this? Does anyone have an idea? Their website does not ...
4
votes
2answers
822 views
Detect tampering of data
I have the following problem:
There are $n$ users and each users fills in three data points per day, this are three integers between say $-10$ and $10$. I have access to the database and hence I am ...
11
votes
1answer
887 views
Why x00 is usually avoided in salt?
In .NET Framework, there is a cryptographic Random Number Generator (RNG) provider which enables to generate a cryptographically strong sequence of random bytes. This provider contain, among others, ...
1
vote
1answer
6k views
AES GCM symmetric encryption of data at rest in c#, ciphertext much longer than plaintext
I've written encryption/decryption routines using AES GCM. Code can be found here.
I recently realized that the cipher text is longer than I believe it should be. It should add the tag and IV onto ...
