Questions tagged [database]
A structured set of data held in a computer, esp. one that is accessible in various ways.
69
questions
2
votes
1answer
41 views
Crypto scheme to map data to users in a way that is anonymous to database server
I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for ...
0
votes
0answers
15 views
Is my password database encryption flow secure?
I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it
Things I know/think are problematic
using base64 digest + getting the first 32 ...
1
vote
1answer
34 views
End-to-end photo storage
I've been tasked with developing an app that will need to store photos a user takes securely, and I've been struggling to think up a method to do this.
What I was thinking so far is as follows:
When ...
0
votes
0answers
76 views
Advanced Composition (Differential Privacy)
I have a problem understanding the proof of the corollary of Advanced Composition
Theorem Advanced Composition:
For all $\varepsilon,\delta,\delta' \geq 0$ the class of $(\varepsilon,\delta)$-...
1
vote
3answers
80 views
How to devise cryptographic system with data-sharing ability and password reset
I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question.
I am writing a C# .NET application. For my application the ...
3
votes
1answer
58 views
Lemma KL-Divergence (Differential Privacy)
I am studying differential privacy and I got stuck again in proof of a lemma. Which is:
$D_{\infty}^\delta(Y||Z) \leq \epsilon$ if and only if there exists a random variable $Y'$ such that $\Delta(Y,...
1
vote
0answers
45 views
Calculating the privacy that Renyi ($\epsilon, \delta$) Differential Privacy satisfies
I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: $\epsilon$ and $\delta $. I know that the $\epsilon$ tells us something about ...
2
votes
1answer
103 views
Differential Privacy: What is the 'game' between data holder and adversary?
I have been reading the Differential Privacy (DP) literature for some time to get familiar with it. I feel comfortable with the Math and Stats foundations of it, but I am suffering a bit from the '...
0
votes
1answer
164 views
Can you correct my understanding of Argon2? [closed]
I'm a bit new to the cryptography field (completely new), and could really use your guidance.
Please, correct my understanding, as defined by the following statements.
The ...
1
vote
0answers
26 views
Integrity for mixture of encrypted/unencrypted database fields
I have multiple blobs each (symmetrically) encrypted with its own randomly generated key.
Now I want to encrypt these blob keys with user keys and store them in a database.
A table could have the ...
0
votes
1answer
104 views
A multi-target attack on 128-bit ECDSA private keys
I'm thinking about doing this as a project, but I'm not sure how I'm supposed to proceed.
So I have an 128-bit ECDSA, which would provide about 128 bits of security (if we do not use special methods ...
0
votes
0answers
22 views
E2EE encrypted chat where messages are only readable by participants and admin users
As the title suggests, is there a way to have an E2EE chat between two users, and have them be visible later by an admin user.
I know this defeats the point of E2EE, but i want to have the messages ...
0
votes
0answers
66 views
Encrypting conversation messages stored in database (symmetric encryption)
I have a chatting application like Slack/Discord.
In this chat application there chat groups and messages sent by users need to be encrypted in the database.
I do not need features like E2E encryption,...
0
votes
1answer
108 views
Security of using constant salt when saving encrypted data to database
Let's say that I want to save some encrypted data to a database through a Spring Boot microservice. For that I will be using Spring Security Crypto that, as the documentation says it uses AES256 with ...
0
votes
0answers
15 views
Is the DBMS_CRYPT Oracle package used for the 'plug-in' method of DBMS encryption? Could anyone send links to more information on the method?
I was assigned a research project on the 'plug-in' method which is basically the concept of attaching an encryption package (encryption module) onto the DBMS. When typing in 'plug-in' method into ...
0
votes
0answers
40 views
Prevent everyone except customer to read DB data
We are planning an application that must store sensitive data.
Data is coming from other sources, the application will be a "collector" of third party data.
We need to encrypt database data so no one ...
0
votes
1answer
58 views
Is it possible to construct dataset for only another party to consult?
Is it possible to construct a dataset made of some kind of probabilistic encrypted indexes such that anyone can update the information contained in the set but only the one with a secret key could be ...
3
votes
2answers
1k views
End to end encrypted web chat app with stored messages in database
I am working on a web app with an integrated chat. All chats can only occur between two users - not more, not less.
I am very concerned with security, so I would like to encrypt all chat messages with ...
2
votes
0answers
32 views
Is it possible to encrypt a user’s email in a zero-knowledge way and still send them emails?
This is kind of hypothetical, but let’s say I have a web app and I want to store a user’s email for sending notifications to.
Is there any zero-knowledge way to hide their email from ourselves and ...
1
vote
1answer
113 views
Frequency Attacks on Encrypted Database
I'm trying to build an encrypted database where we can't trust on the database manager. And since encrypt data in a deterministic way is bad, attackers can recover information doing frequency attacks, ...
2
votes
2answers
224 views
Search Over Encrypted Data
I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted ...
2
votes
1answer
295 views
Is an IV useless for encrypting database IDs?
In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
1
vote
2answers
189 views
How secure is a system that retrieves encrypted private keys from a public database?
The system in question is one with multiple users. Each user has a password associated with their account, and each user owns several public-private keypairs. A user's private keys are encrypted using ...
2
votes
1answer
125 views
Encrypting the relationship between two database tables
I'm not a cryptography expert myself, and know enough to know that I shouldn't design my own crypto schemes, so I thought I'd seek advice here.
In an application, let's say we have two database ...
2
votes
0answers
113 views
P2P Website/Database Encryption Process
Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find ...
-1
votes
2answers
353 views
Encrypt login id in database
I am developing a solution where each user is identified with a social security number (SSN). So they log in with their SSN and a password.
I would like to encrypt the SSN somehow (client-side) ...
3
votes
1answer
1k views
Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?
Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue?
Practical example:
...
1
vote
1answer
97 views
how to efficiently prove the query result is empty?
Consider a simplified scenario.
Suppose an untrusted server holds a set of data $A=\{ a_1,a_2,\cdots,a_n\}$.
A client issues a query $b$ to the server and wants to decide if $b\in A$. The server ...
4
votes
2answers
2k views
Hash function used to find duplicate data, at what point is the risk of a chance match sufficient to switch to a stronger hash or bytewise verifying?
In a lot of data management systems, a hash is used as a kind of data fingerprint, with the intent not to cryptographically defeat an opponent, but to quickly identify duplicate data by seeing if ...
3
votes
1answer
783 views
Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)
I am trying to secure user's profile in database (data at rest). This user's profile is downloaded only after successful authentication at server (based on user's entered password and user name).
The ...
2
votes
2answers
242 views
Is the statement true in the context of AES-256 encrypted data stored on a hacked server?
I'm writing a document and I am making an important statement in it, which may be used for strategic decision regarding data-management (possibly from never handling sensitive information online to ...
2
votes
1answer
990 views
Database and End-to-End Encryption
I'm currently designing a mobile/desktop application to synchronize some messages or notes. I'm searching for a way to secure it and to avoid letting the server be able to read the messages.
My goal ...
2
votes
1answer
1k views
AES Key Generation based on database guid
I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since ...
9
votes
1answer
3k views
Encrypting user data with their password?
I had an idea once that all of the user data (including the username) could be encrypted with the user's password. Obviously, most sites would store different data, so using the same password and ...
2
votes
0answers
389 views
CryptDB data re-encryption and onion layers
From the CryptDB paper , I understoond that the onion layers once decrypted are not re-encrypted. Only columns which are queried infrequently will be re-encrypted to higher onion layers. But if we ...
1
vote
1answer
118 views
What are the possible security issues when exporting a plaintext database to a file like this?
Say I have plaintext database with key-value pairs of usernames and passwords. Then I iterate through the database, encrypt the passwords, and write the username and encrypted password pairs to file ...
1
vote
1answer
90 views
Secure way to hash a lookup value
I want to securely store a database table that consists of an account ID and a few columns of sensitive data. The data only has value if it can be associated with the account ID. My thinking is to ...
2
votes
1answer
427 views
What is the best current way to cryptographically secure databases?
I'm currently working on a proposal for some secure complete system and one of the things currently lacking is the database security.
However I don't want to roll my own crypto there and thereby need ...
0
votes
1answer
382 views
Backdoorable hash function in password database
I want to use a (preferably established) hash function that is backdoorable in a password database. I want to do so because I need password escrow (being able to get the cleartext back. I want to ...
5
votes
2answers
3k views
Public key crypto instead of hashing passwords in a database
Suppose I want to keep a client's password database secure (not in plaintext), while still having access to the plaintext password.
Now I generates a public/private keypair. Then I send the public ...
3
votes
1answer
300 views
Secure method of encrypting data within a database
I'm designing a program which makes queries to a database stored locally which could potentially contain a lot of sensitive information. As such the information must be kept secure as possible from ...
-1
votes
2answers
709 views
SQL-Like queries in CRYPTDB doesn't work [closed]
I have downloaded and built Cryptdb and it works well. Most of queries on encrypted database run without any issue but, the query with LIKE key word receives an ...
2
votes
1answer
103 views
Join Datasets While Protecting Anonymity
I've run into this issue a couple of times in my career. I'll see if I can explain with an example (please ignore the fact that this is implausible in the real-world).
Suppose I sell computers, and I ...
1
vote
1answer
2k views
Creating unique keys with md5
The project I'm working on requires me to find a way to create a unique key based on data stored in a table. The table in question consists of x columns and y rows.
In order to create the key I want ...
1
vote
1answer
204 views
How to store and use a Cryptographic Seed in a database [closed]
Companies such as Barclays use cryptographic seeds (for their PINsentry system), RSA do the same for RSA SecurID, but how do they safely secure the seeds in the database.
With passwords you just hash ...
2
votes
2answers
360 views
Is this a valid “fix” for deterministic encryption in encrypted databases?
It appears (after doing some light research) that for encrypted databases to be practical enough to be usable, deterministic encryption is required, specifically with regard to the type of encryption ...
0
votes
2answers
1k views
Database row level encryption scheme
I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
2
votes
0answers
217 views
Encrypted database: how to deal with general queries?
My question is quite related to the concept of homomorphic encryption, which is not practical at all nowadays.
In short, I would like to know how to query encrypted databases. Simple queries which ...
5
votes
3answers
750 views
Cryptographic data structure: sparse array without membership test
I would like a data structure supporting two operations: $\mathsf{set}(k,v)$ and $\mathsf{get}(k)$, with the following properties:
$k$ can be any number between $0$ and something impressively large, ...
1
vote
1answer
168 views
Privacy-Preserving relational databases: checking the existence of a record (or multiple records)
I would like to know if there exists a protocol which performs the following operation in a privacy-preserving fashion:
User $U$ wants to know whether a record is stored in the database. The primary ...
