Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [secure-storage]

Secure storage describes storing resources in a secure way, so that they are only available to authorized users and trusted networks.

0
votes
0answers
6 views

Reset ATECC508A to default? [migrated]

Is there a way to reset the atecc508a from Microchip Technology to default? The configuration zone was already locked. I would appreciate any help. Thank you very much.
0
votes
1answer
74 views

Storing passwords in a publicly available database

I have a public database where users need to store configuration files. The file can contain passwords. Everyone can read config files but only the server can read passwords in them. In the browser, ...
1
vote
1answer
189 views

How Secure is gpg Command Using Symmetric AES-256 From Being Cracked

How secure is any data encrypted using the following command: gpg -o *encrypted_output_file_name* --symmetric --cipher-algo AES256 *file_to_be_encrypted* ...
2
votes
1answer
57 views

Where does one store 3rd-party Public Keys

So, I've just started looking at the subject of Cryptography and am working through Stephen Haunt's Practical Cryptography course on PluralSight but have a question that doesn't appear to be covered. ...
0
votes
1answer
63 views

How do i manage encryption keys with a cloud provider?

I would like to provision services from a Software as a Service (SaaS) provider. This is multitenant environment (multiple companies will be using a single instance of the application, with a single ...
1
vote
0answers
63 views

Suggestion for proof of retrievability (via coding theory)

I want to build a fully open-source open-everything protocol/service for massively-distributed shared storage (P2P). I came up with a suggestion for a proof-of-retrievability scheme, but I would like ...
3
votes
1answer
175 views

aWallet Password Manager

After reading a lot of articles on ramping up the security of my web accounts, I started using aWallet Password Manager for Android to backup my passwords. I like ...
0
votes
0answers
34 views

Secure data storage in OWA

We are developing end-to-end encryption for email messages with OWA and JavaScript. We are using asymmetric encryption so we need to keep private key with OWA on the device of user (or elsewhere where ...
3
votes
1answer
70 views

What exactly are an untrusted memory and a trusted CPU?

In the use of SGX and Oblivious RAM. There sometimes exist the notions untrusted memory and trusted processor. What are the intuitions of those? Can memory easily be hacked by adversaries? What about ...
0
votes
1answer
33 views

Security of traditional ORAMs if write accesses are revealed

I was reading about path ORAM, and I have few questions I was wondering if an adversary knows all write accesses will be performed and has a view of the tree of which path being accessed. Can he ...
0
votes
3answers
136 views

Do storage encryption systems care about size of data?

I was studying about Psuedorandom functions and their use as encryption functions. One of the things that I read was "birthday bound" or "birthday attack". When encryption is used for something ...
1
vote
4answers
447 views

salt usage for hashed password storage - design consideration

This is part of my academic assignment and hence to ensure no one feels i'm asking for the answer. I've given my opinion. Hashing is mathematical one way function that takes arbitrary length data ...
0
votes
1answer
130 views

Storing private keys directly in a keyring

Storing an RSA 2048-bit key directly in a keyring seems to work fine, and is advantageous because the application can be removed, broken, reinstalled and the key still works. However, most apps seem ...
1
vote
0answers
34 views

Revocation of users in encrypted storage system?

How can you design an encrypted storage system, that allows adding and removing users without sharing a common secret and having to re-encrypt everything when a user is removed? My partial idea is: ...
7
votes
1answer
360 views

Is it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?

Assume an "encrypted data package" file format which includes the following data PBKDF2 algorithm salt rounds keylen AES algorithm & mode IV ciphertext where the PBKDF2 salt and AES IV are ...
4
votes
1answer
101 views

Proof of Disclosure? Is there such a thing?

Let's say I have a document. I want to give you a copy, and then I want to prove that I gave you a copy. Ie, I want some kind of digitally signed receipt from you. If you're dishonest, you may receive ...
0
votes
1answer
203 views

Is this is a secure use of AES-CTR?

Here is a hypothetical application of AES-CTR encryption. Encryption: Step 1: Generate random key and IV for new object; Step 2: Use said key and iv to encrypt some data, which is then stored on a ...
-4
votes
1answer
564 views

Would Hashing A Password In Sha512 Using JavaScript Be Secure?

I've created a competition for a few friends of mine that wanted to learn the basics of penetration testing. In said competition, there is one section in which there's a log file you need to check out ...
1
vote
1answer
282 views

How can I ensure forward secrecy when storing encrypted messages in a public blockchain?

I want to store encrypted sensitive messages in the blockchain. I was thinking of using public-key cryptography to achieve this, but as the encrypted data will be stored forever in the blockchain and ...
2
votes
1answer
140 views

Writing encrypted data in place

Is there a good reason not to write encrypted data in-place? From the iOS 10 Security Guide:
0
votes
1answer
48 views

How to save the data in a non-trustworthy db, so the next time I read from the db, I know that I've read actual and not an old version of the data?

Assume I encrypt a message, A1, and save it. Later I replace the message A1 with a new message, A2. I do not trust the message storage. Now I want to read the last message. How can I verify that I've ...
3
votes
3answers
1k views

Where to store sensitive keys in a device?

I am working on some security features that should be executed by the firmware of a consumer device whose communication to a server must be secure. Any exchange of data is based on symmetric ...
0
votes
2answers
506 views

Best approach for storing private key

I'm working on a web service application which uses a self signed certificate. I apologize up front if this turns to be a dumb question. When using openssl for generating private key, it reveals (as ...
-1
votes
2answers
67 views

Is there some encryption scheme which is getting increase “noise” and then can't be indecipherable at last?

There's some function f() which has some "error", so "error" grows when decryption is failed every time and then finally it won't be able to decrypt. But, the "error" will be initialized when its ...
0
votes
1answer
109 views

Password-Managers: what is the IND-CDBA attack logic?

In the work of Paolo Gasti and Kasper B. Rasmussen On The Security of Password Manager Database Formats, they describe two attack forms: IND-CDBA and MAL-CDBA. While I understand the MAL-CDBA attack ...
1
vote
0answers
104 views

RSA Cryptosystem

This question is regarding the RSA cryptosystem. Alice gives Bob her public key, $N$ and $e$, on a USB flash drive. Unfortunately, Bob loses the flash drive on the train. Question 1: Does ...
3
votes
4answers
883 views

Where should I store the private key (RSA) in a web application?

My web application receives encrypted data from another server encrypted with RSA keys. Where should I store the private key (RSA) in a .NET web application (Windows)? It seems that putting in it in ...
1
vote
1answer
70 views

Warding an ECIES setup against MitM: ECDSA?

Is it necessary/appropriate to digitally sign an ETM file in an ECIES context? The encryption mode is CTR(using Inferno). The current output is: [shared public key] [ciphertext] [MAC]. The encrypted ...
1
vote
3answers
221 views

Secondary hash function utility, regarding data destruction?

Given that hash functions are inherently irreversible, would they not then be useful in applications where it's desired to overwrite sensitive data? (i.e. Darik’s Boot and Nuke) Specifically, why ...
4
votes
1answer
76 views

Can big numbers multiplication be a valid form of encryption?

I have a vector of int called $Xreg = [x1, x2, ..., xn]$ that I need to send from a client to a server for storage in a database. If an attacker gains access to the database or the server he shouldn'...
3
votes
2answers
166 views

General idea for storing public/private keys?

What are the general ideas for storing keys in order to make sure no one else has access to it? It's not a good approach to hash the keys, since you are going to need them later.
3
votes
2answers
823 views

What do we need white box crypto for?

I am familiar with white box cryptography, but somehow I still fail to see its potential applications? Which situations would necessitate using it? Maybe you can even give me an example or two? I ...
1
vote
2answers
652 views

security of using digital signature as key derivation material

I want all keys in my iOS application to rely on the Secure Enclave for security as the iOS keychain becomes insecure on jailbroken devices. Currently, the Secure Enclave currently only supports ...
6
votes
1answer
1k views

Encrypted firmware

I have seen many papers on "encrypted firmware" (for example, firmware on Apple Watch like devices) . Can you tell me how it works? Is there a stub in the firmware which is not encrypted and can ...
15
votes
3answers
13k views

Where and how to store private keys in web applications for private messaging with web browsers

I am working on a web application enabling users to communicate over private messages which is just one part of the whole system. The main focus during my development process is to protect the privacy ...
3
votes
1answer
76 views

About ORAM initalization and running out of space

I have two questions about ORAM Since at the beginning,the server allocates unused storage for ORAM cient,there are no user's data in the storage.if now client access the storage the server will know ...
2
votes
0answers
304 views

CryptDB data re-encryption and onion layers

From the CryptDB paper , I understoond that the onion layers once decrypted are not re-encrypted. Only columns which are queried infrequently will be re-encrypted to higher onion layers. But if we ...
1
vote
1answer
70 views

Secure way to hash a lookup value

I want to securely store a database table that consists of an account ID and a few columns of sensitive data. The data only has value if it can be associated with the account ID. My thinking is to ...
0
votes
1answer
145 views

XTS-AES key management

XTS-AES uses two keys $(k_1, k_2)$, which are obtained from a concatenated key $k$. Does this key $k$ remain same for the whole disk or changes per sector?
1
vote
1answer
125 views

Properly storing an E-mail Password

I'm creating a messaging application that will use an outlook account to send an email. However, I'm unsure about the proper steps to store the e-mail password on the user's computer. Suppose I had ...
5
votes
1answer
635 views

Is EncFS good for online storage services?

Conclusion from an EncFS audit: EncFS is probably safe as long as the adversary only gets one copy of the ciphertext and nothing more. EncFS is not safe if the adversary has the opportunity ...
2
votes
0answers
44 views

Is there a system where I can securely store a secret value and compare a semi-ambiguous input to it?

I have an idea for a new kind of mobile phone lock screen. When you first create your pattern, you put together a series of colors and compass directions from the following choices: Red, Blue, Yellow, ...
1
vote
0answers
24 views

Is there any equivalent to the apache xml security library for JSON? [closed]

I'm talking about org.apache.xml.security(santurio) Is there any equivalent library that works with JSON and provides the same set of features? (mostly AES-128 with KEK support)
1
vote
1answer
102 views

Encryption algorithms larger than 256 Bit for “big data” encryption?

I'm somewhat new to encryption. When looking at encryption programs for big data, I frequently see a maximum of 256 bits. Why do we generally restrict our (symmetric) keys to 256 bits? Can more ...
3
votes
1answer
96 views

Optimal bandwidth cost for Oblivious RAM

Goldreich and Ostrovsky show that any ORAM algorithm must have bandwidth cost $\Omega(logN)$, where $N$ is the total number of blocks outsourced. This is in Theorem C of this paper. But they didn't ...
2
votes
2answers
409 views

Attribute-based encryption for cloud storage

I'm trying to understand attribute-based encryption schemes. Almost all articles describe that they are designed for cloud storage, but as I understand, almost all computing (encryption & ...
1
vote
0answers
81 views

What is a proof of data possession that accounts for fake mirrors?

Alice pays Bob $5/month to host a gigantic file for her. She wants to occasionally verify that Bob is actually hosting the file. To do this, she selects random blocks from the file, and challenges ...
4
votes
0answers
327 views

Storing password or derived key in keychain?

Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 ...
6
votes
3answers
1k views

Can passwords be stored securely so that a similarity comparison can be made?

On the Pro Webmasters StackExchange site, someone asked a question about a webapp (in this case cPanel) that refused to allow a password change because it was too similar to a previous password. I ...
11
votes
2answers
1k views

Does there exist a proof-of-retrievability scheme that is publicly-verifiable, limited-use, and does not use homomorphic encryption?

I find myself wanting to test out a practical implementation of a proof-of-retrievability scheme, simply out of curiosity. These schemes seem to be divided into two variations, publicly-verified and ...