Questions tagged [secure-storage]
Secure storage describes storing resources in a secure way, so that they are only available to authorized users and trusted networks.
79
questions
0
votes
0
answers
26
views
A serious security issue in remote data storage
In order to ensure the integrity of remote data, Ateniese et al. first proposed the idea of provable data possession (PDP). In this proof, the data are computed as elements on a G-group in the form of ...
- 1
1
vote
2
answers
162
views
Flaws in modern file encryption
Assuming AES-XTS is used for encryption, the data has to be put into the algorithm first and probably processed in RAM. Which means that the unencrypted plaintext is somewhere in the dynamic memory. ...
- 43
1
vote
3
answers
165
views
Erasing data from a server/ssd
Imagine the following use case: I have confidential data saved on storage and want to delete it so I can forward the storage to another person, who will probably try everything the market offers to ...
- 43
1
vote
1
answer
86
views
Effects of and prevention of leaking a private key in an public key encryption scheme
Suppose we have a public key encryption scheme and the private key of the client is stored locally as to never leave the client. But this makes me wonder what would happen when the device of the ...
- 125
2
votes
1
answer
191
views
Password Manager Architecture and Design
I'm working on a local, client-side password manager. I want to hash a master password with argon2 to store it safely in an SQLite database. This will be how a user could login and be authenticated. (...
- 123
0
votes
1
answer
119
views
Shamir Secret Sharing for API Authentication
I want to implement authentication for an API and thought about using Shamir Secret Sharing to do so.
My plan is to generate 1 Master Key which is stored in the Database, we then generate about 1000 ...
- 1
2
votes
1
answer
141
views
Would encrypting several layers of a filesystem be a waste?
I've been thinking about ways to improve the security of my data stored and backed up using the "3-2-1" method.
Moreover by using several layers of encryption to encrypt and decrypt a ...
- 21
2
votes
1
answer
408
views
Best practices on implementing a password manager
I'm a dev new to security and cryptography.
I'm writing a password manager and Time-based OTP combo in dart/flutter to use in multiple devices and platform for fun and use it personally for real. I ...
2
votes
1
answer
49
views
Is hashing salt possible even with the password with salt appended to the end?
Should you hash the salt on its own ? Is that possible?
for example being password with salt appended at the end hash(pass || salt) and hash(salt) in a password file?
- 21
1
vote
2
answers
338
views
Secure storage of encryption key in offline device
I'm developing a device where I need to store a symmetric key that the customer uploads to the device.
The device is offline at all times, so centralized storage in HSM is not an option.
The device ...
- 11
1
vote
0
answers
229
views
How web browsers and WebCrypto API protects secrets
I tried to search and take a look at a way to securely generate or import secret keys on client-side. First I tried to see if it is possible to take advantage of TPM in Windows but as far as I ...
- 43
1
vote
1
answer
57
views
How to securely store data with an untrustworthy party?
Alice wants to store key:value pairs with Bob.
The goal of the exercise is for Alice to be able to use Bob as a reliable data storage service, even if Bob were ...
- 11
0
votes
2
answers
612
views
Generation of RSA key pair and storage of only private key PKCS#11
I noticed that the PKCS#11 supports C_GenerateKey function for symmetric keys and for asymmetric there's only C_GenerateKeyPair ...
1
vote
0
answers
635
views
Key rotation and versioning for encryption at rest
I'm working with a dev team who are implementing encryption at rest at the application level. It's for particularly sensitive fields inside an RDB. (The underlying DB storage has an additional layer ...
- 11
4
votes
1
answer
2k
views
XSalsa20Poly1305 for encryption at rest
I just found a project that used XSalsa20Poly1305 for transit and encryption at rest. I am trying to find some information if that is something worth trusting data to.
It feels a little hard to put ...
- 143
3
votes
1
answer
252
views
Key Encryption: Does it need to be Authenticated?
Alice wants to store files $m_i$ on Bob's untrusted cloud storage platform, with the additional restriction that she can only store one master key $k$ herself.
She encrypts the files with keys $k_i$ ...
3
votes
1
answer
113
views
Hide the presence of a key in a key-value storage
Problem: I want to build a key-value storage in such a way that it would be impossible to detect a presence of a key in the storage by inspecting it. In other words, any read operation with any valid ...
- 33
4
votes
2
answers
1k
views
Side-Channel Attacks in the Cloud
Let's say we have some very sensitive personal files. At all costs, we do not want any other pair of eyeballs to gaze upon them. We need these sensitive files to be secure and available.
So, we have ...
- 3,142
3
votes
3
answers
134
views
What is the purpose of implementing cryptographic algorithms in a token?
In particular, in PKCS #11. Not a lot of information on the web; I found this explanations. Ignoring the empty marketing talk like “heightened security” and “centralized and secure management”, I ...
- 291
1
vote
1
answer
1k
views
Encryption algorithm with shortest ciphertext for long strings
EDIT:
My original problem was that if I have to encrypt large amounts of data, AES would expand the data even more, but this is not the case. This question states that AES does not expand data at all.
...
- 113
1
vote
1
answer
101
views
Self-correcting encryption. What are the essential elements?
Optical discs are prone to damage, and for this reason, they usually store data encoded with an error correcting code.
While day-to-day use for optical storage media has diminished in recent years, ...
- 9,682
2
votes
0
answers
79
views
Merkle tree-based PoR
As you may already know, proofs of retrievability (PoR) can be constructed using MACs, Signatures (as stated here) or Merkle tree (like this).
The PoRs that are based on MACs or signatures usually use ...
- 452
1
vote
1
answer
489
views
Long term storage of encrypted data
Say that I have 16-32 GB of data, and I want to devise a system for storing this data in an encrypted form. This system needs to meet two core objectives:
The data needs to remain as pristine as ...
0
votes
0
answers
32
views
Are there any known problems performing a One-time pad with 2 keys stored separately - AKA 2 part Symmetric key exchange over TLS
If this is something that already has a name, please tell me to look at that, but I have not been able to find one yet.
I am considering this process for storing some data securely. I want to ...
- 101
0
votes
0
answers
107
views
Packing technique for large data storage
Packing multiple plaintext messages into a single ciphertext block is known to increase the effeciency of homomorphic encryption. Can someone let me know if this technique can support large data ? For ...
- 61
1
vote
1
answer
142
views
Secretless authentication method for remote hardware
We're working with a microcontroller that is not secure enough to store secrets. The ROM could be dumped in a properly equiped lab.
This is why we considered integrating a certified Secure Element ...
- 58
2
votes
3
answers
1k
views
How HSM stores keys securely
when we say that HSM stores keys securely we mean that non-authoriszed requester cannot access the keys.
but the key is stored physically anyway in the hardware, so access is still possible
if the ...
- 159
3
votes
2
answers
279
views
Homomorphic Modular Reduction for Secure Storage
My question is quite similar to Homomorphic modulo, but I want to give a context where the operation is carried in an outsourced environment.
Are there any specific homomorphic cryptographic schemes ...
- 31
3
votes
1
answer
520
views
Use a hash-function twice
I'm creating a small messenger and I wanted to know if it makes sense to store user passwords double-hashed in our backend-database. I wanted the user the register in an app, which should save a hash ...
- 31
3
votes
1
answer
102
views
I don't want to store passwords, can I use them as an encryption key for another field?
I'm not a 'cryptographic' anything, so if this is a super-dumb question please let me know (politely).
So here's the deal, say I don't want to store passwords because that opens me up to all sorts of ...
- 131
0
votes
1
answer
413
views
Storing passwords in a publicly available database
I have a public database where users need to store configuration files. The file can contain passwords. Everyone can read config files but only the server can read passwords in them.
In the browser, ...
7
votes
1
answer
17k
views
How Secure is gpg Command Using Symmetric AES-256 From Being Cracked
How secure is any data encrypted using the following command:
gpg -o *encrypted_output_file_name* --symmetric --cipher-algo AES256 *file_to_be_encrypted*
Can ...
- 171
2
votes
1
answer
364
views
Where does one store 3rd-party Public Keys
So, I've just started looking at the subject of Cryptography and am working through Stephen Haunt's Practical Cryptography course on PluralSight but have a question that doesn't appear to be covered.
...
- 121
0
votes
1
answer
117
views
How do i manage encryption keys with a cloud provider?
I would like to provision services from a Software as a Service (SaaS) provider. This is multitenant environment (multiple companies will be using a single instance of the application, with a single ...
- 109
1
vote
0
answers
97
views
Suggestion for proof of retrievability (via coding theory)
I want to build a fully open-source open-everything protocol/service for massively-distributed shared storage (P2P). I came up with a suggestion for a proof-of-retrievability scheme, but I would like ...
- 321
3
votes
1
answer
410
views
aWallet Password Manager
After reading a lot of articles on ramping up the security of my web accounts, I started using aWallet Password Manager for Android to backup my passwords. I like ...
- 133
3
votes
1
answer
225
views
What exactly are an untrusted memory and a trusted CPU?
In the use of SGX and Oblivious RAM. There sometimes exist the notions untrusted memory and trusted processor.
What are the intuitions of those?
Can memory easily be hacked by adversaries? What about ...
- 1,675
0
votes
1
answer
42
views
Security of traditional ORAMs if write accesses are revealed
I was reading about path ORAM, and I have few questions
I was wondering if an adversary knows all write accesses will be performed and has a view of the tree of which path being accessed. Can he ...
- 403
1
vote
3
answers
250
views
Do storage encryption systems care about size of data?
I was studying about Psuedorandom functions and their use as encryption functions. One of the things that I read was "birthday bound" or "birthday attack".
When encryption is used for something ...
- 417
1
vote
4
answers
716
views
salt usage for hashed password storage - design consideration
This is part of my academic assignment and hence to ensure no one feels i'm asking for the answer. I've given my opinion.
Hashing is mathematical one way function that takes arbitrary length data ...
- 111
0
votes
1
answer
528
views
Storing private keys directly in a keyring
Storing an RSA 2048-bit key directly in a keyring seems to work fine, and is advantageous because the application can be removed, broken, reinstalled and the key still works.
However, most apps seem ...
- 450
1
vote
0
answers
65
views
Revocation of users in encrypted storage system?
How can you design an encrypted storage system, that allows adding and removing users without sharing a common secret and having to re-encrypt everything when a user is removed?
My partial idea is:
...
- 111
7
votes
1
answer
746
views
Is it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?
Assume an "encrypted data package" file format which includes the following data
PBKDF2
algorithm
salt
rounds
keylen
AES
algorithm & mode
IV
ciphertext
where the PBKDF2 salt and AES ...
- 18k
4
votes
1
answer
149
views
Proof of Disclosure? Is there such a thing?
Let's say I have a document. I want to give you a copy, and then I want to prove that I gave you a copy. Ie, I want some kind of digitally signed receipt from you. If you're dishonest, you may receive ...
- 106
0
votes
1
answer
383
views
Is this is a secure use of AES-CTR?
Here is a hypothetical application of AES-CTR encryption.
Encryption:
Step 1: Generate random key and IV for new object;
Step 2: Use said key and iv to encrypt some data, which is then
stored on a ...
- 103
-2
votes
1
answer
1k
views
Would Hashing A Password In Sha512 Using JavaScript Be Secure?
I've created a competition for a few friends of mine that wanted to learn the basics of penetration testing. In said competition, there is one section in which there's a log file you need to check out ...
2
votes
1
answer
545
views
How can I ensure forward secrecy when storing encrypted messages in a public blockchain?
I want to store encrypted sensitive messages in the blockchain.
I was thinking of using public-key cryptography to achieve this, but as the encrypted data will be stored forever in the blockchain and ...
- 123
2
votes
1
answer
229
views
Writing encrypted data in place
Is there a good reason not to write encrypted data in-place?
From the iOS 10 Security Guide:
- 123
0
votes
1
answer
56
views
How to save the data in a non-trustworthy db, so the next time I read from the db, I know that I've read actual and not an old version of the data?
Assume I encrypt a message, A1, and save it. Later I replace the message A1 with a new message, A2. I do not trust the message storage.
Now I want to read the last message. How can I verify that I've ...
- 11
6
votes
3
answers
3k
views
Where to store sensitive keys in a device?
I am working on some security features that should be executed by the firmware of a consumer device whose communication to a server must be secure.
Any exchange of data is based on symmetric ...
- 1,507