Skip to main content

Questions tagged [secure-storage]

Secure storage describes storing resources in a secure way, so that they are only available to authorized users and trusted networks.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Flaws in modern file encryption

Assuming AES-XTS is used for encryption, the data has to be put into the algorithm first and probably processed in RAM. Which means that the unencrypted plaintext is somewhere in the dynamic memory. ...
moju22's user avatar
  • 33
1 vote
3 answers
138 views

Erasing data from a server/ssd

Imagine the following use case: I have confidential data saved on storage and want to delete it so I can forward the storage to another person, who will probably try everything the market offers to ...
moju22's user avatar
  • 33
1 vote
1 answer
52 views

Effects of and prevention of leaking a private key in an public key encryption scheme

Suppose we have a public key encryption scheme and the private key of the client is stored locally as to never leave the client. But this makes me wonder what would happen when the device of the ...
H-a-y-K's user avatar
  • 125
2 votes
1 answer
180 views

Password Manager Architecture and Design

I'm working on a local, client-side password manager. I want to hash a master password with argon2 to store it safely in an SQLite database. This will be how a user could login and be authenticated. (...
dvub's user avatar
  • 123
0 votes
1 answer
100 views

Shamir Secret Sharing for API Authentication

I want to implement authentication for an API and thought about using Shamir Secret Sharing to do so. My plan is to generate 1 Master Key which is stored in the Database, we then generate about 1000 ...
Michael's user avatar
2 votes
1 answer
109 views

Would encrypting several layers of a filesystem be a waste?

I've been thinking about ways to improve the security of my data stored and backed up using the "3-2-1" method. Moreover by using several layers of encryption to encrypt and decrypt a ...
Xcrowzz's user avatar
  • 21
2 votes
1 answer
344 views

Best practices on implementing a password manager

I'm a dev new to security and cryptography. I'm writing a password manager and Time-based OTP combo in dart/flutter to use in multiple devices and platform for fun and use it personally for real. I ...
anthonychwong's user avatar
2 votes
1 answer
49 views

Is hashing salt possible even with the password with salt appended to the end?

Should you hash the salt on its own ? Is that possible? for example being password with salt appended at the end hash(pass || salt) and hash(salt) in a password file?
Bus's user avatar
  • 21
1 vote
2 answers
294 views

Secure storage of encryption key in offline device

I'm developing a device where I need to store a symmetric key that the customer uploads to the device. The device is offline at all times, so centralized storage in HSM is not an option. The device ...
BenjaminK's user avatar
1 vote
0 answers
211 views

How web browsers and WebCrypto API protects secrets

I tried to search and take a look at a way to securely generate or import secret keys on client-side. First I tried to see if it is possible to take advantage of TPM in Windows but as far as I ...
John's user avatar
  • 43
1 vote
1 answer
57 views

How to securely store data with an untrustworthy party?

Alice wants to store key:value pairs with Bob. The goal of the exercise is for Alice to be able to use Bob as a reliable data storage service, even if Bob were ...
user97568's user avatar
0 votes
2 answers
560 views

Generation of RSA key pair and storage of only private key PKCS#11

I noticed that the PKCS#11 supports C_GenerateKey function for symmetric keys and for asymmetric there's only C_GenerateKeyPair ...
simonskof's user avatar
1 vote
0 answers
559 views

Key rotation and versioning for encryption at rest

I'm working with a dev team who are implementing encryption at rest at the application level. It's for particularly sensitive fields inside an RDB. (The underlying DB storage has an additional layer ...
meeque's user avatar
  • 11
4 votes
1 answer
1k views

XSalsa20Poly1305 for encryption at rest

I just found a project that used XSalsa20Poly1305 for transit and encryption at rest. I am trying to find some information if that is something worth trusting data to. It feels a little hard to put ...
tcurdt's user avatar
  • 143
3 votes
1 answer
224 views

Key Encryption: Does it need to be Authenticated?

Alice wants to store files $m_i$ on Bob's untrusted cloud storage platform, with the additional restriction that she can only store one master key $k$ herself. She encrypts the files with keys $k_i$ ...
Arya Pourtabatabaie's user avatar
3 votes
1 answer
109 views

Hide the presence of a key in a key-value storage

Problem: I want to build a key-value storage in such a way that it would be impossible to detect a presence of a key in the storage by inspecting it. In other words, any read operation with any valid ...
dvitas's user avatar
  • 33
4 votes
2 answers
1k views

Side-Channel Attacks in the Cloud

Let's say we have some very sensitive personal files. At all costs, we do not want any other pair of eyeballs to gaze upon them. We need these sensitive files to be secure and available. So, we have ...
Patriot's user avatar
  • 3,132
3 votes
3 answers
134 views

What is the purpose of implementing cryptographic algorithms in a token?

In particular, in PKCS #11. Not a lot of information on the web; I found this explanations. Ignoring the empty marketing talk like “heightened security” and “centralized and secure management”, I ...
beroal's user avatar
  • 291
1 vote
1 answer
1k views

Encryption algorithm with shortest ciphertext for long strings

EDIT: My original problem was that if I have to encrypt large amounts of data, AES would expand the data even more, but this is not the case. This question states that AES does not expand data at all. ...
luek baja's user avatar
  • 113
1 vote
1 answer
99 views

Self-correcting encryption. What are the essential elements?

Optical discs are prone to damage, and for this reason, they usually store data encoded with an error correcting code. While day-to-day use for optical storage media has diminished in recent years, ...
DannyNiu's user avatar
  • 9,451
2 votes
0 answers
79 views

Merkle tree-based PoR

As you may already know, proofs of retrievability (PoR) can be constructed using MACs, Signatures (as stated here) or Merkle tree (like this). The PoRs that are based on MACs or signatures usually use ...
Aydin's user avatar
  • 442
1 vote
1 answer
471 views

Long term storage of encrypted data

Say that I have 16-32 GB of data, and I want to devise a system for storing this data in an encrypted form. This system needs to meet two core objectives: The data needs to remain as pristine as ...
chancellorofpaphos's user avatar
0 votes
0 answers
32 views

Are there any known problems performing a One-time pad with 2 keys stored separately - AKA 2 part Symmetric key exchange over TLS

If this is something that already has a name, please tell me to look at that, but I have not been able to find one yet. I am considering this process for storing some data securely. I want to ...
Matthew Carlson's user avatar
0 votes
0 answers
104 views

Packing technique for large data storage

Packing multiple plaintext messages into a single ciphertext block is known to increase the effeciency of homomorphic encryption. Can someone let me know if this technique can support large data ? For ...
sof's user avatar
  • 61
1 vote
1 answer
140 views

Secretless authentication method for remote hardware

We're working with a microcontroller that is not secure enough to store secrets. The ROM could be dumped in a properly equiped lab. This is why we considered integrating a certified Secure Element ...
Elbattore's user avatar
1 vote
3 answers
1k views

How HSM stores keys securely

when we say that HSM stores keys securely we mean that non-authoriszed requester cannot access the keys. but the key is stored physically anyway in the hardware, so access is still possible if the ...
Lkaf Temravet's user avatar
3 votes
2 answers
275 views

Homomorphic Modular Reduction for Secure Storage

My question is quite similar to Homomorphic modulo, but I want to give a context where the operation is carried in an outsourced environment. Are there any specific homomorphic cryptographic schemes ...
Jeremy' Chu's user avatar
3 votes
1 answer
498 views

Use a hash-function twice

I'm creating a small messenger and I wanted to know if it makes sense to store user passwords double-hashed in our backend-database. I wanted the user the register in an app, which should save a hash ...
Lorenz's user avatar
  • 31
3 votes
1 answer
100 views

I don't want to store passwords, can I use them as an encryption key for another field?

I'm not a 'cryptographic' anything, so if this is a super-dumb question please let me know (politely). So here's the deal, say I don't want to store passwords because that opens me up to all sorts of ...
Der Kommissar's user avatar
0 votes
1 answer
409 views

Storing passwords in a publicly available database

I have a public database where users need to store configuration files. The file can contain passwords. Everyone can read config files but only the server can read passwords in them. In the browser, ...
user3803241's user avatar
7 votes
1 answer
16k views

How Secure is gpg Command Using Symmetric AES-256 From Being Cracked

How secure is any data encrypted using the following command: gpg -o *encrypted_output_file_name* --symmetric --cipher-algo AES256 *file_to_be_encrypted* Can ...
Arjun's user avatar
  • 171
2 votes
1 answer
335 views

Where does one store 3rd-party Public Keys

So, I've just started looking at the subject of Cryptography and am working through Stephen Haunt's Practical Cryptography course on PluralSight but have a question that doesn't appear to be covered. ...
Stuart Hemming's user avatar
0 votes
1 answer
117 views

How do i manage encryption keys with a cloud provider?

I would like to provision services from a Software as a Service (SaaS) provider. This is multitenant environment (multiple companies will be using a single instance of the application, with a single ...
Architect 's user avatar
1 vote
0 answers
97 views

Suggestion for proof of retrievability (via coding theory)

I want to build a fully open-source open-everything protocol/service for massively-distributed shared storage (P2P). I came up with a suggestion for a proof-of-retrievability scheme, but I would like ...
Carl Löndahl's user avatar
3 votes
1 answer
401 views

aWallet Password Manager

After reading a lot of articles on ramping up the security of my web accounts, I started using aWallet Password Manager for Android to backup my passwords. I like ...
y2k-shubham's user avatar
3 votes
1 answer
223 views

What exactly are an untrusted memory and a trusted CPU?

In the use of SGX and Oblivious RAM. There sometimes exist the notions untrusted memory and trusted processor. What are the intuitions of those? Can memory easily be hacked by adversaries? What about ...
mallea's user avatar
  • 1,635
0 votes
1 answer
42 views

Security of traditional ORAMs if write accesses are revealed

I was reading about path ORAM, and I have few questions I was wondering if an adversary knows all write accesses will be performed and has a view of the tree of which path being accessed. Can he ...
DiamondDuck's user avatar
1 vote
3 answers
241 views

Do storage encryption systems care about size of data?

I was studying about Psuedorandom functions and their use as encryption functions. One of the things that I read was "birthday bound" or "birthday attack". When encryption is used for something ...
Limit's user avatar
  • 417
1 vote
4 answers
713 views

salt usage for hashed password storage - design consideration

This is part of my academic assignment and hence to ensure no one feels i'm asking for the answer. I've given my opinion. Hashing is mathematical one way function that takes arbitrary length data ...
Parth Maniar's user avatar
0 votes
1 answer
515 views

Storing private keys directly in a keyring

Storing an RSA 2048-bit key directly in a keyring seems to work fine, and is advantageous because the application can be removed, broken, reinstalled and the key still works. However, most apps seem ...
Erik Aronesty's user avatar
1 vote
0 answers
64 views

Revocation of users in encrypted storage system?

How can you design an encrypted storage system, that allows adding and removing users without sharing a common secret and having to re-encrypt everything when a user is removed? My partial idea is: ...
Marc's user avatar
  • 111
7 votes
1 answer
745 views

Is it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?

Assume an "encrypted data package" file format which includes the following data PBKDF2 algorithm salt rounds keylen AES algorithm & mode IV ciphertext where the PBKDF2 salt and AES ...
e-sushi's user avatar
  • 18k
4 votes
1 answer
148 views

Proof of Disclosure? Is there such a thing?

Let's say I have a document. I want to give you a copy, and then I want to prove that I gave you a copy. Ie, I want some kind of digitally signed receipt from you. If you're dishonest, you may receive ...
jyelon's user avatar
  • 106
0 votes
1 answer
381 views

Is this is a secure use of AES-CTR?

Here is a hypothetical application of AES-CTR encryption. Encryption: Step 1: Generate random key and IV for new object; Step 2: Use said key and iv to encrypt some data, which is then stored on a ...
Locust5304's user avatar
-2 votes
1 answer
1k views

Would Hashing A Password In Sha512 Using JavaScript Be Secure?

I've created a competition for a few friends of mine that wanted to learn the basics of penetration testing. In said competition, there is one section in which there's a log file you need to check out ...
The Gamer King's user avatar
2 votes
1 answer
543 views

How can I ensure forward secrecy when storing encrypted messages in a public blockchain?

I want to store encrypted sensitive messages in the blockchain. I was thinking of using public-key cryptography to achieve this, but as the encrypted data will be stored forever in the blockchain and ...
Brendan Rius's user avatar
2 votes
1 answer
229 views

Writing encrypted data in place

Is there a good reason not to write encrypted data in-place? From the iOS 10 Security Guide:
Elist's user avatar
  • 123
0 votes
1 answer
56 views

How to save the data in a non-trustworthy db, so the next time I read from the db, I know that I've read actual and not an old version of the data?

Assume I encrypt a message, A1, and save it. Later I replace the message A1 with a new message, A2. I do not trust the message storage. Now I want to read the last message. How can I verify that I've ...
vzdor's user avatar
  • 11
6 votes
3 answers
3k views

Where to store sensitive keys in a device?

I am working on some security features that should be executed by the firmware of a consumer device whose communication to a server must be secure. Any exchange of data is based on symmetric ...
MichaelW's user avatar
  • 1,497
1 vote
2 answers
963 views

Best approach for storing private key

I'm working on a web service application which uses a self signed certificate. I apologize up front if this turns to be a dumb question. When using openssl for generating private key, it reveals (as ...
akhilbaai's user avatar