Skip to main content
17 votes
Accepted

Encrypting user data with their password?

There are a number of considerations here, I'll try to lay them out one at a time for ease of following: What must the site do with the data? Oftentimes, we ask web sites to do things on our behalf ...
HedgeMage's user avatar
  • 285
8 votes
Accepted

Risks of Using SHA1 Instead of SHA256 for RSA with OAEP Padding

You can use SHA-1 or MD5 for OAEP. It won't expose you to any attack. OAEP uses the hash functions for two things: to hash the label, and as part of the mask generation function, which, in practice, ...
Gilles 'SO- stop being evil''s user avatar
6 votes
Accepted

Is an IV useless for encrypting database IDs?

The mode of operation does not just matter; it defines the properties of the IV! The mode of operation is the part that specifies the size of the IV, the contents of the IV as well as the impact of ...
Maarten Bodewes's user avatar
  • 93.2k
6 votes
Accepted

Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)

My question is where (along with encrypted data? somewhere else?) [...] should I store the MAC in database? In theory you can store the MAC wherever you want, as long as you store it and get the ...
SEJPM's user avatar
  • 46.1k
4 votes
Accepted

What are the possible security issues when exporting a plaintext database to a file like this?

I'll start with the usual reminder: Please don't roll your own crypto, chances are you're getting it wrong. For password databases, KDBX (KeePass' format) usually is a good example which you strongly ...
SEJPM's user avatar
  • 46.1k
4 votes

Encrypt login id in database

I want to say don't use SSNs like usernames for practical and ethical reasons. Yet I hope that if you switch to normal username/passwords you won't remove the (weak) password protection on encrypted ...
Future Security's user avatar
4 votes
Accepted

Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?

Furthermore, is using AES-CBC this way any safer than using AES-ECB? Yes, using CBC mode is (almost?) always safer than using ECB mode. Is using zero IVs with AES-CBC safe[...]? No it is not safe, ...
SEJPM's user avatar
  • 46.1k
3 votes
Accepted

Lemma KL-Divergence (Differential Privacy)

I don't understand why: $$\sum_{y\in T}(\Pr[Z=y]-\Pr[Y=y]) = \sum _{y \notin T}(\Pr[Y=y]-\Pr[Z=y])$$ Well the domain is partitioned into $T$ and its complement. So the sum over the full domain of the ...
kodlu's user avatar
  • 22.7k
3 votes

A multi-target attack on 128-bit ECDSA private keys

One $n$-bit ECDSA private key can be found from the public key with about $2^{n/2+1}$ group operations, by Pollard's rho, which is relatively easily distributed. Nothing more costly is worth ...
fgrieu's user avatar
  • 141k
3 votes
Accepted

Hash function used to find duplicate data, at what point is the risk of a chance match sufficient to switch to a stronger hash or bytewise verifying?

The hypothesis it's assumed data items are completely random in their hash values for all practical purposes is unrealistic (it is very easy to build data items which hash values are even). ...
fgrieu's user avatar
  • 141k
3 votes

Hash function used to find duplicate data, at what point is the risk of a chance match sufficient to switch to a stronger hash or bytewise verifying?

This short calculation might address some of your concerns: Lets assume we are talking about 10^15 datasets of 4KB. That's about 3.6 Exabytes of data and 10^15 hashes. From the table at: https://en....
raisyn's user avatar
  • 481
3 votes
Accepted

Is the statement true in the context of AES-256 encrypted data stored on a hacked server?

Important note: as long as the data on the server (name of platform) is encrypted and the decryption key safely stored elsewhere according to protocols established, it does not matter (from an access ...
Biv's user avatar
  • 10k
3 votes
Accepted

Is there any way to ensure that a network merge, after a parition, never causes disagreements?

This is a long studied question in distributed algorithms design. There are three network models that are traditionally studied: synchronous networks, partially synchronous networks, and asynchronous ...
Vervious's user avatar
  • 155
2 votes

Is the statement true in the context of AES-256 encrypted data stored on a hacked server?

I will address you first rewritten version of the text, and highlight the part that I think needs improvement: Important note: as long as the data on the server (name of platform) is encrypted and ...
Luis Casillas's user avatar
2 votes
Accepted

Database and End-to-End Encryption

You seem to be inventing your own ad-hoc protocol, without authenticated encryption, and using old algorithms with known security weaknesses such as small block size. I strongly suggest you use a ...
rmalayter's user avatar
  • 2,297
2 votes

Encrypting the relationship between two database tables

Provided that any user, who is supposed to have access to any relationship, may be granted access to all relationships, one solution would be to use a SQL engine that supports table level access ...
Henrick Hellström's user avatar
2 votes

Encrypt login id in database

Do not use the SSN as a username!! Like FutureSecurity I cannot speak for the legal liabilities and respective requirements for handling SSNs. The following advice is general and may or may not apply ...
cypherfox's user avatar
  • 1,422
2 votes
Accepted

End to end encrypted web chat app with stored messages in database

Just keep all user-associated information encrypted using the user's password. Be sure to use a secure password-based key-derivation function (PBKDF2 seems to come to mind but personally I prefer ...
Serpent27's user avatar
  • 1,461
2 votes
Accepted

Is this method of salting effective?

Sha256 has not long been cracked, but it's not useful for human-generated passwords. You want a key stretching function. SubtleCrypto provides PBKDF2 (documentation), which is fine. Other libraries ...
Aman Grewal's user avatar
  • 1,421
2 votes

What is $z_b$ in this introduction to Private Information Retrieval?

Long to write as a comment; Look at the referenced paper 47 The user chooses uniformly at random $t$ numbers $y_1,\ldots,y_t \in Z_n^{+}$ such that $y_b$ is a $\text{QNR}$ and $y_j$ , for $j \neq b$, ...
kelalaka's user avatar
  • 48.9k
2 votes
Accepted

What is $z_b$ in this introduction to Private Information Retrieval?

I am the author of the paper. It is a stupid typo. $z_b$ should be $r_b$. I have corrected the error in my own copy but I can not correct the copy that is out there officially. Apologies. My bad!
William Gasarch's user avatar
2 votes
Accepted

Should I protect the salt before storing it in a database or use a pepper (secret salt) instead?

Pick peppers the same way you pick cryptographic keys: use your OS's CSPRNG to generate a 16-32 byte (128-256 bit) pepper. If your system has a Hardware Security Module (HSM) or secure enclave, you ...
SAI Peregrinus's user avatar
2 votes
Accepted

Differential Privacy: Gaussian Mechanism when $\epsilon >1$, Laplace Mechanism when $\epsilon = 0$

In the Gaussian mechanism case, it is important to distinguish the use of $\epsilon$ to parameterise the Gaussian distribution and its use to quantify the level of differential privacy. For any $0<\...
Daniel S's user avatar
  • 24k
2 votes
Accepted

Compressing SHA256 to be a viable database id?

I think this is an XY problem and actually should be posted at Software Engineering SE. The goal described in the OP, the generation of user IDs, can be solved without any cryptography. 1. Scaling ...
mentallurg's user avatar
  • 2,621
2 votes

Password encryption in database

From comments, we learn that the application is storage of password-protected PKCS#12 private keys. Best practice for this would not be symmetric encryption of the passwords protecting the PKCS#12 ...
fgrieu's user avatar
  • 141k
2 votes
Accepted

How is the Unix / PostgreSQL crypt function a trapdoor function?

TLDR: crypt is not a trapdoor function. crypt does not meet the question's condition 3. It does not apply a trapdoor function, ...
fgrieu's user avatar
  • 141k
2 votes

Derive related universally unique identifier (UUID) from a main UUID

A random UUID has 6 bits of overhead, so even if it is fully randomized it will only have 122 random bits. To understand the various versions of random UUID's you can read RFC 4122. If a UUID needs to ...
Maarten Bodewes's user avatar
  • 93.2k
2 votes
Accepted

How many bits should change in a password salt?

pepper is a globally-unique, application-wide constant That's a possible definition. Some make pepper public (e.g. server name). Others make pepper a secret decided at installation, and that can help ...
fgrieu's user avatar
  • 141k
2 votes

Row level database encryption scheme

Are there any glaring security flaws in this approach? There is no complete security architecture shared, and the security of these an entire schemes is considered off topic on this site. That said, ...
Maarten Bodewes's user avatar
  • 93.2k
1 vote
Accepted

End-to-end photo storage

What I was thinking so far is as follows: When user first logs into app, input their password along with a salt (stored in a database) to a key-derivation function to generate a hash Use this hash to ...
kelalaka's user avatar
  • 48.9k

Only top scored, non community-wiki answers of a minimum length are eligible