Is BitLocker susceptible to any known attacks other than bruteforcing when used with a very strong passphrase and no TPM?

I have learned about attacks where the BitLocker master key can be sniffed on its way from the CPU to the TPM using a logic analyzer. However, in computer configurations without TPMs, this is obviously not possible. Furthermore, as I under… Continue reading Is BitLocker susceptible to any known attacks other than bruteforcing when used with a very strong passphrase and no TPM?

is it less secure to run the onion (TOR) protocol on a virtual machine running on a host with an ordinary Internet connection?

I’m thinking in an analogy of the Postal Service. If you mail a package of drugs with an encrypted return address, it does not seem secure to send it through the US mail in another envelope with a plaintext return address.

Continue reading is it less secure to run the onion (TOR) protocol on a virtual machine running on a host with an ordinary Internet connection?

Is XML Encryption 1.1 Key Agreement test cases decryption possible in .NET? [closed]

I have asked this already on Stack Overflow, but got a suggestion to ask in this community too.
I’m working on implementing an XML encrypting / decrypting application in .NET with support for ECDH-ES because clients will use EC key pairs t… Continue reading Is XML Encryption 1.1 Key Agreement test cases decryption possible in .NET? [closed]

Is it currently considered strong security to store the encrypted data and encryption key in the same database? [duplicate]

In 2024, is it considered safe to encrypt user data, store the encryption keys in the database, and protect them with user credentials? Deriving keys from user password is not ideal in my design. My plan is to allow OAuth-based authentica… Continue reading Is it currently considered strong security to store the encrypted data and encryption key in the same database? [duplicate]