Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

1
vote
2answers
24 views

How to export secret keys from GnuPG including photo IDs?

I'm trying to create an OpenPGP key with a photo ID using GnuPG and then export it, so it can be imported on a different computer. Whatever tests I've done the photo ID never appears after the import ...
-5
votes
0answers
30 views

If there is a fair way handshake secret? [on hold]

If there is a fair way handshake secret key ? I mean such way that it doesn't favour none of site.
0
votes
0answers
3 views

total effective key length of the AESX-192 [migrated]

If I have a AESX-192 be a block cipher which is similar to DESX but has the DES being replaced by AES and the AES key size is 192 bits. How should I compute the total effective key length of the ...
3
votes
2answers
46 views

Securing HSM-stored symmetric data encryption keys (AES) in memory on server

My project requires me to encrypt sensitive user data using symmetric data encryption (AES). I will be storing the AES key (DEK) in a HSM-based key management service (ie. Azure Key Vault / AWS KMS) ...
1
vote
1answer
62 views

what is the best way to know if the entered decryption key is correct?

I was searching for a way to store the encryption key of AES_ENCRYPT and found a good answer here: where to store a key for encryption However, now I am trying to use "Type in the encryption key when ...
3
votes
2answers
32 views

Comparing allegedly identical OpenPGP keys published through different channels

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like ...
3
votes
2answers
21 views

What can I do with the removed Masterkey?

I intend to start using GnuPG respective mail encryption with GnuPG. So I created a key pair with a short expiry date to gain some understanding. I read some stuff about removing the secret masterkey ...
1
vote
1answer
28 views

What are the Consequences of OpenPGP Key Collisions?

In this answer to GPG keys & SHA-1, there's the sentence: However, since PGP keys are usually generated by their users, collision attacks are not a problem. They might conceivably be a problem ...
7
votes
2answers
284 views

Building a backdoor for full disk encryption

I have all my data encrypted on my laptop. All the backup hard drives are also encrypted. I know all the keys by heart and I could pick up any disk, enter the password and restore everything with it. ...
4
votes
2answers
157 views

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 ...
4
votes
1answer
57 views

Infinite one time pads, brute force multiple pads?

So based on my understanding using the same key for encrypting two completely random plain texts when using an otp cipher will still retain perfectly secret. This is based on the answers on this ...
0
votes
1answer
39 views

Securing HSM's Login Keys

I have an PKCS#11 enabled application which interacts with HSM to store TDES keys. The HSM is initialized with the Security Officer (SO) password provided by the user while the application was first ...
3
votes
2answers
52 views

Can I store a pair of keys on iOS secure element?

I would like to know if I can use the iPhone's secure element to store a pair of keys. I need to store them in the safest emplacement, and I can't think of a better one than the secure element.
13
votes
3answers
990 views

How do I protect my OpenPGP key on my computer?

How do I protect my OpenPGP key on my computer? If I make a backup of my private key I will keep it secure, but if someone gets access to my computer he/she will can get all my keys through Kleopatra ...
5
votes
1answer
21 views

Transparent key management for client computers

I'm tasked with adding a backup feature to our software. This backup feature should store the customer's database on external memory. One of the requirements for this feature is that the backup should ...
0
votes
1answer
71 views

Questions on the variations of RSA keys

I've built a simple application that reads in an RSA key, checks the header and starts identifying properties of the RSA key to make sure it is valid (Using child_process in express to run $ ...
3
votes
1answer
44 views

Centralized key management for IOS and Android Code Signing

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines. I see systems like ...
0
votes
0answers
34 views

On the Import Client Key screen in Bitvise what is numeric field just next to the Location Profile dropdown?

What is this field for? I know I saved a profile in the beginning, and I want this private key to be attached to just the profile that I'm using, but what on earth is that numeric field for?
3
votes
1answer
61 views

Is the ssh-copy-id command secure?

I have 2 Ubuntu 14.04 servers with openssh-server installed on both. I've set up key-based authentication using RSA keys, without passphrase, so that I can run automated backup scripts, to a remote ...
1
vote
1answer
65 views

Is it safe to publish my development private key?

For my development environment, the following three SSL files allow me to access my application from https://localhost on my local machine. Private key: server.key Certificate signing request: ...
3
votes
1answer
69 views

Does RekeyLimit property in sshd_config enforce re-keying / key re-exchange?

I have set the RekeyLimit property in sshd_config and tried to perform a SSH. However, I could not see rekeying happening in the verbose logs, all I see is the log message below at the start of the ...
0
votes
1answer
133 views

Tie key to computer

I have client server application. Is it possible to tie an encryption key to some computer (say my client) such that is key is stolen attacker won't be able to use that key from another computer? ...
1
vote
1answer
80 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
0
votes
3answers
131 views

How to store encryption key securely?

Say I have symmetric key which I want to store securely. One way is I will store this key on file system encrypted using user password. Then user at windows startup will enter password which will be ...
1
vote
3answers
329 views

Prevent or detect key copy

This question can be classified as somewhat two interrelated questions - or two goals. Main aim is basically to authenticate client to server, but remain secure even if someone steals the key from ...
13
votes
1answer
225 views

Yubikey / GPG with OpenSSH signed key

I am currently looking into the possibility of using Yubikey (NEO)'s to store the private SSH keys of my users. By searching the internet I've found several places that explain how you can generate a ...
-1
votes
1answer
78 views

Why are pgp keys limited to a number of bits?

I am wondering : why does pgp keys have a fixed number of bits. They can be 2048,4096, but why not 56000 or 23 bits ? Is there a specification, or ISO, that was made to limit thoses Keys. Why? If a ...
4
votes
0answers
76 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
3
votes
1answer
37 views

Strategy to migrate Passwords securely from one application to another

We are working on a tool that exports data from Source Application "S" to CSV files. These CSV files are manually migrated to box where the Target Application "T" resides. Each line in this CSV is ...
1
vote
0answers
69 views

Multi-Region MySQL Deployment on AWS - How to Encrypt?

Problem: AWS offers the managed RDS MySQL database service in which you can encrypt and manage keys using AWS's Key Management System (KMS). Unfortunately encrypted database snapshots cannot be copied ...
4
votes
5answers
171 views

Should I generate new SSH private keys for each machine I work from?

I hope this is an appropriate place to ask this question. I've been thinking recently about public and private keys, and I'm wondering what the best practices are related to management of my own ...
1
vote
1answer
78 views

How to detect whether a GnuPG private key has passphrase on it from a script?

I've written a script to help our developers store a copy of their private keys without a passphrase inside our Puppet tree (not committed to Git) so our Vagrant boxes can use Hiera with eyaml + gpg ...
2
votes
1answer
26 views

Revoking AIK Key

How can I prevent attacks via compromised Attestation Identity Key (AIK) keys, such as having an attacker forging the cryptographic signature of an AIK key on TPM?
3
votes
1answer
44 views

GPG key expired on mykeyring, but still valid on keyserver

Can someone help me in explaining this: I have an old and expired GPG key, on my keyring the key lists correctly as expired: myself@mypc:~$ gpg --list-sig --fingerprint DDF70E72 pub 1024D/DDF70E72 ...
4
votes
1answer
81 views

My OpenPGP private keys are set up with sub-keys. What happens if I revoke a sub-key and re-issue a new one?

I have set up my OpenPGP keys with sub-keys, following the general instructions laid out in "Creating the perfect GPG keypair." The general gist is that you create a "master keypair" which is not ...
1
vote
1answer
69 views

Keeping a password safe in program config

I have a Windows service which connects to a database to poll some value in order to monitor certain activity. Of course, to use this I need a database password. I need to keep this password safe, ...
3
votes
1answer
70 views

Should I revoke & regenerate PGP private keys after computer is serviced by Apple Store?

I recently had an issue with my MacBook where it wouldn't boot. So I took it in to the apple store, and they said that they would need to send it off to a service center to diagnose and repair it. I ...
7
votes
1answer
1k views

Has the leaked D-Link windows signing key been revoked?

Recently news broke as to D-Link mistakenly publishing a private code-signing key as part of an open source framework. The D-Link key was leaked in late February, and expired on September 3, it ...
0
votes
1answer
57 views

Key management: Detecting that a key has been compromised?

I am looking at communication between our iOS/Android mobile app on the one side, and our RESTful web services API on the other side. From the server side, I have to assume that anything I receive is ...
1
vote
2answers
139 views

Difference between KMS and PKI

While the PKI System deal with digital certificates life cycle and Key Management System (KMS) deal with keys life cycle. What is the the fundamental difference between them? Is it possible to ...
4
votes
1answer
372 views

How to authenticate in a website with public/private keys?

I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing? ...
8
votes
3answers
671 views

What to do when you can’t protect mobile app secret keys?

We have a mobile app for iOS and Android available in the Apple and Google Play stores. The app communicates with our server’s Web Services over HTTPS. We have attackers able to spoof the app ...
6
votes
4answers
453 views

How to inject a key (physically) on a huge number of devices?

The system I am designing has a huge number (assume millions) of individual devices, and each device needs to be injected with a unique symmetric key dedicated to that device. Each device also has a ...
2
votes
1answer
58 views

New certificate but what about the keys?

One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a ...
1
vote
1answer
123 views

Envelope Encryption with asymmetric keys vs KMS

In Envelope encryption a symmetric secret key is used to sign the data and then another key is used to encrypt the secret to produce an encrypted secret key. The encrypted messages is packaged with ...
0
votes
0answers
18 views

What is the goal of sign a key in BrowserID certificate?

I'm learning about the Mozilla Auth. it has an implementation of SRP protocol in https://github.com/mozilla/fxa-auth-server/blob/master/docs/overview.md and his client; example is ...
2
votes
2answers
127 views

How often should TLS Session Ticket Keys be rotated?

I am configuring a non-sticky load balanced cluster of HTTPS servers. To enable TLS session resumption when a previous client reconnects to a different server in the cluster I will be configuring ...
0
votes
0answers
29 views

Online Personalisation of Terminal-HSM key management

In Germany, there is a widely used key management called Online Personalisation of Terminal-HSM (OPT, Online-Personalisierung von Terminal-HSM). I would like to get details about it and to compare it ...
1
vote
1answer
93 views

SSL key decryption [duplicate]

I am wondering if I can get the SSL Key given the following conditions: Encrypted Text is known Decrypted Text is known Any ideas on how I can create a program that does this?
2
votes
1answer
106 views

Why is brute forcing DH private key harder than calculating public key?

Assuming shared parameters: prime p base g Alice's private key is a and her public key is A, which is g ^ a mod p Calcuating A requires g * g * g... a times. Modulus is applied whenever necessary. ...