Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

2
votes
1answer
12 views

PGP Owner Trust Field & Signature Trust Field Distinction

I'm reading Cryptography and Network Security Principles and Practices (5th ed, p584) and reading about PGP keyrings, I'm a little confused about the differences between the owner trust field and the ...
0
votes
1answer
16 views

Should I create one key pair per customer as Service Provider in SAML?

This is basically the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application that allows customer to use their existing IdP for authentication with our Web ...
1
vote
2answers
62 views

Securing communications in decentralized network of servers

Lets consider the following setup: One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and ...
1
vote
2answers
40 views

Encrypting user credentials using AES: how to hide the key

One of my software (an R package) has to save on disk users sensitive information. I encrypt such information using AES encryption using a random key that is generated at the moment of installation ...
-1
votes
0answers
24 views

May .pfx file contain more than one private key? [migrated]

I am trying to understand whether .pfx file may contain multiple private keys or not. In case there are several sets of certificates and their private keys how they can be found in KeyStore? By using ...
0
votes
0answers
26 views

GPG: Import UID [closed]

I have not yet submitted my keys to a keyserver. I have one UID, but I wish to change its email address. As my master key is only saved on an encrypted USB device, I performed the following steps: ...
74
votes
2answers
5k views

How are private keys kept private?

This may sound like a stupid question but seriously how are private keys kept private? If you're someone like Google you have some huge number of servers to which the public can establish secure ...
2
votes
1answer
95 views

Strategy for encryption before cloud storage

Apologies if this has been asked before. I am looking to encrypt documents before storing in the cloud. There will be a separate metadata storage, which could be either internal or cloud hosted. My ...
32
votes
2answers
5k views

I accidentally published my SSH key passphrase, what to do?

So I mistook input fields and now my SSH key passphrase is visible to the world, and I can't even remove it. Now as far as I understand, this is not an immediate security concern, since the ...
1
vote
1answer
25 views

Digital Certificate Repository Integrity

I am trying to figure out if there is an automatic way to determine if a digital certificate repository has been tampered with. Does anyone know of a way to do so?
5
votes
2answers
137 views

How are symmetric cryptographic keys stored?

If you have a symmetric key which is negotiated via SRP protocol between a mobile device (e.g. smartphone) and a server, what would be a safe way to persist this resulting key on each side? On the ...
1
vote
1answer
31 views

Best practices for encryption from web<-> specific client

If we want to allow sensitive data between a web server and specific client only, is there anything more that can be done besides the following? Note that this is potentially a duplicate of ...
3
votes
1answer
88 views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...
1
vote
0answers
22 views

JKS - Keystore protection and configuration file

It appears that Java Keystore is often used by web server using a configuration file, with the password opening the JKS written in it and also the password protecting the specific entry. How could ...
0
votes
1answer
78 views

Safely encrypting data received through HTTPS

I am receiving sensitive data over an HTTPS connection and need to store this on disk, encrypted so no one can tamper with it, but for reading later on. Each user in the system has a password. The ...
3
votes
1answer
37 views

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs: Stop using 32bit key ids It takes 4 seconds to ...
1
vote
1answer
34 views

User Key pairs and Man-in-the-middle issues

I'm trying to wrap my head around how to exchange user's keys with a server. Maybe during sign-up a JS applet generates a key-pair for the user. These keys would be used for signing subsequent ...
3
votes
1answer
83 views

How to deal with SSH keys in insecure environment

I am trying to find out a "safe" solution for the following situation. tl;dr how to keep things secure in an environment that is absolutely not? I work in a company where workstations are not safe ...
0
votes
1answer
84 views

Is it dangerous to use the same key (RSA) for both encryption (PGP) and authentication (SSH)?

Alice wants to send an encrypted message to Bob, but she also wants to connect to Carol's server. Are there any dangers associated with using the same RSA key for both PGP and SSH (other than a lack ...
1
vote
1answer
23 views

GPG: Detaching Public Subkeys - why can't I do it?

I understand the benefits of using subkeys. I also know that, in the case of private keys it is possible to detach the subkeys from the master key, since there are times when a user may prefer not to ...
2
votes
1answer
25 views

Is android's FDE secure from offline attacks?

Android provides FDE, but it uses lockscreen pin, which is (at least in my case) fairly weak (like a 4-digit PIN). Does it mean that my FDE could be easily broken by offline attack? Or maybe master ...
0
votes
1answer
40 views

Encyption Key Storage and floating point encryption

I am working on a web application where I need to encrypt some fields based on user configuration and display the decrypted information. The field values can be text or integers or floats. We are ...
1
vote
1answer
22 views

How can i store encryption key into Microsoft provided Key container?

I'm working on an application in which user will enter encryption key via GUI and my app will fetch that encryption key. Now i need to store that received key into Microsoft key container. I got this ...
16
votes
4answers
3k views

Is it dangerous to publicly share ciphertext?

Alice wants to share a message with Bob, but Alice and Bob can never be in the same place at the same time. We can assume they both know each others public keys (or agreed on a shared key, if that ...
0
votes
1answer
81 views

What are the best practices to store payment processor dev/API keys?

I am integrating with multiple payment processors which have their set of public/private keys. This would be used in conjuction with per user keys, to bill clients. I was wondering what is the best ...
5
votes
2answers
77 views

Why don't PGP keyservers enforce double-opt-in?

One thing that I found out when starting using PGP: When I uploaded my keys to the SKS keyserver, the keyserver did not take any action to verify that I am who I claim to be. Since a PGP key contains ...
1
vote
0answers
39 views

How is Tresorit client-side encryption key stored and managed?

I am using Tresorit on Mac OS X and iPhone. When I am using it there is always applied client-side encryption before posting the file to cloud. The key used for encryption is AES-256 and CFB mode of ...
1
vote
0answers
21 views

CCM instead of key wrap

Is there any instance of NIST or other encryption standards using AES-CCM to encrypt/authenticate key data? I would like to use CCM over a keywrap function, but cannot find any precedent for this in ...
1
vote
1answer
62 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strenght ? (PBKDF2 as both ...
0
votes
0answers
28 views

Distribution of key by server

I have read that in asymmetric cryptography, a system admin can generate key pairs on the server. After that, the users will be given the generated key pairs and this is an efficient way of doing this ...
1
vote
1answer
60 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
1
vote
2answers
58 views

Management of server keys

I plan to put an SSH server on micro-controller devices. There shall be many devices distributed in a wide range. The identity of the server is checked with the server key. The server needs to store ...
0
votes
1answer
32 views

PKCS#12 File - security impacts when imported in Web Browser or Windows Store?

When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password. How does the browser or operating system manage this password? Is it secure?
-3
votes
1answer
83 views

AES 256 bit key to plaintext conversion? [closed]

I'm a little rusty on cryptography, but I have successfully acquired a 256 bit key that is used for encryption and I want to know if it is possible to reverse it into its corresponding plain text ...
1
vote
1answer
43 views

Bus smart ticketing systems and EMV

I have recently started to study the smart ticketing systems. Most of the modern systems support the use of EMVCo standards for buying tickets in the bus. Also, in each bus usually there are more than ...
1
vote
1answer
72 views

Any way to revoke old key pair?

There is a many-year-old 1024 DSA key in the public keyservers under my name. There is a 2048 ELG-E subkey for it. I didn't create these keys, they were created for me by a former employer without my ...
0
votes
1answer
30 views

JKS is readable without providing a password

I'm at that stage in application development where I'm forced to tinker with openssl and keytool again. I was surprised to find that I could list and export certs from a JKS key store without ...
1
vote
1answer
54 views

Single vs server specific ssh keys?

This question has a bit to do with procedure. Is it better for a person to have one single ssh key pair and share the public key where needed. Alternatively is it better to have server specific keys? ...
0
votes
0answers
14 views

Why do PGP Keys have expiration dates? [duplicate]

I read a tutorial to get started with PGP and so far I understand the importance and the difference between encryption, decryption, signing, and verifying. However, I don't understand why a key has ...
4
votes
2answers
108 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
4
votes
1answer
126 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of ...
-1
votes
4answers
114 views

Can I “hide” the private key, while still allowing it to be used?

Let's say you assign SSH keypairs to all users on your system; none of these "low trust" users have root privileges. You want the users to be able to use their keys in SSH connections, however, you ...
3
votes
3answers
114 views

Best practices to copy private keys to mobile devices

I would like to copy an ssh key to my Android phone. However, I have displaced the connection cable for my computer. I am looking for a safe way to transfer the key to the device. Obviously, I don't ...
1
vote
3answers
88 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
3
votes
3answers
181 views

Safe storage service for private keys

Is it currently technically (as opposed to financially) possible to provide a fairly secure means of providing a storage facility for private keys, not excluding physical verification etc? As in, you ...
0
votes
0answers
65 views

How should I organize my keys?

Suppose I have a set of computers with variegate level of trust (for example): I fully trust my own desktop pc at home I trust a bit also my smartphone, but I know it could be stolen I trust a bit ...
1
vote
1answer
277 views

Protecting decryption key on server

What is the most suitable way to encrypt and decrypt sensitive data on a public cloud server disk without storing the decryption key on the server in plaintext? REQUIREMENTS In our SaaS web/mobile ...
0
votes
1answer
85 views

How are Cloud based HSMs used for Encryption by an application that is on premise (behind the enterprise firewall)?

Amazon CloudHSM (It is Safenet in the backend), Safenet Luna HSM SaaS version and other cloud HSM providers provide Key Management and encryption services on device in the cloud. From my research, I ...
3
votes
1answer
370 views

How does firefox sync password recovery work?

According to Mozilla Sync-new-security-model, Firefox servers are not able to decrypt your sync data without your password. So I figured that, the browser generates a key from your password, encrypts ...
1
vote
1answer
383 views

Secure private key storage

In light of BadUSB, storing private keys on a USB flash drive is not the best way. What about writing private keys to a CD? What I am worried about is whenever I plug my private key storage device ...