Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

0
votes
0answers
9 views

Storing encryption keys on a server using Node.js and MySQL

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for ...
0
votes
0answers
14 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
-1
votes
0answers
21 views

PCI-DSS: Protect any keys used to secure cardholder data against disclosure and misuse [on hold]

How to implement PCI-DSS requirement 3.5? (Protect any keys used to secure cardholder data against disclosure and misuse.) I use a JCEKS keystore, passphrase protected, to store my keys (RSA 2048 ...
0
votes
0answers
21 views

What are some of the threat models that affect key mangement? [closed]

I am currently trying to to conduct some research into traditional key management and how we can apply these techniques to use them in the cloud. What are some base threat models I should be trying ...
4
votes
1answer
57 views

Recommended symmetric key usage period

Let's assume that there are two nodes A and B connected over a network. Both have a single pre-shared symmetric key (e.g., AES-128) and exchange messages. What is the recommended period, until the ...
6
votes
3answers
99 views

Server side SSH keys compromised

I'm interested in knowing what could be the consequence if the server side SSH keys of a host were compromised. The situation would be: An attacker manages to read the SSH private keys of the ...
0
votes
1answer
41 views

Multiple user encryption-key store

Let's say I have an application that accesses an encrypted datastore, and I want the admins to be able to unlock the datastore upon application startup (and then the application will have access to ...
1
vote
0answers
81 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
-1
votes
1answer
34 views

Implementing a product key system?

Say I have a piece software that allows people to download a trial version that can then be unlocked. Would the following steps below be an effective way to implement a key system for unlocking the ...
2
votes
2answers
40 views

How secure is switching keys if breaking the key is an intractable problem?

Let's say that you create a system where a secret is hidden and revealed by a particular key. As well, the key can be broken, but it would take thousands of years. If you keep switching the keys ...
1
vote
2answers
132 views

How to maintain security and trust with a PGP keypair for a team or group of people?

I've seen many instances where a company or organization generates and uses a PGP keypair for a team or group of people. Most likely they all have a copy of the private and public keys on their ...
1
vote
0answers
48 views

How to securely delete an OpenVPN connection profile

I store my OpenVPN profile (keys) in an encrypted drive but I run OpenVPN inside an OS that is not encrypted. When I finish my OpenVPN session and disconnect, the connection profiles are still there ...
1
vote
1answer
56 views

GSM A5/1 encryption: Key management

I'm currently studying the A5/1 algorithm used for GSM encryption. I understood how thanks to the symmetric private Key and a public counter frame one can encrypt the communication between A and B. ...
1
vote
2answers
40 views

How to setup cronjobs that do scp without saving the .pem file on either of the machines

I have the following situation and want to know what are the best practices to do such things without exposing myself to security issues I have two servers both use the same private key for login. ...
0
votes
1answer
20 views

One user ID of a trusted key has unknown trust

I observed today that Thunderbird/Enigmail (24.2.0/1.6) does not allow me to select a key for encrypting mails to one of the addresses associated with the key, even though others work. Help sites ...
4
votes
1answer
35 views

PGP keys varying only in attached signatures

Here is a few questions revolving around the same core problem. Let's say I generate a PGP keypair. I now get the keypair signed by person A at signing party X. In the evening, I give my now-signed ...
2
votes
1answer
60 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
1
vote
0answers
55 views

Import securely RSA private key through PKCS#11

I have a cryptographic device that supports the following mechanisms: How I could securely import RSA private key into it? Because there is no support for wrap/unwrap using symmetric key is there ...
2
votes
0answers
45 views

Why doesn't Bitlocker mix the password with stored key?

Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of ...
3
votes
4answers
189 views

Are there Ciphers designed to be slow?

To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to ...
3
votes
2answers
79 views

Signing my certificate by using my smart card and eID card?

In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication. I ...
1
vote
0answers
74 views

“Keyset does not exist” when using SignData function with RSA

"Keyset does not exist". I know that there are tons of question about this error, but mine is totally different. I'm not gona use the key from windows certificate store, but load the public key & ...
3
votes
2answers
90 views

Do I ultimately have to hold a key in my head?

To preface, I'm not an IT security person, just a layman intrigued by the logic. I had this question while reading about Ladar Levison turning a key to his email service on paper to the government. ...
51
votes
10answers
5k views

Where do you store your personal private GPG key?

So, I want to start using pass, but I need a GPG key for this. This application will store all of my passwords, which means it's very important that I don't lose my private key, once generated. Hard ...
1
vote
1answer
74 views

Pgp Private key storage on windows server advice

Looking for a bit of advice really, here's the situation: I currently have a security minded client who will be sending PGP encrypted files. I have to decrypt the files on my server before ...
0
votes
1answer
37 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...
2
votes
1answer
69 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
2
votes
2answers
57 views

RSA key exposure

Is there any limit to the number bytes that an RSA key can be used before it can be exposed. In Symmetric encryption a Key is not recommended to be used to encrypt more than specific amount of data ...
1
vote
2answers
130 views

Using 1-day expiration GPG keys only… any disadvantages?

From the thread Does GPG key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
0
votes
2answers
85 views

What are the Standard Practices for Securely Storing Encryption Keys in Databases

I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ? To add a ...
0
votes
2answers
64 views

What is the meaning of “Key Deletion” operation?

In the context of Key Management and encryption/decryption, what does "Deleting a Key" mean exactly? What are the implications of "Key Deletion", in terms of: Decryption of the old data (i.e. data ...
3
votes
1answer
163 views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
4
votes
3answers
222 views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
8
votes
2answers
240 views

Is it really secure to store API keys in environment variables?

This site says it is best to keep API keys in environment variable out of the code. And here Storing Credentials Securely You should take great care to ensure your credentials are stored ...
7
votes
3answers
228 views

How can I allow acces to encrypted data if only 2 out of 3 users provide a secret?

I want to encrypt data, but make sure that no single user can decrypt the data. Further, it is important not to require ALL users to be present to decrypt. This will allow for some flexibility and ...
0
votes
0answers
29 views

Secure data with server and RSA? [duplicate]

the RSA system uses a private key to read the content encrypted with the public key. If I make a game for mobile, and want to save the data : I guess I cannot save the private key on the device. If ...
0
votes
1answer
160 views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
3
votes
1answer
181 views

DPAPI equivalent on linux?

I have an app server and a db server. I want to send certain data to the db encrypted, using a DEK (data encryption key). Ideally, this DEK is read protected on the linux file system and encrypted ...
1
vote
1answer
86 views

Which is best DPAPI or HSM?

Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
3
votes
1answer
66 views

How do I sign another person's key and make the signature expire?

I'm using gnupg and I've just seen that people can sign keys with an expiration attached. The expiration of individual signatures can be seen in gpg --list-sigs <KEY> when setting this in your ...
3
votes
1answer
84 views

Can we build a key exchange protocol without certificates?

Assume that the server and the client both has some secret key K. Is it possible to have a key exchange protocol with authentication between them such that MITM attack cannot hold and if the key is ...
1
vote
1answer
67 views

Security implications of setting the same password on private key and PKCS12/JKS?

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
6
votes
1answer
146 views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
0
votes
2answers
112 views

Password management [duplicate]

I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
5
votes
2answers
263 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
2
votes
0answers
339 views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile website to make my service also available for other mobile operating systems. Now, ...
1
vote
1answer
64 views

Can I ask GPG keyservers to name all keys signed by a particular key?

Given the alleged possibility that an adversary might attempt to acquire my (OFFLINE) Secret Certification Key and Passphrase and sign other keys with it, including a key they made with my ...
3
votes
2answers
169 views

What is the purpose of 'Version:' in PGP public key

PGP public keys look something like -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.9 (GNU/Linux) mQGiBEl2HAgRBAC9IZGQE3NRWFoXV7CcVRbo7xMe+nGPRMTOocA0pcv9N67R6CAZ ... -----END PGP PUBLIC ...
1
vote
1answer
95 views

Advice on using encryption for self training app

I am self training on using encryption. I am a php developer and in my spare time I am building an online app that provides basic cms features to help me understand encryption design more. I am using ...
0
votes
3answers
129 views

What are the MitM implications of a stolen client-side private key?

Many VoIP handsets support client-side SSL authentication for auto-provisioning. Unfortunately, some devices must be programmed with their client-side keys. (Keys generated on low-entropy devices are ...