Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

3
votes
1answer
59 views

Question about AES-CBC IVs

I'm writing a Java program that encrypts strings with AES-CBC encryption. (Eventually I'm going to add steganography functions too). As you are well aware, CBC needs an IV in order to encrypt the ...
2
votes
2answers
58 views

Why use dedicated SSH keys for different hosts (like GitHub)?

I recently discovered github-keygen, a tool that helps you set up SSH for use with GitHub. One of the things the tool does is to create a new SSH private key dedicated to GitHub exchanges; the manual ...
0
votes
0answers
14 views

How can I create many-to-one keys in Doctrine/Zend/PHP?

I'm using Zend with Doctrine 2 to store data in a database. For a given user, I encrypt the data with a randomly-generated key specific to that user, and encrypt the key with that user's password ...
1
vote
0answers
22 views

Key distribution for zeromq [closed]

We're evaluating zeromq for a publisher/subscriber model where the publisher could change after each session. The public keys have to be distributed in advance. It seems that zeromq has its own ...
1
vote
2answers
79 views

Suggestion on asymmetric (hybrid encryption) encryption for big file

We will be using following commands to encrypt to firmware file at server and that will be decrypted on the embedded board using decryption command mentioned below, Following command will be used to ...
0
votes
1answer
47 views

Grabbing ChaCha20 key from ram

There are various other posts which talk about grabbing a key from ram such as http://electronics.stackexchange.com/questions/198274/storing-a-secure-key-in-an-embedded-devices-memory How would you ...
5
votes
1answer
91 views

Can you extract the encryption key of a computer with full disk encryption via malware?

I recently discovered the subject of cold boot attacks which are able to extract the encryption key of the ram memory after the computer has shut down. and from what I understand is that law ...
0
votes
0answers
26 views

I want to deploy from GitLab to AWS - so where exactly do I store my private key?

This seems like an odd and simple question, but I'm trying to get my head around the principle of "never check a private key into version control". I'm trying to build a startup of sorts, where ...
9
votes
4answers
605 views

Print or burn encryption key? [duplicate]

I'm thinking of setting up a cloud backup for home computers, and to increase privacy I want to encrypt the data with my own encryption key. The "cloud" would give me a chance to restore data in ...
-1
votes
2answers
53 views

Store encrypted data locally on the phone that the Android and iOS app itself decrypts

I have an iOS and Android app where our "secret sauce" is a bunch of numbers (weights, actually) stored in a database. Our app uses these numbers to compare what the user of the app has given it, and ...
-1
votes
1answer
29 views

Safest place to store a credential/key on iOS Android device?

I'm developing a game which has an accounting system very similar to the one used in Geometry Dash, where the user can also upload levels or vote on them, without the need to be registered with an ...
66
votes
3answers
12k views

Why shouldn't I bring a computer to a key-signing party?

I'm looking at the event description for the key-signing party at an upcoming BSD conference, and it's mentioned that I shouldn't bring my computer in to the event: Things to bring no ...
0
votes
2answers
91 views

C# .Net most secure way to store RSA Key Pair in Windows

At the moment I am looking into the most secure way to store a private RSA key on Windows. Making it as much usable for the end user as possible, while keeping the security to its highest. As this ...
1
vote
0answers
75 views

How to crack (get secret from) Android Keystore System

I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to ...
0
votes
0answers
20 views

Key Distribution Center Key Protocol Analysis

http://i68.tinypic.com/fwu92v.png As shown in the image, why is Circle 1 to be B and Circle 2 to be A? Why is not the opposite, that is, Circle 1 to be A and Circle 2 to be B? like this picture ...
3
votes
1answer
42 views

Relatively simple OTP code generated by SafeNet MobilePass

I noticed something peculiar while logging into the VPN of the company I work for. I generated a one-time passcode from MobilePass, and the code displayed was “010010”. I captured an image of this ...
4
votes
1answer
77 views

What medium for storing full-disk encryption keys is easy-to-use as well as easy-to-destroy?

If I were to frequently work on sensitive data on a LUKS partition and wanted to be able to quickly destroy the keys to it, I figure it would make sense to— encrypt that partition with a key file, ...
-1
votes
0answers
37 views

What would happend if an attacker stole the key to my key management server?

I have a little question regarding the wonderful topic of "Key Management". Let's imagine I would use a service like AWS Key Management. According to their API documentation one can easily decrypt a ...
2
votes
1answer
54 views

How to manage employee OpenPGP keys?

I am trying to create a secured policy for storing and maintaining keys between users of my company. I am rather new to OpenPGP and thus need some advice. Currently, the idea is: Generate a master ...
1
vote
0answers
27 views

Dynamic Key Management in WPA through Radius server

Can anybody tell me in detail (or provide good links), how the dynamic key management is done by the authentication server in WPA? In other words, let's say I gave my credentials to the authentication ...
0
votes
1answer
31 views

Why must the master key be stronger than the session key?

If I am going to use a master key to generate a session key, the master key must be "stronger" than the session key. For instance, I should not be distributing a 128-bit AES keys with a 56-bit DES ...
0
votes
0answers
67 views

How do I securely encrypt and store database encryption keys? [duplicate]

I have a database with encrypted information, and want to encrypt each entry with a different key. Then I want to store the encrypted keys in another database. I know I have to encrypt the keys before ...
4
votes
1answer
76 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
2
votes
2answers
81 views

Is there a difference between getting encryption key versus encrypted data from server in terms of security

Suppose we have web and application servers and trying to encrypt credit card information for our financial web application. Communication between web and app servers are secured through SSL/TLS. Lets ...
0
votes
0answers
115 views

Secure Handshake and register for Auth

The registration The Start - pre-authentication Let's assume there are Alice and Bob. They know each others public keys and each of them generates a random string - Bob's Bobkey and Alice's Alicekey....
0
votes
0answers
38 views

Preventing a key from being found by analysis

Lets say Alice wants to send an encrypted message to Bob. They both know a secret key. Alice uses the key to encrypt the message and Bob uses the key to decrypt the message. Now, if the handshake ...
1
vote
2answers
101 views

Does unsecure delivery of keys and certs make a VPN useless?

I had to install an OpenVPN service onto a fresh, disconnected computer, but the keys and certs were delivered through an insecure computer with a highly suspect connection. Let's assume that the ...
5
votes
1answer
125 views

How to share an encryption key between different PHP applications?

I'm working with the php-encryption library to provide integration between two different applications. On one side, I have a corporative application that holds all data from users. This application ...
0
votes
1answer
153 views

Is this a good scheme for storing encrypted user credentials?

We are building a service that manages multiple user accounts. For that reason, we need to store the credentials to a user's accounts using a symmetrical algorithm so they can be retrieved for the ...
3
votes
2answers
83 views

Does TLS rotate the shared secret periodically?

After the initial shared secret is agreed upon between the client an server through the TLS handshake does the shared secret get rotated periodically ?
1
vote
1answer
32 views

Is there a secure method of distributing keys to network-booted diskless nodes?

I have a bit of an 'initial trust' issue. We are using CoreOS to run Kubernetes, and secure both the etcd API and the Kubernetes API servers using client certificates. We are using iPXE to boot ...
1
vote
0answers
75 views

SSH Keybased authentication using NitroKey

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my ...
5
votes
2answers
184 views

Best practices: Use of a single private key as a person, or multiple to identify self across domains?

Similar to the question here, I'd like to apply the same question to a person. For example, I have implanted a chip in my hand that holds an encrypted private key that serves as my personal unique ...
1
vote
0answers
26 views

key hierarchy management and master key

Now, I have this equation, {{K_ab}K_bs}K_as. K_ab is encrypted by K_bs then whole packet is encrypted by K_as I think the key structure is K_as is the master key, K_bs is under K_as and K_ab is the ...
0
votes
1answer
51 views

Review of a protocol

I am wondering if anyone could give a second opinion whether the following is secure or not. I have a system which consist of a mobile device, FTP server and a PC. The mobile device is to upload ...
1
vote
0answers
59 views

Key Hierarchy and key Encryption

If i have two 56-bit DES keys, and I use these two key to encrypt a 256-bit AES key. Like this: K_AT encrypts K_BT and K_BT encrypts K What is the effective security of key K? Is it 2 X 56 Bits?
0
votes
1answer
73 views

Can I use a KEK to protect data as well?

My customer wants my organisation to evolve their system such that keys currently used to protect the confidentiality of other keys during transport are also used to protect data confidentiality in ...
2
votes
1answer
53 views

Azure Key Vault vs Azure Environment Variables - Which is the right way?

I've read a lot on the new Azure Key Vault feature and it does have some valid use cases. However in the case of a simple web app I don't see the benefit of using environment variables which can be ...
2
votes
1answer
31 views

How to import primary secret key from backup into GnuPG?

I've seen "Re-import secret primary key in GnuPG" which is pretty much the issue I'm seeing, but I haven't had any luck with GnuPG 1.4.20 (from GPGTools) or GnuPG 2.1. Even if I delete my entire ~/....
1
vote
1answer
66 views

Hide data from user, but process it in application

Is there a way to hide the data that's received somehow from the user? In particular, I have some data that gets send from a webserver to an application. I want the application to process the data, ...
2
votes
1answer
65 views

Recommendation Key Management and Storage in Cloud Storage

I am currently researching about key management in the cloud storage and looking for alternative for it. The current system stores encryption key for each file in the server and each key is encrypted ...
2
votes
2answers
73 views

How does GnuPG encrypt secret keys?

When creating a secret key with GnuPG, you are asked for a password to protect it. Which encryption algorithm is used to achieve this? The handbook only says that a symmetric encryption algorithm is ...
5
votes
2answers
145 views

Public key for SSH over the internet differs from a key for SSH over the LAN

I have a Raspberry Pi and can access it via SSH (authentication via user password) when my laptop is in the same network. Now I want to access it over the internet. I already set my router to forward ...
1
vote
1answer
37 views

How to properly use PGP for e-mail encryption/signature (key generation, key rollover, etc.) [duplicate]

To improve my privacy, I would like to use PGP to encrypt/sign my e-mails. How should I proceed to use PGP in a secure fashion? I am trying to think about how to do it properly. From what I found, ...
9
votes
1answer
140 views

How to compare key management strategies

Are there formal security definitions or frameworks to evaluate the quality of a key management scheme? Can I state something like "the key is XYZ-protected against a polynomial adversary given that [...
3
votes
2answers
148 views

Does Intel or Arm support private key memory?

I know some security processors have an isolated bus where you can store a private key and use it with hardware encryption without the key ever being stored in memory. Some even have key storage ...
0
votes
2answers
42 views

Does PKI signature verification require secure distribution of public keys?

I'm looking at a software project where the GPG public keys of the maintainers are found on a website using HTTP. According to the GNU Privacy Handbook, "The signature is verified using the ...
1
vote
1answer
69 views

Key rotation for shared secret keys - recommendation

When using software that does encryption using shared secrets what are the recommended practices for changing the keys. To be specific, this is a distributed software running in a cluster and the ...
3
votes
1answer
61 views

PKCS#11 session object security

The CKA_TOKEN attribute identifies whether the object is a token object or a session object. We can believe that when the PKCS#11 object has CKA_TOKEN attribute set to true, then it is securely ...
3
votes
1answer
98 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...