Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

0
votes
0answers
9 views

Sharing DUKPT BDK with a partner

Assumptions: We have devices out in the field injected with keys derived from our one and only BDK. The devices encrypt data using the injected derived key. All our devices connect to our server ...
2
votes
1answer
63 views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...
0
votes
1answer
88 views

Is it secure to not expire keys in symmetric encryption?

Note that this question describe hypothetical case, that is never meant to be used in real world. Server communicates with clients with message structure: client_id, initialization_vector, encrypted ...
1
vote
1answer
47 views

Can TPM Storage Keys be Created Outside TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
11
votes
1answer
665 views

Why isn't there a certificate revocation request standard?

Say I am building a Certificate Authority software and I want to automate certificate revocation as much as possible. I know it will not be possible in some cases, like if the building where the ...
2
votes
1answer
29 views

Is it possible re-key OpenVPN on the fly

Is it possible re-key OpenVPN on the fly with a new PSK without killing an restarting it with a new config? it will be started with a PSK but i want to change it soon after start and periodically.
1
vote
0answers
10 views

Checklist for Data Communication Review in ERP Solution

I am looking out for a checklist for data communication review within ERP application. I understand some of the checks would be related to digital signature, TLS/SSL use, Key Life Cycle management ...
1
vote
0answers
31 views

Manual IPsec and session key(s)

I am evaluating IPsec. I have determined it is best for my case to not use AH (will use PSK for authentication). One issue I have is that at the start there will be no connectivity, so IKE will not ...
18
votes
5answers
1k views

Considerations for long-term key storage (paper backup, media for vault storage)?

I'm reviewing our company's security procedures regarding cryptographic keys and master passwords, and also my private system at home. The key generation process is pretty much the same as that ...
2
votes
1answer
24 views

Merge a second OpenPGP key pair into user id of other key

I have OpenPGP key pairs for two of my email addresses. When I created them, I did not know that it was possible to just add another user id to the first key pair. Then I found out it is possible from ...
0
votes
1answer
47 views

Security without TLS certificates

after getting an answer to Security over multi-streaming such as SCTP i have found that i do not have the capacity to give a public key or certificate to the other end securely (to be sure MitM cannot ...
3
votes
1answer
24 views

should ~/.cache/keyring-* be cleared?

I am using gnupg 1.4.15 ls ~/.cache/keyring-* shows many keyring directories. GPG_AGENT_INFO variable is pointing only to the latest one. Should I manually delete all the other keyring agents? Is ...
0
votes
0answers
85 views

Decrypt Private Key

I have a private key together with a certificate in a pem file. The part of the private key starts with: -----BEGIN ENCRYPTED PRIVATE KEY----- I have a passphrase for it. I need to bring it back ...
2
votes
1answer
24 views

Is it okay to omit the 'Version:' line in a PGP public key? [duplicate]

The software I use to generate my PGP keys doesn't include the 'Version:' line that most PGP software includes by default. Almost every public key I've seen begins like this: -----BEGIN PGP PUBLIC ...
4
votes
2answers
225 views

Sharing RSA keys between PGP and SSH protocols: Does this pose a security risk?

If I generate a PGP subkey that only has the authentication capablity and use this to generate an SSH keypair to authenticate Git for example, does this pose a security threat? When I do, should I ...
1
vote
1answer
48 views

How to change personal cipher/digest preferences of existing OpenPGP key in GnuPG?

The OpenPGP key contains a list of personal algorithm preferences (the meaning of the numbers can be decoded in RFC 4880): # gpg -a --export "foo@example.com" | gpg --list-packets | fgrep 'pref-' ...
2
votes
1answer
36 views

Best practice of deprecating old OpenPGP subkeys when migrating to a new subkey pair?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The ...
0
votes
1answer
24 views

Guidelines for time for encryption key regeneration

I am looking at using a third party key distribution protocol. I do not have much details of the internals itself. However I am required to configure the time for regeneration of the (128 bit ...
2
votes
1answer
126 views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
0
votes
2answers
63 views

How hard would it be to scramble crypto keys in memory on command?

I'm looking for a way locate a set of keys in memory on command. Use case would be cold boot attack prevention: a trigger on rack open, scramble the keys in memory followed by shutdown in full disk ...
0
votes
1answer
44 views

Distinguishing between tokens and actual PANs for tokens based on reversible cryptographic functions

I’m researching a possibility of implementing KEK and DEK servers compliant with PCI-DSS requirements. PCI Tokenization Guidelines states: “The tokenization solution should include a mechanism for ...
2
votes
5answers
164 views

Does publishing the md5sum of a private key compromise the private key in any meaningful way?

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an ...
1
vote
0answers
23 views

how IKE (Internet Key Exchange) protocol reacts to the replay attack?

I mean how IKE in any mode (quick,aggressive, main) responds to an attacker that tries to replay one or more messages?
1
vote
1answer
106 views

JSON Web Tokens - How to securely store the key?

I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The concept core of this method is that the server is the only ...
1
vote
1answer
130 views

Is adding apt keys using wget secure?

Many (I would even say most) projects that have Debian repo give instructions like this (https://www.dotdeb.org/instructions/): 3. Fetch and install the GnuPG key wget ...
3
votes
1answer
64 views

PGP Owner Trust Field & Signature Trust Field Distinction

I'm reading Cryptography and Network Security Principles and Practices (5th ed, p584) and reading about PGP keyrings, I'm a little confused about the differences between the owner trust field and the ...
0
votes
2answers
89 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
1
vote
2answers
83 views

Securing communications in decentralized network of servers

Lets consider the following setup: One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and ...
1
vote
2answers
76 views

Encrypting user credentials using AES: how to hide the key

One of my software (an R package) has to save on disk users sensitive information. I encrypt such information using AES encryption using a random key that is generated at the moment of installation ...
74
votes
2answers
5k views

How are private keys kept private?

This may sound like a stupid question but seriously how are private keys kept private? If you're someone like Google you have some huge number of servers to which the public can establish secure ...
2
votes
1answer
111 views

Strategy for encryption before cloud storage

Apologies if this has been asked before. I am looking to encrypt documents before storing in the cloud. There will be a separate metadata storage, which could be either internal or cloud hosted. My ...
33
votes
2answers
5k views

I accidentally published my SSH key passphrase, what to do?

So I mistook input fields and now my SSH key passphrase is visible to the world, and I can't even remove it. Now as far as I understand, this is not an immediate security concern, since the ...
2
votes
1answer
36 views

Digital Certificate Repository Integrity

I am trying to figure out if there is an automatic way to determine if a digital certificate repository has been tampered with. Does anyone know of a way to do so?
5
votes
2answers
182 views

How are symmetric cryptographic keys stored?

If you have a symmetric key which is negotiated via SRP protocol between a mobile device (e.g. smartphone) and a server, what would be a safe way to persist this resulting key on each side? On the ...
1
vote
1answer
52 views

Best practices for encryption from web<-> specific client

If we want to allow sensitive data between a web server and specific client only, is there anything more that can be done besides the following? Note that this is potentially a duplicate of ...
3
votes
1answer
155 views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...
3
votes
2answers
80 views

JKS - Keystore protection and configuration file

It appears that Java Keystore is often used by web server using a configuration file, with the password opening the JKS written in it and also the password protecting the specific entry. How could ...
0
votes
1answer
85 views

Safely encrypting data received through HTTPS

I am receiving sensitive data over an HTTPS connection and need to store this on disk, encrypted so no one can tamper with it, but for reading later on. Each user in the system has a password. The ...
2
votes
1answer
76 views

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs: Stop using 32bit key ids It takes 4 seconds to ...
1
vote
1answer
45 views

User Key pairs and Man-in-the-middle issues

I'm trying to wrap my head around how to exchange user's keys with a server. Maybe during sign-up a JS applet generates a key-pair for the user. These keys would be used for signing subsequent ...
3
votes
1answer
107 views

How to deal with SSH keys in insecure environment

I am trying to find out a "safe" solution for the following situation. tl;dr how to keep things secure in an environment that is absolutely not? I work in a company where workstations are not safe ...
1
vote
1answer
158 views

Is it dangerous to use the same key (RSA) for both encryption (PGP) and authentication (SSH)?

Alice wants to send an encrypted message to Bob, but she also wants to connect to Carol's server. Are there any dangers associated with using the same RSA key for both PGP and SSH (other than a lack ...
1
vote
1answer
47 views

GPG: Detaching Public Subkeys - why can't I do it?

I understand the benefits of using subkeys. I also know that, in the case of private keys it is possible to detach the subkeys from the master key, since there are times when a user may prefer not to ...
2
votes
1answer
48 views

Is android's FDE secure from offline attacks?

Android provides FDE, but it uses lockscreen pin, which is (at least in my case) fairly weak (like a 4-digit PIN). Does it mean that my FDE could be easily broken by offline attack? Or maybe master ...
0
votes
1answer
56 views

Encyption Key Storage and floating point encryption

I am working on a web application where I need to encrypt some fields based on user configuration and display the decrypted information. The field values can be text or integers or floats. We are ...
1
vote
1answer
40 views

How can i store encryption key into Microsoft provided Key container?

I'm working on an application in which user will enter encryption key via GUI and my app will fetch that encryption key. Now i need to store that received key into Microsoft key container. I got this ...
16
votes
4answers
3k views

Is it dangerous to publicly share ciphertext?

Alice wants to share a message with Bob, but Alice and Bob can never be in the same place at the same time. We can assume they both know each others public keys (or agreed on a shared key, if that ...
0
votes
1answer
115 views

What are the best practices to store payment processor dev/API keys?

I am integrating with multiple payment processors which have their set of public/private keys. This would be used in conjuction with per user keys, to bill clients. I was wondering what is the best ...
5
votes
2answers
93 views

Why don't PGP keyservers enforce double-opt-in?

One thing that I found out when starting using PGP: When I uploaded my keys to the SKS keyserver, the keyserver did not take any action to verify that I am who I claim to be. Since a PGP key contains ...
2
votes
0answers
79 views

How is Tresorit client-side encryption key stored and managed?

I am using Tresorit on Mac OS X and iPhone. When I am using it there is always applied client-side encryption before posting the file to cloud. The key used for encryption is AES-256 and CFB mode of ...