Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
3
votes
2answers
31 views
Change 'Key Usage' of a certificate
Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
6
votes
2answers
74 views
Backup schedule for Encryption Keys
How often should encryption keys be backed up?
Should this be done on the same schedule as the encrypted content/configuration? That seems excessive, as the keys do not change as often.
Perhaps ...
5
votes
3answers
87 views
Does IPSec use IKE or ISAKMP?
Does the IPSec protocol suite use IKE or ISAKMP?
RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol ...
0
votes
1answer
54 views
PCI 3.6.6 cryptographic key procedures include split knowledge
My question is, if you run your own company and there are no employees and you still qualify under assessment D what do you do in a case like this where it is requiring 2 or more people? On a related ...
4
votes
1answer
124 views
Truecrypt - One keyfile multiple passwords
Is it possible to create one keyfile that opens a Truecrypt volume and this keyfile is protected (aes encryption fe) with a password?
The use case is a True crypt volume accessed by multiple ...
3
votes
3answers
152 views
How to secure SSH such that multiple users can log in to one account?
Consider a generic up-to-date Linux distro hosting a web server. I need three humans to occasionally SSH into the same user account to perform some action that can only be done by that particular user ...
6
votes
6answers
275 views
Is leaking the hash of your encryption key a security risk?
I've been trying to design a simple archive format, that allows me to just bundle a bunch of encrypted files together.
The idea, I currently have is to embed not the encryption key but a truncated ...
3
votes
1answer
82 views
Distributing API Keys to Mobile Apps
I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs ...
0
votes
3answers
207 views
Brute forcing ssh keys
My problem is a common one: I deleted my SSH key, and forgot to set rm to point to a .trash file. I have the public key, and I need to get in this server. I am not doing this on anyone else's server. ...
4
votes
0answers
177 views
Migrating GPG master keys as subkeys to new master key
Currently I have 3 private GPG pairs which are all master keys.
I want to convert these keys into subkeys for a new key pair (and keep that in the vault).
I have read the following thread ...
2
votes
4answers
258 views
Why do APIs use API Keys instead of Usernames?
It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
1
vote
1answer
129 views
Exchange of DEK and KEK (encryption keys) between app server and key server
In my application, it is required to encrypt a user's data before inserting it into the mysql database. I am using AES algorithm to encrypt the data using a 256 bit hash (and is calling it Data ...
0
votes
2answers
183 views
Where do I securely store application-specific symmetric key?
I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere.
From a similar ...
2
votes
1answer
198 views
What is the best practice for storing a secret on the cloud?
This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
3
votes
1answer
122 views
Symmetric key management
I am currently employing GNU Crypto in Java and I am now deciding on the best way to store the keys.
The question Storage of 'secrets', keystores, HSMs and the rest has led me to believe the ...
1
vote
1answer
65 views
How to have Thunderbird include a root certificate?
An eMail signed via S/MIME also contains the X.509 certificate chain containing the public key in order to directly verify the signature (assuming its issuing CA is deemed trustworthy). The chain does ...
0
votes
1answer
100 views
What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?
Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange?
Can the server be configured to use weak key sizes for ...
6
votes
1answer
283 views
Encrypting sensitive data in software and storing/decrypting it on a server
I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing.
I'm developing software which has 2 parts - a C# program run ...
1
vote
1answer
75 views
How to change (sub)key usage of a PGP key?
gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...
3
votes
2answers
157 views
What is a good general purpose GnuPG key setup?
Since most key types can be used for multiple purposes, namely certification, authentication, encryption and signatures, one could simply use one key for everything - which is a bad idea, as ...
6
votes
1answer
240 views
Is it secure to transfer an RSA public key by email?
I've set up my VPS'ssh server to accept only key-based identification: I disabled password-based connection.
As a consequence I am connecting from home with an RSA key generated prior to password ...
0
votes
1answer
93 views
Key distribution advice
I have been thinking for days about that problem! The application is based on a student system management. I am implementing database encryption on a column level and The encryption occurs at the ...
-1
votes
1answer
146 views
GPG advantages / disadvantages, is it useful or secure? [closed]
I thinking about GPG, is very widely used, but is secure? Why and where we using GPG?
I found an article from 2002, but is very old.
2
votes
1answer
302 views
Where to store Java keystore password?
We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
0
votes
3answers
263 views
How to store a private RSA key for an application?
I was wondering how an application that have a private key will keep it secure?
If the private key is outside the binary, then anybody can access it, but store it in the binary doesn't make it more ...
0
votes
3answers
86 views
Implement server serial key for server software
Me and my friend want to sell game server-side software, but we want some sort of control, over use of that software.
For example, we want some sort of serial key system, so only verified/paid ...
2
votes
2answers
208 views
Encrypt+Signing data: PKCS#7 / CMS or do-it-your-own way?
Currently I'm saving an array of AES keys into a keychain as JSON, saved as a text file / SQL text column:
{
[
{
encryptedAesKey:RsaEncryptedBytesBase64Encoded==,
...
3
votes
2answers
214 views
How many GPG keys should I make?
I am learning how to use GPG keys, and I am wondering what is the threshold people generally use to maintain separate GPG keys. Maintaining an incredibly large number of keys is not good since it ...
1
vote
1answer
176 views
AES128 and IV for app crypto
We have some columns in some tables that are sensitive and would like to protect them "anyways". Also, since Azure SQL demands application level encryption, we have to roll our own. There would be a ...
1
vote
4answers
301 views
SSH: reusing public keys and known-man-in-the-middle
Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key):
Best Practice: “One per-user ssh key” or ...
3
votes
4answers
163 views
Using dynamic keys
It is intuitively clear that, the less materials a cryptanalyst has available to work on, the lower would be his chance of success. This implies that the security of encryption of a message could be ...
1
vote
1answer
97 views
Passing generated keys to another process
I am doing a project in which one process generates a key using a distributed algorithm. I need to pass this key to the calling process or procedure. Generally speaking, one can do this in the ...
20
votes
7answers
1k views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
1
vote
2answers
89 views
How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)
I have a newer private key I have to import into an older server.
How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
3
votes
5answers
386 views
How can I explain the concept of public and private keys without technical jargon? [duplicate]
Possible Duplicate:
Principle of asymmetric algorithm in plain english
In the spirit of How can I explain SQL injection without technical jargon?, do you have any suggestions on how to ...
0
votes
1answer
141 views
Password protection of encryption and signature keys
I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code)
The basic ...
3
votes
1answer
101 views
Key Management for PCI and Payment automation
We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
8
votes
2answers
278 views
Key management scheme in PHP that is compliant with NIST SP 800-57
We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management
I wonder if there're any open-source or commercial PHP solutions ...
4
votes
1answer
823 views
Encrypting data for Android mobile app
I am creating a mobile app for Android. This is my first mobile app by the way.
I have decided to store data used in my app in a SQLite database in the target Android device.
The data I am storing ...
117
votes
7answers
6k views
How do certification authorities store their private root keys?
Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
1
vote
3answers
140 views
Validate hmac with hashed stored key
What if an HMAC is correctly generated and sent with the data to the server, so far I know the server needs to know the original data with which the MAC was created in order to re-create the MAC and ...
0
votes
2answers
183 views
In depth security: splitting key in different places
I use AES encryption on a website. At the moment, the key is stored in the source of the PHP script that does the encryption/decryption process thanks to openssl.
I know that it isn't secure, so I ...
7
votes
3answers
290 views
AES using derived keys / IVs. Does it introduce a weakness?
I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application.
Obviously in order to re-use this key, a unique ...
6
votes
1answer
70 views
What is the best way to manage package signing keys?
I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment.
I have initially created a signing ...
4
votes
1answer
238 views
Help understanding PCI-DSS when using password based encryption from automatically generated keys
I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS.
We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the ...
2
votes
1answer
105 views
Security of re-encryption with a list of pre-computed password based keys
I have a problem where an encrypted file stored on a server needs to be decrypted through a precomputed list of passwords that are used one time only - OTP applied to encryption basically. The file is ...
2
votes
1answer
123 views
What dangers are there in storing my private key on different servers?
This question is specifically concerned with storing keys in the cloud, and is somewhat applicable.
But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and ...
1
vote
1answer
226 views
How to protect encryption key while application is using it
I made an J2SE application that uses AES (in CBC mode using BouncyCastle library) to encrypt application config file & some user provided files.
I stored the raw AES key in a file that is ...
0
votes
3answers
258 views
Are there flaws in this simple key exchange?
I'm reviewing for a computer security exam. Here is a simple scenario:
Suppose that someone suggests the following way to confirm that the two of you are both in possession of the same secret key. ...
4
votes
1answer
176 views
Storing License Keys
I'm creating an application which generates licenses key and stores this in a database (the licenses are checked on-line). I don't wish to store these license unhashed - in case the database is ...
