Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

-2
votes
0answers
25 views

Assignment on two factor key authentication in cloud system [on hold]

I am doing a assignment on two factor key authentication in cloud system. but I could not find any white papers related to this. Its grateful if you can provide some notes or sources related to this ...
-1
votes
0answers
25 views

HSM: creating new key using NCryptoki [on hold]

I'm working with the NCryptoki dll (http://www.ncryptoki.com/) I'm new to this dll and I'm trying to do some stuff. Now I'm trying to create a new DES CBC key. I have write this, but it is giving me ...
0
votes
1answer
27 views

Single vs server specific ssh keys?

This question has a bit to do with procedure. Is it better for a person to have one single ssh key pair and share the public key where needed. Alternatively is it better to have server specific keys? ...
0
votes
0answers
13 views

Why do PGP Keys have expiration dates? [duplicate]

I read a tutorial to get started with PGP and so far I understand the importance and the difference between encryption, decryption, signing, and verifying. However, I don't understand why a key has ...
1
vote
0answers
19 views

Using ssh key for connection but without -i option [migrated]

I am working with serverals hosts and I do not want specify the password every time that I want to connect to any hosts. Then I have generated a key with: Enter file in which to save the key ...
4
votes
1answer
65 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
2
votes
1answer
97 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of ...
-1
votes
4answers
82 views

Can I “hide” the private key, while still allowing it to be used?

Let's say you assign SSH keypairs to all users on your system; none of these "low trust" users have root privileges. You want the users to be able to use their keys in SSH connections, however, you ...
3
votes
3answers
90 views

Best practices to copy private keys to mobile devices

I would like to copy an ssh key to my Android phone. However, I have displaced the connection cable for my computer. I am looking for a safe way to transfer the key to the device. Obviously, I don't ...
1
vote
3answers
62 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
3
votes
3answers
133 views

Safe storage service for private keys

Is it currently technically (as opposed to financially) possible to provide a fairly secure means of providing a storage facility for private keys, not excluding physical verification etc? As in, you ...
0
votes
0answers
45 views

How should I organize my keys?

Suppose I have a set of computers with variegate level of trust (for example): I fully trust my own desktop pc at home I trust a bit also my smartphone, but I know it could be stolen I trust a bit ...
1
vote
1answer
150 views

Protecting decryption key on server

What is the most suitable way to encrypt and decrypt sensitive data on a public cloud server disk without storing the decryption key on the server in plaintext? REQUIREMENTS In our SaaS web/mobile ...
0
votes
1answer
50 views

How are Cloud based HSMs used for Encryption by an application that is on premise (behind the enterprise firewall)?

Amazon CloudHSM (It is Safenet in the backend), Safenet Luna HSM SaaS version and other cloud HSM providers provide Key Management and encryption services on device in the cloud. From my research, I ...
2
votes
1answer
151 views

How does firefox sync password recovery work?

According to Mozilla Sync-new-security-model, Firefox servers are not able to decrypt your sync data without your password. So I figured that, the browser generates a key from your password, encrypts ...
1
vote
1answer
121 views

Secure private key storage

In light of BadUSB, storing private keys on a USB flash drive is not the best way. What about writing private keys to a CD? What I am worried about is whenever I plug my private key storage device ...
3
votes
2answers
201 views

How Securely Store Sensitive Data on Mobile Appliation

i want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a ...
3
votes
1answer
59 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
2
votes
0answers
86 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
1
vote
1answer
91 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
0
votes
2answers
94 views

Key Management/storage system

In my firm we have a couple of thousand hardware devices, installed externally, that all send back data to a central server. They send back data about every hour. Each of these hardware devices ...
4
votes
2answers
261 views

Continued Use of Kerberos

I posted this question over on Crypto.SE, but didn't get any takers and thought it might be more suited for this site as it were, so I'm cross posting it here. I was recently looking through the Mac ...
1
vote
0answers
29 views

Clear EFS Cache at Set Interval

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so ...
6
votes
1answer
240 views

Why should I persist OAuth 2 access tokens along with refresh token

That's something I've came across in a couple articles about OAuth 2: when it comes to persisting refresh tokens to database some authors prefer to store access token as well, or at least mention it ...
2
votes
2answers
85 views

Distributing public keys; with or without a sub-key?

Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does ...
0
votes
2answers
115 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
7
votes
1answer
614 views

Passing secret keys securely to docker containers

I want to pass a secret value needed by an app that runs in a Docker container. This particular container is short-lived -- it starts up, runs a command, and then terminates. Method 1: Pass the ...
2
votes
1answer
49 views

SSH key passphrase update and multiply locations

I have a ssh key which I use to upload code to github. the private key is located on several locations from where I upload/download data. I wonder how can I update (or expire) old keys after I update ...
1
vote
1answer
76 views

What are the risks of protecting an API with one key only (without secret)?

I understand that a lot of APIs are protected using a (possibly public) API Key, to identify who is making the request, and a secret to hmac the parameters and determine if the client is actually who ...
1
vote
0answers
49 views

NISTIR 7966 (Security of Automated Access Management Using Secure Shell) - is there anything new?

Tatu Ylönen (the creator of SSH protocol) and two others authored a report recently, offering their views on SSH key management. I have read the report, and am struggling to identify whether it is ...
2
votes
1answer
208 views

Is knowing the decrypted and encrypted data enough to find the key?

Let's say an attacker knows the encrypted content, the decrypted content and the algorithm used: can he get the key that was used to encrypt the content or does it make it easier to find the key out? ...
3
votes
1answer
90 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized ...
2
votes
2answers
157 views

Does a self-signed certificate offer more protection than a public key?

I'm having a hard time finding the practical benefits of transmitting a self-signed certificate over simply a public key. I understand that a self-signed certificate proves the integrity of the public ...
2
votes
1answer
94 views

Is it necessary to remove the primary secret GPG key from your laptop if it has full-disk encryption?

According to a number of articles, e.g. "Creating the Perfect GPG Keypair," it is advisable to have a number of subkeys in your GPG key, one for encryption, and one for signing, and then to (a) back ...
2
votes
2answers
88 views

How to properly transition from standard PGP keys to using subkeys?

When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like ...
1
vote
0answers
42 views

AWS IAM User vs STS

I'm trying to better understand the potential of AWS Secure Token Service, and looking for thoughts on how best to solve a particular problem. Let's say I have a bunch of IAM users that are currently ...
2
votes
3answers
129 views

AES Key Management / How To Swap Encryption Key

I'm currently using AES 256 for the encryption of my web application and the security policy context specifies that the encryption key must be replaced once every few months. When that happens what ...
1
vote
0answers
78 views

Using SSH Private keys in Production environment

I have a need to scp a bunch of files from a production box to my development environment. I am a developer and have limited read access to the production machines. Instead of entering password for ...
-1
votes
2answers
134 views

How to securely store users' private keys? [closed]

I'm building an application that needs to store a public/private key pair generated by the user. What's the best way to do this? Encrypt the private key in the db with some application-generated ...
3
votes
1answer
95 views

Why use “App Secret” in mobile applications?

I see some SaaS require to import "App Secret" into your application also with "Application Key". I understand the "Applicaton Key", but can not understand the "App Secret". Here is why: I can ...
1
vote
1answer
128 views

GnuPG / OpenPGP: How to eliminate redundancy in PGP private key?

I examined a few randomly generated private keys generated by Gnu PG, and found a lot of redundancy. It is enclosed by -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY BLOCK----- ...
1
vote
1answer
52 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
4
votes
1answer
73 views

How long do keys stay on keyservers?

Do GPG/PGP keyservers "garbage collect" old keys which have expired, been revoked, or simply haven't been updated in a decade? Or does the server (theoretically) keep every key it has ever seen from ...
0
votes
1answer
30 views

Key Extraction via electrical signal processing

Looking for a link to what I believe was recent research that was similar to "RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis" - but instead of being based on acoustic emanations, the ...
0
votes
2answers
64 views

Public Key Transfer between two Applications

I have a Service written in c# which uses asymmetric Encryption to Encrypt Data, and a client application which Decrypts the Encrypted data received from the service. How can I do the following ...
2
votes
3answers
112 views

Best practices for HSM's used by test and production systems

Should a test/demo/non-prod system be prohibited from using the same HSM as production? Since the same master key would be used for both test and prod it seems like it could raise eyebrows but I can't ...
0
votes
0answers
65 views

Expiration / enforce change of passphrase for private ssh keys

Out of curiosity, and also to check whether this is doable at all: Is there any way using standard tools to assign an expiry date [only] to the passphrase of an ssh private key, or to enforce the ...
0
votes
2answers
65 views

Can I generate multiple PGP key pairs for later use

I was just wondering if I can generate couple of PGP key pairs and save them for later use or backup. In addition can I be sure that other wont generate and use some of my key pairs in the meantime. I ...
3
votes
2answers
39 views

Preventing/Detecting forgery of logs generated in a potentially hostile environment

I have an application that runs on some host machine and generates logs. Later in the day those logs are securely transmitted to my machine. The problem is that while the logs are being generated I ...
2
votes
2answers
48 views

Can the GPG master secret key be stored as read-only?

Once you have generated your master PGP key, will the "data" in the private key ever change? For instance, if you add another subkey, uid, or any other data to the master key, do these changes need ...