Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

0
votes
1answer
23 views

Best practices for encryption from web<-> specific client

If we want to allow sensitive data between a web server and specific client only, is there anything more that can be done besides the following? Note that this is potentially a duplicate of ...
2
votes
1answer
55 views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...
1
vote
0answers
16 views

JKS - Keystore protection and configuration file

It appears that Java Keystore is often used by web server using a configuration file, with the password opening the JKS written in it and also the password protecting the specific entry. How could ...
0
votes
1answer
75 views

Safely encrypting data received through HTTPS

I am receiving sensitive data over an HTTPS connection and need to store this on disk, encrypted so no one can tamper with it, but for reading later on. Each user in the system has a password. The ...
3
votes
1answer
26 views

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs: Stop using 32bit key ids It takes 4 seconds to ...
1
vote
1answer
33 views

User Key pairs and Man-in-the-middle issues

I'm trying to wrap my head around how to exchange user's keys with a server. Maybe during sign-up a JS applet generates a key-pair for the user. These keys would be used for signing subsequent ...
3
votes
1answer
72 views

How to deal with SSH keys in insecure environment

I am trying to find out a "safe" solution for the following situation. tl;dr how to keep things secure in an environment that is absolutely not? I work in a company where workstations are not safe ...
0
votes
0answers
45 views

Is it dangerous to use the same key (RSA) for both encryption (PGP) and authentication (SSH)?

Alice wants to send an encrypted message to Bob, but she also wants to connect to Carol's server. Are there any dangers associated with using the same RSA key for both PGP and SSH (other than a lack ...
1
vote
1answer
20 views

GPG: Detaching Public Subkeys - why can't I do it?

I understand the benefits of using subkeys. I also know that, in the case of private keys it is possible to detach the subkeys from the master key, since there are times when a user may prefer not to ...
2
votes
1answer
22 views

Is android's FDE secure from offline attacks?

Android provides FDE, but it uses lockscreen pin, which is (at least in my case) fairly weak (like a 4-digit PIN). Does it mean that my FDE could be easily broken by offline attack? Or maybe master ...
0
votes
1answer
33 views

Encyption Key Storage and floating point encryption

I am working on a web application where I need to encrypt some fields based on user configuration and display the decrypted information. The field values can be text or integers or floats. We are ...
1
vote
1answer
20 views

How can i store encryption key into Microsoft provided Key container?

I'm working on an application in which user will enter encryption key via GUI and my app will fetch that encryption key. Now i need to store that received key into Microsoft key container. I got this ...
16
votes
4answers
3k views

Is it dangerous to publicly share ciphertext?

Alice wants to share a message with Bob, but Alice and Bob can never be in the same place at the same time. We can assume they both know each others public keys (or agreed on a shared key, if that ...
0
votes
1answer
67 views

What are the best practices to store payment processor dev/API keys?

I am integrating with multiple payment processors which have their set of public/private keys. This would be used in conjuction with per user keys, to bill clients. I was wondering what is the best ...
5
votes
2answers
68 views

Why don't PGP keyservers enforce double-opt-in?

One thing that I found out when starting using PGP: When I uploaded my keys to the SKS keyserver, the keyserver did not take any action to verify that I am who I claim to be. Since a PGP key contains ...
1
vote
0answers
22 views

How is Tresorit client-side encryption key stored and managed?

I am using Tresorit on Mac OS X and iPhone. When I am using it there is always applied client-side encryption before posting the file to cloud. The key used for encryption is AES-256 and CFB mode of ...
1
vote
0answers
20 views

CCM instead of key wrap

Is there any instance of NIST or other encryption standards using AES-CCM to encrypt/authenticate key data? I would like to use CCM over a keywrap function, but cannot find any precedent for this in ...
1
vote
0answers
15 views

Two keys in ~/.ssh directory [migrated]

I originally had a DSA public key in my ~/.ssh directory on my server id_dsa.pub. The corresponding private key id_dsa is stored on my local machine. I then generated an RSA key pair directly inside ...
1
vote
1answer
47 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strenght ? (PBKDF2 as both ...
0
votes
0answers
27 views

Distribution of key by server

I have read that in asymmetric cryptography, a system admin can generate key pairs on the server. After that, the users will be given the generated key pairs and this is an efficient way of doing this ...
1
vote
1answer
53 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
1
vote
2answers
54 views

Management of server keys

I plan to put an SSH server on micro-controller devices. There shall be many devices distributed in a wide range. The identity of the server is checked with the server key. The server needs to store ...
0
votes
1answer
32 views

PKCS#12 File - security impacts when imported in Web Browser or Windows Store?

When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password. How does the browser or operating system manage this password? Is it secure?
-3
votes
1answer
73 views

AES 256 bit key to plaintext conversion? [closed]

I'm a little rusty on cryptography, but I have successfully acquired a 256 bit key that is used for encryption and I want to know if it is possible to reverse it into its corresponding plain text ...
1
vote
1answer
42 views

Bus smart ticketing systems and EMV

I have recently started to study the smart ticketing systems. Most of the modern systems support the use of EMVCo standards for buying tickets in the bus. Also, in each bus usually there are more than ...
1
vote
1answer
41 views

Any way to revoke old key pair?

There is a many-year-old 1024 DSA key in the public keyservers under my name. There is a 2048 ELG-E subkey for it. I didn't create these keys, they were created for me by a former employer without my ...
0
votes
1answer
26 views

JKS is readable without providing a password

I'm at that stage in application development where I'm forced to tinker with openssl and keytool again. I was surprised to find that I could list and export certs from a JKS key store without ...
0
votes
1answer
39 views

Single vs server specific ssh keys?

This question has a bit to do with procedure. Is it better for a person to have one single ssh key pair and share the public key where needed. Alternatively is it better to have server specific keys? ...
0
votes
0answers
14 views

Why do PGP Keys have expiration dates? [duplicate]

I read a tutorial to get started with PGP and so far I understand the importance and the difference between encryption, decryption, signing, and verifying. However, I don't understand why a key has ...
4
votes
2answers
106 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
4
votes
1answer
122 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of ...
-1
votes
4answers
107 views

Can I “hide” the private key, while still allowing it to be used?

Let's say you assign SSH keypairs to all users on your system; none of these "low trust" users have root privileges. You want the users to be able to use their keys in SSH connections, however, you ...
3
votes
3answers
112 views

Best practices to copy private keys to mobile devices

I would like to copy an ssh key to my Android phone. However, I have displaced the connection cable for my computer. I am looking for a safe way to transfer the key to the device. Obviously, I don't ...
1
vote
3answers
81 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
3
votes
3answers
168 views

Safe storage service for private keys

Is it currently technically (as opposed to financially) possible to provide a fairly secure means of providing a storage facility for private keys, not excluding physical verification etc? As in, you ...
0
votes
0answers
55 views

How should I organize my keys?

Suppose I have a set of computers with variegate level of trust (for example): I fully trust my own desktop pc at home I trust a bit also my smartphone, but I know it could be stolen I trust a bit ...
1
vote
1answer
235 views

Protecting decryption key on server

What is the most suitable way to encrypt and decrypt sensitive data on a public cloud server disk without storing the decryption key on the server in plaintext? REQUIREMENTS In our SaaS web/mobile ...
0
votes
1answer
76 views

How are Cloud based HSMs used for Encryption by an application that is on premise (behind the enterprise firewall)?

Amazon CloudHSM (It is Safenet in the backend), Safenet Luna HSM SaaS version and other cloud HSM providers provide Key Management and encryption services on device in the cloud. From my research, I ...
3
votes
1answer
298 views

How does firefox sync password recovery work?

According to Mozilla Sync-new-security-model, Firefox servers are not able to decrypt your sync data without your password. So I figured that, the browser generates a key from your password, encrypts ...
1
vote
1answer
304 views

Secure private key storage

In light of BadUSB, storing private keys on a USB flash drive is not the best way. What about writing private keys to a CD? What I am worried about is whenever I plug my private key storage device ...
3
votes
2answers
288 views

How Securely Store Sensitive Data on Mobile Appliation

i want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a ...
5
votes
1answer
72 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
2
votes
0answers
96 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
1
vote
1answer
113 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
0
votes
2answers
108 views

Key Management/storage system

In my firm we have a couple of thousand hardware devices, installed externally, that all send back data to a central server. They send back data about every hour. Each of these hardware devices ...
4
votes
2answers
289 views

Continued Use of Kerberos

I posted this question over on Crypto.SE, but didn't get any takers and thought it might be more suited for this site as it were, so I'm cross posting it here. I was recently looking through the Mac ...
1
vote
0answers
46 views

Clear EFS Cache at Set Interval

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so ...
6
votes
1answer
381 views

Why should I persist OAuth 2 access tokens along with refresh token

That's something I've came across in a couple articles about OAuth 2: when it comes to persisting refresh tokens to database some authors prefer to store access token as well, or at least mention it ...
2
votes
2answers
100 views

Distributing public keys; with or without a sub-key?

Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does ...
0
votes
2answers
136 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...