Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
117
votes
7answers
6k views
How do certification authorities store their private root keys?
Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
72
votes
3answers
44k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
28
votes
6answers
9k views
How should I distribute my public key?
I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
25
votes
4answers
5k views
How can PrivateSky not see your data?
PrivateSky is a website that promises encrypted "cloud-like" secure information exchange. They promise that except the sender and receiver, nobody can see your data. After testing it yesterday, I do ...
23
votes
6answers
1k views
Is using a public-key for logging in to SSH any better than saving a password?
Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
20
votes
7answers
1k views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
20
votes
5answers
2k views
PCI Encryption Key Management
(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously).
I currently ...
19
votes
2answers
3k views
Web Application encryption key management
In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions:
...
17
votes
3answers
2k views
What useful things can I do with the html5 “keygen” element?
There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari.
Here's what it looks like:
<form action="processkey.cgi" method="post" ...
13
votes
3answers
1k views
What are the chances to generate the same ssh key?
I could generate ssh keys on the client like (without password):
ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v
and copy the generated id_rsa.pub to the server:
ssh-copy-id -i ...
13
votes
2answers
1k views
How secure is Keychain on OS X?
Keychain is a built-in app on OS X that stores all of the user credentials, and allows for one to keep encrypted notes in an easily accessible way.
Does anyone know how secure Keychain is? I know ...
12
votes
6answers
624 views
How can the impact of cold boot attacks be minimized?
Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
12
votes
4answers
783 views
Is Steganography considered encryption and subject to USA export restrictions?
I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
11
votes
2answers
1k views
What's wrong with storing private keys in the cloud?
I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
11
votes
4answers
1k views
Security of passphrase-protected private key
If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
10
votes
6answers
765 views
Shouldn't GPG key fetching use a secure connection?
If I run this for example:
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451
then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) ...
10
votes
2answers
1k views
What vulnerabilities could be caused by a wildcard SSL cert?
In a comment on this answer, AviD says:
"There are numerous security issues with wildcard SSL certs."
So, what are the problems? I understand that the same private key is being used in multiple ...
10
votes
3answers
739 views
What's the common pragmatic strategy for managing key pairs?
I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH.
Originally when I learned about PKI, I created a single ...
10
votes
2answers
981 views
GnuPG/OpenPGP Key Practices
I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to ...
10
votes
3answers
574 views
Key management in cloud datacenters
In terms of infrastructure, how do Cloud providers (organizations providing SaaS, PaaS, or IaaS via the cloud) manage keys and cryptography?
From my understanding, "private" datacenters tend to ...
9
votes
4answers
2k views
Does symmetric encryption provide data integrity?
Let's say I have one server that encrypts a file with a symmetric key, e.g. AES-CBC, and sends it to clients that decrypt it. Does that provide data integrity when decrypted? Or is it possible for ...
9
votes
5answers
1k views
Storing private asymmetric key in application binary?
I would like to give a daemon-style process (i.e. no user interaction) access to a shared secret key so that it can access a shared, encrypted data file. User applications accessing the same encrypted ...
9
votes
5answers
1k views
Use RSA keypair for PGP encryption and decryption
Is there a way that I can use a RSA keypair with PGP?
What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
9
votes
2answers
3k views
where to store a key for encryption
I am looking for a way to store a key used for password encryption. I am using a mysql db which would store a user name and an encrypted password that would be encrypted using ...
9
votes
3answers
3k views
Encrypting with Mongo
How can I achieve the following goals?
All compute and storage to be located in the cloud.
Encryption in transit of all data between web nodes and db nodes running MongoDB.
How to set up tunnels? ...
8
votes
5answers
338 views
What can one do when encryption methods fail?
I'm in search of an expert to answer my curiosity. Suppose that methods like AES/DES, SSH, PGP, RSA, etc. can be cracked or fail somehow. In other words, suppose that it's possible to determine one ...
8
votes
3answers
1k views
What common products use Public-key cryptography?
I want know what common use products are there that use public key/private key cryptography?
8
votes
5answers
7k views
Compute the AES-encryption key given the plaintext and its ciphertext?
I'm tasked with creating database tables in Oracle which contain encrypted
strings (i.e., the columns are RAW). The strings are encrypted by the application
(using AES, 128-bit key) and stored in ...
8
votes
3answers
25k views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
8
votes
2answers
1k views
8
votes
3answers
741 views
Security implications of storing the password hash along an encrypted AES key
I am using the PKCS#5 standard to generate a key using a random and unique salt and the user's password in input. Consider this key as the "encryption" key.
The "encryption" key is used to encrypt a ...
8
votes
2answers
278 views
Key management scheme in PHP that is compliant with NIST SP 800-57
We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management
I wonder if there're any open-source or commercial PHP solutions ...
7
votes
2answers
1k views
Using RSA with 3DES instead of plain 3DES. Does it make sense?
I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And ...
7
votes
3answers
407 views
Server to server encryption: Key rotation over the air. Can it improve security?
In my other question, I explored whether to write my own encryption or use an existing one. I was advised to use TLS or AES or something that is established.
This question is about key rotation. It ...
7
votes
3answers
402 views
Database Encryption Security
I am encrypting and decrypting my database data from my web applications API. If my web server is compromised, what is to keep someone from using that same method to retrieve the data?
For example, ...
7
votes
3answers
1k views
Additional security of keyfile on top of a master password for KeePass
I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model.
However my biggest remaining concern is the ...
7
votes
3answers
294 views
AES using derived keys / IVs. Does it introduce a weakness?
I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application.
Obviously in order to re-use this key, a unique ...
7
votes
2answers
1k views
Data Encryption and Key Management in C#
Which route to take, what are the pros and cons, which is more secure..
Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
7
votes
2answers
2k views
Best Practice: “One per-user ssh key” or “multiple per-host ssh keys” [duplicate]
Possible Duplicate:
What’s the common pragmatic strategy for managing key pairs?
I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when ...
6
votes
2answers
465 views
What happens if two parties have a same pair of public&private keys
we know that we have to create Private key on server and generate its public key and create a certificate.
But what if we get a private key which someone already has. Isn't the security becomes weak ...
6
votes
3answers
1k views
How can I convert my encypted PGP secret key for use performing SSH authentication?
I wish to covert my PGP key (RSA) to be used performing SSH authentication. After some searching, I found openpgp2ssh, which appears to be an appropriate tool. Everything works swimmingly for my ...
6
votes
4answers
563 views
can ssh passwordless public key authentication be ok if combined with a VPN?
Having a debate with a coworker about the merits & faults of public key authentication with ssh.
I'm basically wondering what all the possible merits and faults are, especially in regards to ...
6
votes
5answers
3k views
What does “key with length of x bits” mean?
I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
6
votes
1answer
244 views
Is it secure to transfer an RSA public key by email?
I've set up my VPS'ssh server to accept only key-based identification: I disabled password-based connection.
As a consequence I am connecting from home with an RSA key generated prior to password ...
6
votes
1answer
1k views
Is SSL key generation client-side, server-side, or both?
Who generates the session keys for a SSL symmetric encryption? Is it the client for both client and server where client generates part of it while the server generates the other part?
6
votes
6answers
275 views
Is leaking the hash of your encryption key a security risk?
I've been trying to design a simple archive format, that allows me to just bundle a bunch of encrypted files together.
The idea, I currently have is to embed not the encryption key but a truncated ...
6
votes
1answer
2k views
How can I enumerate all the saved RSA keys in the Microsoft CSP?
I have an application that is creating several keys and storing them in various stores (in this case the Machine store).
How can I enumerate all the keys on a given Windows system?
...
6
votes
3answers
520 views
What are the pros and cons of outsourcing an organization's PKI?
I am looking for the pros and cons of outsourcing an organization's Public Key Infrastructure (PKI). I understand that the answer to whether or not to actually outsource is going to depend on the ...
6
votes
1answer
524 views
Public key length
I was wondering if there was (and I hope there is) a standard for public key size for ECDH (Elliptic Curve Diffie-Hellman) and ECDSA (Elliptic Curve Digital Signature Algorithm) for every curve type ...
6
votes
1answer
70 views
What is the best way to manage package signing keys?
I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment.
I have initially created a signing ...
