Tagged Questions

Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

1
vote
2answers
246 views

Storing SSH private keys on an Android device

(I'm not sure if this better belongs on unix.se or android.se, but since it's primarily security-related, I'm asking it here) I use my Android device to access servers for quick on-the-go ...
1
vote
1answer
139 views

How are private keys (sMIME, PGP, etc) synchronized across a user's devices?

Given that user needs to store a copy of the same private key on each of his devices (in order to decrypt email and other data encrypted with the public key) ... what are some general techniques for ...
4
votes
1answer
87 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
1
vote
2answers
176 views

Where to store a key for system wide encryption/decryption?

I have a web application where (among other things) customers can upload files and administrators can then download those files. The uploaded files are stored on ServerA and the web application used ...
3
votes
1answer
68 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
2
votes
6answers
2k views

How are ProtonMail keys distributed?

There is a service called ProtonMail. It encrypts email on the client side, stores encrypted message on their servers, and then the recipient decrypts it, also on the client side and the system ...
4
votes
4answers
76 views

Proof that client app is using the recipient's public encryption key

I'm trying to implement a web app(lication), which allows to share data automatically with connected users. Data will be encrypted end-to-end asymmetrically on the clients. My first plan was to share ...
0
votes
2answers
96 views

Security Modules - Hardware vs. Software

In terms of PCI requirements and compliance, is a software-based key management module like Gazzang zTrustee an acceptable solution to the PCI requirements that a (hardware) HSM solution like AWS ...
1
vote
0answers
106 views

SSH using pre-existing session (symmetric) keys

Is there at present a way to open a SSH connection using pre-existing symmetric session keys? In other words, if I create a list of symmetric keys can I send that list to the recipient on a CD or USB ...
3
votes
2answers
393 views

Storing the master key in the app server binary

Imagine you have a master key to encrypt/decrypt the data saved in your database of your app service. What is the risk of having this key embedded in your app service code to store this key in the app ...
5
votes
3answers
246 views

Is it a bad idea to share the ssh host key in a diskless environment?

I am looking at this cluster of student work stations. They are diskless clients which boot from NFS. They also have sshd enabled. All of these machines share the same ssh host key (rsa,dsa,etc), ...
1
vote
1answer
62 views

How to validate the confirmation link received when publishing a new PGP key?

I find PGP to be quite a complex subject. I have gotten to a point where I need to give a client a public key for encryption. I have successfully done my homework, generating a public key from my ...
4
votes
1answer
146 views

GPG master key without email address

I would like to create a new GPG key. Going through a couple of thread it seems like the most popular scheme for maximum security is to have an offsite master (sign-only) key which provides a shell ...
0
votes
1answer
124 views

Multi user symmetric key encryption

I realize SIMILAR questions have been asked before but I'm looking for certain specifics I can't seem to find elsewhere. The following question closely resembles mine but falls short for me on ...
0
votes
0answers
42 views

Key Distribution using multicast

I am trying to come up with a solution for a system where i need to generate a key (Kn) from time to time and distribute it to a large number of servers in a private network. Since it has to be a ...
1
vote
1answer
62 views

When does S/MIME require the other party's certificate and when is their key enough?

Trying to understand S/MIME implementation, I see that sometimes you must have the other party's certificate, and sometimes its enough to just have their public key. I'm confused as to when you need ...
1
vote
0answers
130 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
2
votes
1answer
708 views

Storing encryption keys on a server using Node.js and MySQL

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for ...
0
votes
1answer
107 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
4
votes
1answer
93 views

Recommended symmetric key usage period

Let's assume that there are two nodes A and B connected over a network. Both have a single pre-shared symmetric key (e.g., AES-128) and exchange messages. What is the recommended period, until the ...
7
votes
3answers
253 views

Server side SSH keys compromised

I'm interested in knowing what could be the consequence if the server side SSH keys of a host were compromised. The situation would be: An attacker manages to read the SSH private keys of the ...
0
votes
1answer
90 views

Multiple user encryption-key store

Let's say I have an application that accesses an encrypted datastore, and I want the admins to be able to unlock the datastore upon application startup (and then the application will have access to ...
1
vote
0answers
207 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
-1
votes
1answer
66 views

Implementing a product key system?

Say I have a piece software that allows people to download a trial version that can then be unlocked. Would the following steps below be an effective way to implement a key system for unlocking the ...
2
votes
2answers
46 views

How secure is switching keys if breaking the key is an intractable problem?

Let's say that you create a system where a secret is hidden and revealed by a particular key. As well, the key can be broken, but it would take thousands of years. If you keep switching the keys ...
2
votes
2answers
262 views

How to maintain security and trust with a PGP keypair for a team or group of people?

I've seen many instances where a company or organization generates and uses a PGP keypair for a team or group of people. Most likely they all have a copy of the private and public keys on their ...
1
vote
0answers
328 views

How to securely delete an OpenVPN connection profile

I store my OpenVPN profile (keys) in an encrypted drive but I run OpenVPN inside an OS that is not encrypted. When I finish my OpenVPN session and disconnect, the connection profiles are still there ...
1
vote
2answers
407 views

GSM A5/1 encryption: Key management

I'm currently studying the A5/1 algorithm used for GSM encryption. I understood how thanks to the symmetric private Key and a public counter frame one can encrypt the communication between A and B. ...
1
vote
2answers
69 views

How to setup cronjobs that do scp without saving the .pem file on either of the machines

I have the following situation and want to know what are the best practices to do such things without exposing myself to security issues I have two servers both use the same private key for login. ...
0
votes
1answer
68 views

One user ID of a trusted key has unknown trust

I observed today that Thunderbird/Enigmail (24.2.0/1.6) does not allow me to select a key for encrypting mails to one of the addresses associated with the key, even though others work. Help sites ...
5
votes
1answer
46 views

PGP keys varying only in attached signatures

Here is a few questions revolving around the same core problem. Let's say I generate a PGP keypair. I now get the keypair signed by person A at signing party X. In the evening, I give my now-signed ...
3
votes
1answer
163 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
1
vote
0answers
244 views

Import securely RSA private key through PKCS#11

I have a cryptographic device that supports the following mechanisms: How I could securely import RSA private key into it? Because there is no support for wrap/unwrap using symmetric key is there ...
2
votes
2answers
268 views

Why doesn't Bitlocker mix the password with stored key?

Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of ...
3
votes
4answers
216 views

Are there Ciphers designed to be slow?

To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to ...
3
votes
2answers
169 views

Signing my certificate by using my smart card and eID card?

In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication. I ...
1
vote
0answers
153 views

“Keyset does not exist” when using SignData function with RSA

"Keyset does not exist". I know that there are tons of question about this error, but mine is totally different. I'm not gona use the key from windows certificate store, but load the public key & ...
3
votes
2answers
103 views

Do I ultimately have to hold a key in my head?

To preface, I'm not an IT security person, just a layman intrigued by the logic. I had this question while reading about Ladar Levison turning a key to his email service on paper to the government. ...
62
votes
11answers
10k views

Where do you store your personal private GPG key?

So, I want to start using pass, but I need a GPG key for this. This application will store all of my passwords, which means it's very important that I don't lose my private key, once generated. Hard ...
1
vote
1answer
366 views

Pgp Private key storage on windows server advice

Looking for a bit of advice really, here's the situation: I currently have a security minded client who will be sending PGP encrypted files. I have to decrypt the files on my server before ...
0
votes
1answer
90 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...
2
votes
1answer
188 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
2
votes
2answers
90 views

RSA key exposure

Is there any limit to the number bytes that an RSA key can be used before it can be exposed. In Symmetric encryption a Key is not recommended to be used to encrypt more than specific amount of data ...
1
vote
2answers
198 views

Using 1-day expiration GPG keys only… any disadvantages?

From the thread Does GPG key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
0
votes
2answers
174 views

What are the Standard Practices for Securely Storing Encryption Keys in Databases

I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ? To add a ...
0
votes
2answers
76 views

What is the meaning of “Key Deletion” operation?

In the context of Key Management and encryption/decryption, what does "Deleting a Key" mean exactly? What are the implications of "Key Deletion", in terms of: Decryption of the old data (i.e. data ...
1
vote
1answer
102 views

One public key contains all subkeys?

I've created a keypair with gpg2 --gen-key Then I created a subkey only for signing. If I clearly understand the process I have now 3 pub/priv pairs. The master, one for encrypting and one for ...
6
votes
1answer
1k views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
6
votes
3answers
2k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
8
votes
2answers
628 views

Is it really secure to store API keys in environment variables?

This site says it is best to keep API keys in environment variable out of the code. And here Storing Credentials Securely You should take great care to ensure your credentials are stored ...