Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

0
votes
1answer
112 views

Multi user symmetric key encryption

I realize SIMILAR questions have been asked before but I'm looking for certain specifics I can't seem to find elsewhere. The following question closely resembles mine but falls short for me on ...
0
votes
0answers
42 views

Key Distribution using multicast

I am trying to come up with a solution for a system where i need to generate a key (Kn) from time to time and distribute it to a large number of servers in a private network. Since it has to be a ...
1
vote
1answer
52 views

When does S/MIME require the other party's certificate and when is their key enough?

Trying to understand S/MIME implementation, I see that sometimes you must have the other party's certificate, and sometimes its enough to just have their public key. I'm confused as to when you need ...
1
vote
0answers
124 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
2
votes
1answer
663 views

Storing encryption keys on a server using Node.js and MySQL

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for ...
0
votes
1answer
91 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
4
votes
1answer
90 views

Recommended symmetric key usage period

Let's assume that there are two nodes A and B connected over a network. Both have a single pre-shared symmetric key (e.g., AES-128) and exchange messages. What is the recommended period, until the ...
6
votes
3answers
236 views

Server side SSH keys compromised

I'm interested in knowing what could be the consequence if the server side SSH keys of a host were compromised. The situation would be: An attacker manages to read the SSH private keys of the ...
0
votes
1answer
85 views

Multiple user encryption-key store

Let's say I have an application that accesses an encrypted datastore, and I want the admins to be able to unlock the datastore upon application startup (and then the application will have access to ...
1
vote
0answers
201 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
-1
votes
1answer
61 views

Implementing a product key system?

Say I have a piece software that allows people to download a trial version that can then be unlocked. Would the following steps below be an effective way to implement a key system for unlocking the ...
2
votes
2answers
45 views

How secure is switching keys if breaking the key is an intractable problem?

Let's say that you create a system where a secret is hidden and revealed by a particular key. As well, the key can be broken, but it would take thousands of years. If you keep switching the keys ...
1
vote
2answers
246 views

How to maintain security and trust with a PGP keypair for a team or group of people?

I've seen many instances where a company or organization generates and uses a PGP keypair for a team or group of people. Most likely they all have a copy of the private and public keys on their ...
1
vote
0answers
290 views

How to securely delete an OpenVPN connection profile

I store my OpenVPN profile (keys) in an encrypted drive but I run OpenVPN inside an OS that is not encrypted. When I finish my OpenVPN session and disconnect, the connection profiles are still there ...
1
vote
2answers
371 views

GSM A5/1 encryption: Key management

I'm currently studying the A5/1 algorithm used for GSM encryption. I understood how thanks to the symmetric private Key and a public counter frame one can encrypt the communication between A and B. ...
1
vote
2answers
65 views

How to setup cronjobs that do scp without saving the .pem file on either of the machines

I have the following situation and want to know what are the best practices to do such things without exposing myself to security issues I have two servers both use the same private key for login. ...
0
votes
1answer
54 views

One user ID of a trusted key has unknown trust

I observed today that Thunderbird/Enigmail (24.2.0/1.6) does not allow me to select a key for encrypting mails to one of the addresses associated with the key, even though others work. Help sites ...
4
votes
1answer
41 views

PGP keys varying only in attached signatures

Here is a few questions revolving around the same core problem. Let's say I generate a PGP keypair. I now get the keypair signed by person A at signing party X. In the evening, I give my now-signed ...
3
votes
1answer
160 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
1
vote
0answers
235 views

Import securely RSA private key through PKCS#11

I have a cryptographic device that supports the following mechanisms: How I could securely import RSA private key into it? Because there is no support for wrap/unwrap using symmetric key is there ...
2
votes
2answers
223 views

Why doesn't Bitlocker mix the password with stored key?

Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of ...
3
votes
4answers
215 views

Are there Ciphers designed to be slow?

To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to ...
3
votes
2answers
160 views

Signing my certificate by using my smart card and eID card?

In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication. I ...
1
vote
0answers
152 views

“Keyset does not exist” when using SignData function with RSA

"Keyset does not exist". I know that there are tons of question about this error, but mine is totally different. I'm not gona use the key from windows certificate store, but load the public key & ...
3
votes
2answers
102 views

Do I ultimately have to hold a key in my head?

To preface, I'm not an IT security person, just a layman intrigued by the logic. I had this question while reading about Ladar Levison turning a key to his email service on paper to the government. ...
59
votes
10answers
9k views

Where do you store your personal private GPG key?

So, I want to start using pass, but I need a GPG key for this. This application will store all of my passwords, which means it's very important that I don't lose my private key, once generated. Hard ...
1
vote
1answer
329 views

Pgp Private key storage on windows server advice

Looking for a bit of advice really, here's the situation: I currently have a security minded client who will be sending PGP encrypted files. I have to decrypt the files on my server before ...
0
votes
1answer
82 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...
2
votes
1answer
169 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
2
votes
2answers
88 views

RSA key exposure

Is there any limit to the number bytes that an RSA key can be used before it can be exposed. In Symmetric encryption a Key is not recommended to be used to encrypt more than specific amount of data ...
1
vote
2answers
188 views

Using 1-day expiration GPG keys only… any disadvantages?

From the thread Does GPG key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
0
votes
2answers
162 views

What are the Standard Practices for Securely Storing Encryption Keys in Databases

I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ? To add a ...
0
votes
2answers
75 views

What is the meaning of “Key Deletion” operation?

In the context of Key Management and encryption/decryption, what does "Deleting a Key" mean exactly? What are the implications of "Key Deletion", in terms of: Decryption of the old data (i.e. data ...
5
votes
1answer
887 views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
6
votes
3answers
2k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
8
votes
2answers
570 views

Is it really secure to store API keys in environment variables?

This site says it is best to keep API keys in environment variable out of the code. And here Storing Credentials Securely You should take great care to ensure your credentials are stored ...
7
votes
3answers
264 views

How can I allow acces to encrypted data if only 2 out of 3 users provide a secret?

I want to encrypt data, but make sure that no single user can decrypt the data. Further, it is important not to require ALL users to be present to decrypt. This will allow for some flexibility and ...
0
votes
0answers
29 views

Secure data with server and RSA? [duplicate]

the RSA system uses a private key to read the content encrypted with the public key. If I make a game for mobile, and want to save the data : I guess I cannot save the private key on the device. If ...
1
vote
1answer
421 views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
4
votes
1answer
366 views

DPAPI equivalent on linux?

I have an app server and a db server. I want to send certain data to the db encrypted, using a DEK (data encryption key). Ideally, this DEK is read protected on the linux file system and encrypted ...
1
vote
1answer
131 views

Which is best DPAPI or HSM?

Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
3
votes
1answer
89 views

How do I sign another person's key and make the signature expire?

I'm using gnupg and I've just seen that people can sign keys with an expiration attached. The expiration of individual signatures can be seen in gpg --list-sigs <KEY> when setting this in your ...
3
votes
1answer
118 views

Can we build a key exchange protocol without certificates?

Assume that the server and the client both has some secret key K. Is it possible to have a key exchange protocol with authentication between them such that MITM attack cannot hold and if the key is ...
1
vote
1answer
141 views

Security implications of setting the same password on private key and PKCS12/JKS?

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
7
votes
1answer
202 views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
0
votes
2answers
150 views

Password management [duplicate]

I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
5
votes
2answers
352 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
4
votes
1answer
878 views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile website to make my service also available for other mobile operating systems. Now, ...
2
votes
1answer
86 views

Can I ask GPG keyservers to name all keys signed by a particular key?

Given the alleged possibility that an adversary might attempt to acquire my (OFFLINE) Secret Certification Key and Passphrase and sign other keys with it, including a key they made with my ...
3
votes
2answers
349 views

What is the purpose of 'Version:' in PGP public key

PGP public keys look something like -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.9 (GNU/Linux) mQGiBEl2HAgRBAC9IZGQE3NRWFoXV7CcVRbo7xMe+nGPRMTOocA0pcv9N67R6CAZ ... -----END PGP PUBLIC ...