Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

2
votes
2answers
82 views

RSA key exposure

Is there any limit to the number bytes that an RSA key can be used before it can be exposed. In Symmetric encryption a Key is not recommended to be used to encrypt more than specific amount of data ...
1
vote
2answers
169 views

Using 1-day expiration GPG keys only… any disadvantages?

From the thread Does GPG key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
0
votes
2answers
135 views

What are the Standard Practices for Securely Storing Encryption Keys in Databases

I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ? To add a ...
0
votes
2answers
72 views

What is the meaning of “Key Deletion” operation?

In the context of Key Management and encryption/decryption, what does "Deleting a Key" mean exactly? What are the implications of "Key Deletion", in terms of: Decryption of the old data (i.e. data ...
4
votes
1answer
424 views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
5
votes
3answers
920 views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
8
votes
2answers
399 views

Is it really secure to store API keys in environment variables?

This site says it is best to keep API keys in environment variable out of the code. And here Storing Credentials Securely You should take great care to ensure your credentials are stored ...
7
votes
3answers
257 views

How can I allow acces to encrypted data if only 2 out of 3 users provide a secret?

I want to encrypt data, but make sure that no single user can decrypt the data. Further, it is important not to require ALL users to be present to decrypt. This will allow for some flexibility and ...
0
votes
0answers
29 views

Secure data with server and RSA? [duplicate]

the RSA system uses a private key to read the content encrypted with the public key. If I make a game for mobile, and want to save the data : I guess I cannot save the private key on the device. If ...
1
vote
1answer
318 views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
3
votes
1answer
283 views

DPAPI equivalent on linux?

I have an app server and a db server. I want to send certain data to the db encrypted, using a DEK (data encryption key). Ideally, this DEK is read protected on the linux file system and encrypted ...
1
vote
1answer
116 views

Which is best DPAPI or HSM?

Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
3
votes
1answer
80 views

How do I sign another person's key and make the signature expire?

I'm using gnupg and I've just seen that people can sign keys with an expiration attached. The expiration of individual signatures can be seen in gpg --list-sigs <KEY> when setting this in your ...
3
votes
1answer
106 views

Can we build a key exchange protocol without certificates?

Assume that the server and the client both has some secret key K. Is it possible to have a key exchange protocol with authentication between them such that MITM attack cannot hold and if the key is ...
1
vote
1answer
102 views

Security implications of setting the same password on private key and PKCS12/JKS?

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
7
votes
1answer
189 views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
0
votes
2answers
140 views

Password management [duplicate]

I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
5
votes
2answers
322 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
4
votes
1answer
658 views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile website to make my service also available for other mobile operating systems. Now, ...
1
vote
1answer
78 views

Can I ask GPG keyservers to name all keys signed by a particular key?

Given the alleged possibility that an adversary might attempt to acquire my (OFFLINE) Secret Certification Key and Passphrase and sign other keys with it, including a key they made with my ...
3
votes
2answers
270 views

What is the purpose of 'Version:' in PGP public key

PGP public keys look something like -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.9 (GNU/Linux) mQGiBEl2HAgRBAC9IZGQE3NRWFoXV7CcVRbo7xMe+nGPRMTOocA0pcv9N67R6CAZ ... -----END PGP PUBLIC ...
1
vote
1answer
107 views

Advice on using encryption for self training app

I am self training on using encryption. I am a php developer and in my spare time I am building an online app that provides basic cms features to help me understand encryption design more. I am using ...
0
votes
3answers
161 views

What are the MitM implications of a stolen client-side private key?

Many VoIP handsets support client-side SSL authentication for auto-provisioning. Unfortunately, some devices must be programmed with their client-side keys. (Keys generated on low-entropy devices are ...
2
votes
2answers
409 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
3
votes
1answer
284 views

Key Management: storing encrypted key in database and decrypted key in session variable

Edit: Rephrased title to hopefully get some interest on what I would have thought was a common issue ? I am developing a website using php/mySQL to store non-commercial data and it will be clearly ...
1
vote
0answers
95 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
0
votes
2answers
143 views

how to store key securely [duplicate]

I will receive some secret key from server which I will use as an authentication key for a MAC function in the future. But my question is how do I store this key securely on my machine? Will I have to ...
2
votes
1answer
248 views

Using Diffie–Hellman key protocol to create a safe secret key

Let's say, I have a friend far from me and I want to send some secret messages to him. I have to say, I'm pretty newbie in security. That's why I'm wondering, does the Diffie–Hellman key exchange ...
2
votes
1answer
153 views

Is it important to keep my pastebin developer key private?

I would like for my application to enable users to save their programs to Pastebin through the Pastebin api. This requires a developer key, which is automatically created with each account. Keeping ...
-2
votes
2answers
119 views

Is this a possible solution to the impractical requirements of using a One Time Pad?

For the sake of example, lets say there are two people named, Bob, and Jim. The Problem Bob wants to send Jim a long secret message, and he decides to use a OTP to encrypt his message. Both Bob and ...
2
votes
1answer
340 views

AES key management

I am encrypting a secret in a db field. I am encrypting using AES with a 256-bit key and a random IV per encryption. They AES key is hard coded in the code. Each IV is stored in clear in another ...
3
votes
2answers
168 views

How can you securely generate keys on AWS?

Our application needs to generate secure keys for long term storage on AWS using openssl. But I've seen some instance where entropy falls dangerously low on AWS machines and this doesn't appear to be ...
1
vote
1answer
61 views

How to restrict access to a resource based on frequency of access?

I want to restrict access to a particular resource based on time (configurable). So suppose user A has time t configured from him. He can access the resource only once every t time units. The values ...
2
votes
1answer
1k views

How do I share my S/MIME public key?

I have setup S/MIME encryption for my email address, and I'd like to allow people to download the public key from my website, rather than having to first receive an email from me. I want the public ...
2
votes
2answers
120 views

Is there a hard-to-spoof identifier associated with a physical hard disk

I would like to salt the pass phrase with the drive id in such a way that, if the disk were imaged to a new drive with a different id, (e.g. by a government forensics specialist) then the image would ...
1
vote
1answer
64 views

Hybrid Encryption System - Is this unnecessary in this case? [closed]

I have a column in my database that I need to encrypt. The column can contain any arbitrary data. What I am thinking is to generate a public and private key pair first. Store the public key in a ...
0
votes
1answer
91 views

I want to store a large number of relatively short-lived symmetric keys

Each encrypted blob will have a well-defined, but different lifetime. Some will be around for 5 minutes, some for a day, some for a week, none for over a month. I would like to be able to "delete" ...
0
votes
2answers
121 views

pgp decryption on public pc

When I want to decrypt mails on a public PC (café), encrypted with GPG, in e.g. gmail with the extension "Mailvelope" or equal - how would that be possible? I found tools to run from an USB stick ...
0
votes
2answers
154 views

How do key servers resolve conflicts?

According to the PGP network FAQ While a number of key servers exist, it is only necessary to send your key to one of them. The key server will take care of the job of sending your key to all ...
0
votes
1answer
143 views

What are techniques for end users to select keys on a smartcard?

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy? For example suppose I have a government issued ID that ...
3
votes
3answers
3k views

What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?

Is it better to create a separate ssh-key for each host and user or just using the id_rsa key for all host to authenticate? Could one id_rsa be a malpractice for the privacy/anonymity policies? ...
0
votes
3answers
375 views

Is using a numbers station to transmit a one-time-pad as key actually insecure?

We all know the two most important problems related to a “one-time-pad”: The one-time-pad needs to be truly random (which I think is logic, as pseudo random generators are quick but predictable). ...
4
votes
1answer
182 views

Unique SSL keys for load-balanced hosts

Given a setup with multiple SSL-terminating load-balancers in a failover configuration, is it a bad idea to have a unique TLS private key for each one of the hosts? They would all share the same FQDN. ...
1
vote
2answers
100 views

Are there any systems to mitigate the risk of losing a Signing Key?

I want to design a system that hinges on ECDSA. All messages are signed using the algorithm, and this is used to prevent spoofing. However, if a user were to somehow lose control of their key, they ...
7
votes
3answers
2k views

How can I securely convert a “string” password to a key used in AES?

I'm writing some software where I have to encrypt all files that are written to a specific folder using AES. There is one password/key that is configured somewhere, that is always used. I don't want ...
2
votes
1answer
146 views

Where can I find resources to help me implement a key server?

I would like to implement a fairly basic but nonetheless robust key server for generating and managing symmetric encryption keys. Are there guidelines or best practices out there that I should peruse? ...
6
votes
3answers
329 views

Vulnerabilities with DB backed session tokens

A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to ...
6
votes
1answer
140 views

public key distribution from a central server

I'm trying to code up a encrypted communication program. Originally I was thinking that I would use public key cryptography and then I would keep the public keys in a database where users could query ...
0
votes
2answers
350 views

How to implement shamir's secret sharing algorithm using AES_ENCYRPT

I am using MySQL AES_ENCRYTP() and AES_DECRYPT() to store sensitive details in a database, and currently storing the key in a php file outside of the web root with read access only. The key file looks ...
1
vote
2answers
294 views

How does Wuala store symmetric key?

As far as I understand Wuala (so called secure cloud storage) is not using the original (user provided) password to encrypt data so what role does original password play in their system? I think they ...