Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
4
votes
3answers
183 views
Security in wireless ad hoc sensor network (without physical access)
I want to know without taking physical access, what are the methods that can steal the data in a node.
When talking about eavesdropping, how can an attacker sniff the packets? Do they need to listen ...
0
votes
0answers
124 views
How to create a portable password storage [closed]
I want to have a portable way to store my passwords and key pairs. While I know that this already exists e.g. as Apps for iOS or Android and counterparts for OS X or Windows which can sync and ...
7
votes
2answers
2k views
Best Practice: “One per-user ssh key” or “multiple per-host ssh keys” [duplicate]
Possible Duplicate:
What’s the common pragmatic strategy for managing key pairs?
I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when ...
3
votes
4answers
672 views
Asymmetric crypto: Decrypt own messages without having private key
I have built a messages system for my website. Users can send the admin messages which are stored in the DB after being AES-encrypted.
I think that using asymmetric crypto (RSA through openssl) ...
1
vote
2answers
701 views
Creating user specific authentication methods in SSH
I have configured sshd on an Ubuntu server to use key authentication and it is working fine.
I had to disable password authentication for key authentication to work.
Server is always accessed via ...
8
votes
2answers
1k views
1
vote
1answer
124 views
How dependable can data encryption be without re-entry of password on startup?
I posted a comment awhile back, and thought I would turn it into a question.
Example: There is a feature in the Microsoft SQL Server for full database encryption, which seems to have an option that ...
0
votes
1answer
258 views
How do I securely store and retrieve a many-time use key?
I am performing some symmetric database encryption/decryption in .net. I am using a single 256 bit private key.
(1) Where do I store this key when not in use?
(2) How do I securely retrieve this ...
4
votes
3answers
304 views
What does it mean for a digital certificate to be “signed”?
When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
1
vote
1answer
315 views
Smart card compatible with Schlumberger (Gemalto) Cryptoflex 16K and USB reader
Another question related to previous ones A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? and About performance of Smard card for performing 3DES in a MD5 hash
We need ...
3
votes
2answers
180 views
A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
5
votes
2answers
155 views
Authenticating client without hardcoding key?
A basic question, but I'm not a master and this is puzzling me-
How is it possible to authenticate a client from the server's perspective?
i.e. imagine you're the server, and you want to give the ...
7
votes
2answers
1k views
Using RSA with 3DES instead of plain 3DES. Does it make sense?
I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And ...
1
vote
1answer
611 views
Google custom Search Engine api key: is it confidential?
Normally, I'd say yes, api keys should be kept secret, and Google's api console even says that. However, I'm just making an ajax get call and all the info is in the clear on my page in order to ...
0
votes
1answer
219 views
What is purpose of --s2k-* GnuPG options? [closed]
When I use gpg --symmetric --s2k- and press tab some options appear:
--s2k-cipher-algo
--s2k-count
--s2k-digest-algo
--s2k-mode
What do those options do?
2
votes
2answers
311 views
Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?
Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption.
Should slow hash function (like bcrypt) be applied to password before using it with ...
5
votes
2answers
686 views
Using TPM with DMcrypt?
Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
4
votes
1answer
604 views
Does GPG key expiration add to security?
I've created a new GPG key to sign a software package in a source repository, with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or ...
4
votes
2answers
778 views
PCI Compliant Key Management solutions that don't cost a fortune
We are relatively small software company who has a requirement to store PAN's for our customers. Hosted payment solutions just don't fit our product requirements. We literally have 3 lines of ...
1
vote
1answer
228 views
Hybrid key management doing it wrong?
I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
5
votes
3answers
3k views
What is the DUKPT Key Derivation Function?
I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
25
votes
4answers
5k views
How can PrivateSky not see your data?
PrivateSky is a website that promises encrypted "cloud-like" secure information exchange. They promise that except the sender and receiver, nobody can see your data. After testing it yesterday, I do ...
0
votes
1answer
510 views
What are the potential vulnerabilities in a SAML-based SSO approach?
What level of access would an attacker need to obtain to compromise a SAML-based SSO system?
Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
3
votes
1answer
170 views
How secure is to store encryption keys or SSH Keys on LPAR?
I want to store SSH keys (used to connect to some devices that have sensitive data) and the encryption/decryption keys of a database application. They will be inside a LPAR (logical partition) in our ...
2
votes
1answer
414 views
How to use DPAPI under load balance environment
DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on ...
9
votes
2answers
3k views
where to store a key for encryption
I am looking for a way to store a key used for password encryption. I am using a mysql db which would store a user name and an encrypted password that would be encrypted using ...
6
votes
4answers
560 views
can ssh passwordless public key authentication be ok if combined with a VPN?
Having a debate with a coworker about the merits & faults of public key authentication with ssh.
I'm basically wondering what all the possible merits and faults are, especially in regards to ...
3
votes
2answers
376 views
How do open source projects handle secure artifacts?
Specifically, how are things like keystores handled, or other items needed to build or run an app?
In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web ...
3
votes
2answers
759 views
How to store IV and key temporarily but securely
I am using .NET 4.0 to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once ...
3
votes
1answer
484 views
Storage of 'secrets', keystores, HSMs and the rest
I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
5
votes
3answers
102 views
Should I make sure to get all of my OpenPGP uids are signed?
Should I make sure that I get all of the uids associated to my OpenPGP key signed, or is it enough to have one of them signed?
If Bob can guarantee that alice@example.com belongs to Alice, I can't ...
5
votes
4answers
293 views
How do you guarantee that you don't lose a keyfile?
I am toying with the idea of adding keyfiles to various things I encrypt. However whats been keeping me from adopting them is garanteeing that I don't loose the keyfile while still keeping security.
...
10
votes
3answers
731 views
What's the common pragmatic strategy for managing key pairs?
I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH.
Originally when I learned about PKI, I created a single ...
5
votes
1answer
2k views
Creating a “key server” (HIPAA compliance with AWS)
I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to ...
6
votes
2answers
463 views
What happens if two parties have a same pair of public&private keys
we know that we have to create Private key on server and generate its public key and create a certificate.
But what if we get a private key which someone already has. Isn't the security becomes weak ...
6
votes
3answers
1k views
How can I convert my encypted PGP secret key for use performing SSH authentication?
I wish to covert my PGP key (RSA) to be used performing SSH authentication. After some searching, I found openpgp2ssh, which appears to be an appropriate tool. Everything works swimmingly for my ...
7
votes
4answers
2k views
Does symmetric encryption provide data integrity?
Let's say I have one server that encrypts a file with a symmetric key, e.g. AES-CBC, and sends it to clients that decrypt it. Does that provide data integrity when decrypted? Or is it possible for ...
6
votes
5answers
3k views
What does “key with length of x bits” mean?
I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
6
votes
1answer
99 views
Creating a Private Key using Human Intervention
In a hypothetical system, lets say that a design requirement is that people who snoop around the database of a web application (sysadmin gone rogue, or what have you), do not have access to the plain ...
2
votes
3answers
1k views
RSA 4096 with AES 256 Encryption Process Using PyCrypto
I have the following process for encrypting and decrypting data in a python script using the PyCrypto module:
Encryption - Server A
AES 256 shared key is generated
Associated IV is generated
Data ...
10
votes
2answers
1k views
What vulnerabilities could be caused by a wildcard SSL cert?
In a comment on this answer, AviD says:
"There are numerous security issues with wildcard SSL certs."
So, what are the problems? I understand that the same private key is being used in multiple ...
10
votes
2answers
1k views
What's wrong with storing private keys in the cloud?
I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
1
vote
2answers
461 views
Need example and working Security Token Service (STS)?
Can anyone explain or post any link to a simple example and introduction about the
Security Token Service (STS)?
5
votes
1answer
192 views
How protective should we be of an SSL client certificate?
We've got an application where the database connection requires an SSL client certificate. How protective do we need to be of this certificate? What are the implications if someone else gets it?
I ...
17
votes
3answers
2k views
What useful things can I do with the html5 “keygen” element?
There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari.
Here's what it looks like:
<form action="processkey.cgi" method="post" ...
4
votes
3answers
152 views
Is there a common name for a software defect that leads to unexpected transfer of secret over the wire?
Suppose in a C++ program I use a memory region for temporarily storing an encryption key and don't overwrite that region afterwards. Then my program wants to send a data packet over the network.
Due ...
7
votes
3answers
406 views
Server to server encryption: Key rotation over the air. Can it improve security?
In my other question, I explored whether to write my own encryption or use an existing one. I was advised to use TLS or AES or something that is established.
This question is about key rotation. It ...
5
votes
3answers
464 views
Where do I securely store the key for a system where the source is visible?
I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there.
I've ...
2
votes
1answer
984 views
DUKPT - Sample data other then in X9.24
I wrote some code that does PIN encryption/decryption according to rules in X9.24.
It works great with examples provided in ANSI doc, but doesn't work with actual device from the client.
Where can I ...
4
votes
1answer
1k views
how to secure Android Market public key
Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
