Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
3
votes
1answer
365 views
Is this security/encryption scheme secure?
I'm rolling my own, personal threetags.com-style 'encrypted data in the cloud' webapp (I didn't like the UI, and lack of non-browser client).
However, I have absolutely no experience with security ...
2
votes
4answers
649 views
Are there any “real world” implementations of secret-sharing encryption schemes?
Imagine something like TrueCrypt where user A can decrypt his files, or any 3 of the 10 directors in his organization can decrypt user A's files. As I understand it this is similar to the way the ...
12
votes
6answers
624 views
How can the impact of cold boot attacks be minimized?
Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
6
votes
1answer
524 views
Public key length
I was wondering if there was (and I hope there is) a standard for public key size for ECDH (Elliptic Curve Diffie-Hellman) and ECDSA (Elliptic Curve Digital Signature Algorithm) for every curve type ...
72
votes
3answers
44k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
3
votes
2answers
503 views
When should I use Message layer encryption vs transport layer encryption
Basically I will be having to secure a connection between different hops. Therefore even if TLS is widely known to be the best in class, I am wondering that in such a case message based encryption ...
11
votes
4answers
2k views
Security of passphrase-protected private key
If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
9
votes
5answers
1k views
Use RSA keypair for PGP encryption and decryption
Is there a way that I can use a RSA keypair with PGP?
What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
4
votes
2answers
2k views
mysql AES_ENCRYPT key length
AES_ENCRYPT uses a 128 bit long key to encrypt the data, but how does mysql handle longer or shorter keys? I found out that pycrypto for instances recomend to transform the key by using md5 sha1 sha2, ...
19
votes
2answers
3k views
Web Application encryption key management
In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions:
...
3
votes
1answer
149 views
Help on interpretation of FIPS-140 paragraph
This is from the FIPS 140-2 standard:
Cryptographic keys stored within a
cryptographic module shall be stored
either in plaintext form or encrypted
form. Plaintext secret and private
...
8
votes
3answers
742 views
Security implications of storing the password hash along an encrypted AES key
I am using the PKCS#5 standard to generate a key using a random and unique salt and the user's password in input. Consider this key as the "encryption" key.
The "encryption" key is used to encrypt a ...
10
votes
6answers
765 views
Shouldn't GPG key fetching use a secure connection?
If I run this for example:
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451
then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) ...
23
votes
6answers
1k views
Is using a public-key for logging in to SSH any better than saving a password?
Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
8
votes
3answers
25k views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
7
votes
3answers
1k views
Additional security of keyfile on top of a master password for KeePass
I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model.
However my biggest remaining concern is the ...
3
votes
3answers
106 views
Encrypting a fixed format message with commands and transmitting over the internet
Linked to: Encrypting a fixed format message?
I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my ...
3
votes
2answers
157 views
Encrypting a fixed format message?
I'm planning to send across TWO pieces of information over the internet from machine A
A site identifier which will be like:
$SiteName = "EXAMPLE" (in plaintext)
Encoded text which will be like:
...
4
votes
2answers
141 views
Question about the SessionLock paper
Some time ago there was a big fuzz over Firesheep: by listening to wifi traffic your login session can be stolen which is very bad because now somebody can e.g. send emails on your behalf. Some people ...
5
votes
5answers
892 views
Should one sign and encrypt using the same key? The Azure Training Labs are taking this approach
I'm taking the Azure lab LoadBalancing with WCF and recognise what I have been told is bad from a security perspective, but am not sure if it applies here.
Can someone look at this code and tell me ...
5
votes
1answer
290 views
Is storing a private key in a device as it was done in AirPort Express the right solution?
Here's a story about how one guy reverse engineered AirPort Express and obtained the private key that was used to prevent cloning the device ability to stream audio to approved devices only.
So ...
7
votes
2answers
1k views
Data Encryption and Key Management in C#
Which route to take, what are the pros and cons, which is more secure..
Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
12
votes
4answers
783 views
Is Steganography considered encryption and subject to USA export restrictions?
I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
9
votes
3answers
3k views
Encrypting with Mongo
How can I achieve the following goals?
All compute and storage to be located in the cloud.
Encryption in transit of all data between web nodes and db nodes running MongoDB.
How to set up tunnels? ...
5
votes
2answers
589 views
Generating one-time tokens from API-key?
I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site.
I intend to distribute secret API-keys to ...
13
votes
3answers
1k views
What are the chances to generate the same ssh key?
I could generate ssh keys on the client like (without password):
ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v
and copy the generated id_rsa.pub to the server:
ssh-copy-id -i ...
4
votes
3answers
297 views
Are there any serious problems with this technique for generating symmetric keys?
I'm using a technique borrowed out of a book by Bruce Schneier and Niels Ferguson called Practical Cryptography. Basically, it boils down to this:
Bob does this:
pubk_A = Alice's public key
...
3
votes
4answers
321 views
Generating OpenPGP key pair with restrictions
I intend to generate an OpenPGP RSA key pair where a part (~half) of the private key is as I specify, i.e. a specific string. Are there tools for generating a key pair with such restrictions, or will ...
10
votes
3answers
574 views
Key management in cloud datacenters
In terms of infrastructure, how do Cloud providers (organizations providing SaaS, PaaS, or IaaS via the cloud) manage keys and cryptography?
From my understanding, "private" datacenters tend to ...
8
votes
5answers
7k views
Compute the AES-encryption key given the plaintext and its ciphertext?
I'm tasked with creating database tables in Oracle which contain encrypted
strings (i.e., the columns are RAW). The strings are encrypted by the application
(using AES, 128-bit key) and stored in ...
8
votes
5answers
338 views
What can one do when encryption methods fail?
I'm in search of an expert to answer my curiosity. Suppose that methods like AES/DES, SSH, PGP, RSA, etc. can be cracked or fail somehow. In other words, suppose that it's possible to determine one ...
5
votes
1answer
211 views
PKI solution vendor selection
What would you look for in a (X.509-) PKI solution, and why would you look for that, given the following constraints:
Available programming/sw-engineering know how is limited (ie, "OpenSSL with a ...
6
votes
1answer
1k views
Is SSL key generation client-side, server-side, or both?
Who generates the session keys for a SSL symmetric encryption? Is it the client for both client and server where client generates part of it while the server generates the other part?
6
votes
1answer
2k views
How can I enumerate all the saved RSA keys in the Microsoft CSP?
I have an application that is creating several keys and storing them in various stores (in this case the Machine store).
How can I enumerate all the keys on a given Windows system?
...
3
votes
1answer
2k views
How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc
Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data?
My goal is to allow my application to ...
9
votes
5answers
1k views
Storing private asymmetric key in application binary?
I would like to give a daemon-style process (i.e. no user interaction) access to a shared secret key so that it can access a shared, encrypted data file. User applications accessing the same encrypted ...
8
votes
3answers
1k views
What common products use Public-key cryptography?
I want know what common use products are there that use public key/private key cryptography?
20
votes
5answers
2k views
PCI Encryption Key Management
(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously).
I currently ...
6
votes
3answers
520 views
What are the pros and cons of outsourcing an organization's PKI?
I am looking for the pros and cons of outsourcing an organization's Public Key Infrastructure (PKI). I understand that the answer to whether or not to actually outsource is going to depend on the ...
10
votes
2answers
982 views
GnuPG/OpenPGP Key Practices
I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to ...
13
votes
2answers
1k views
How secure is Keychain on OS X?
Keychain is a built-in app on OS X that stores all of the user credentials, and allows for one to keep encrypted notes in an easily accessible way.
Does anyone know how secure Keychain is? I know ...
7
votes
3answers
402 views
Database Encryption Security
I am encrypting and decrypting my database data from my web applications API. If my web server is compromised, what is to keep someone from using that same method to retrieve the data?
For example, ...
28
votes
6answers
9k views
How should I distribute my public key?
I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
