Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
3
votes
1answer
172 views
How secure is to store encryption keys or SSH Keys on LPAR?
I want to store SSH keys (used to connect to some devices that have sensitive data) and the encryption/decryption keys of a database application. They will be inside a LPAR (logical partition) in our ...
3
votes
1answer
83 views
Distributing API Keys to Mobile Apps
I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs ...
2
votes
3answers
1k views
RSA 4096 with AES 256 Encryption Process Using PyCrypto
I have the following process for encrypting and decrypting data in a python script using the PyCrypto module:
Encryption - Server A
AES 256 shared key is generated
Associated IV is generated
Data ...
2
votes
4answers
648 views
Are there any “real world” implementations of secret-sharing encryption schemes?
Imagine something like TrueCrypt where user A can decrypt his files, or any 3 of the 10 directors in his organization can decrypt user A's files. As I understand it this is similar to the way the ...
2
votes
4answers
260 views
Why do APIs use API Keys instead of Usernames?
It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
2
votes
2answers
217 views
Encrypt+Signing data: PKCS#7 / CMS or do-it-your-own way?
Currently I'm saving an array of AES keys into a keychain as JSON, saved as a text file / SQL text column:
{
[
{
encryptedAesKey:RsaEncryptedBytesBase64Encoded==,
...
2
votes
1answer
107 views
Security of re-encryption with a list of pre-computed password based keys
I have a problem where an encrypted file stored on a server needs to be decrypted through a precomputed list of passwords that are used one time only - OTP applied to encryption basically. The file is ...
2
votes
1answer
123 views
What dangers are there in storing my private key on different servers?
This question is specifically concerned with storing keys in the cloud, and is somewhat applicable.
But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and ...
2
votes
2answers
314 views
Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?
Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption.
Should slow hash function (like bcrypt) be applied to password before using it with ...
2
votes
1answer
200 views
What is the best practice for storing a secret on the cloud?
This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
2
votes
1answer
315 views
Where to store Java keystore password?
We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
2
votes
1answer
420 views
How to use DPAPI under load balance environment
DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on ...
2
votes
1answer
993 views
DUKPT - Sample data other then in X9.24
I wrote some code that does PIN encryption/decryption according to rules in X9.24.
It works great with examples provided in ANSI doc, but doesn't work with actual device from the client.
Where can I ...
1
vote
2answers
712 views
Creating user specific authentication methods in SSH
I have configured sshd on an Ubuntu server to use key authentication and it is working fine.
I had to disable password authentication for key authentication to work.
Server is always accessed via ...
1
vote
1answer
99 views
Passing generated keys to another process
I am doing a project in which one process generates a key using a distributed algorithm. I need to pass this key to the calling process or procedure. Generally speaking, one can do this in the ...
1
vote
1answer
176 views
AES128 and IV for app crypto
We have some columns in some tables that are sensitive and would like to protect them "anyways". Also, since Azure SQL demands application level encryption, we have to roll our own. There would be a ...
1
vote
1answer
229 views
Hybrid key management doing it wrong?
I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
1
vote
4answers
302 views
SSH: reusing public keys and known-man-in-the-middle
Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key):
Best Practice: “One per-user ssh key” or ...
1
vote
1answer
227 views
How to protect encryption key while application is using it
I made an J2SE application that uses AES (in CBC mode using BouncyCastle library) to encrypt application config file & some user provided files.
I stored the raw AES key in a file that is ...
1
vote
1answer
617 views
Google custom Search Engine api key: is it confidential?
Normally, I'd say yes, api keys should be kept secret, and Google's api console even says that. However, I'm just making an ajax get call and all the info is in the clear on my page in order to ...
1
vote
2answers
468 views
Need example and working Security Token Service (STS)?
Can anyone explain or post any link to a simple example and introduction about the
Security Token Service (STS)?
1
vote
1answer
138 views
Exchange of DEK and KEK (encryption keys) between app server and key server
In my application, it is required to encrypt a user's data before inserting it into the mysql database. I am using AES algorithm to encrypt the data using a 256 bit hash (and is calling it Data ...
1
vote
2answers
95 views
How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)
I have a newer private key I have to import into an older server.
How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
1
vote
3answers
141 views
Validate hmac with hashed stored key
What if an HMAC is correctly generated and sent with the data to the server, so far I know the server needs to know the original data with which the MAC was created in order to re-create the MAC and ...
1
vote
1answer
124 views
How dependable can data encryption be without re-entry of password on startup?
I posted a comment awhile back, and thought I would turn it into a question.
Example: There is a feature in the Microsoft SQL Server for full database encryption, which seems to have an option that ...
1
vote
1answer
66 views
How to have Thunderbird include a root certificate?
An eMail signed via S/MIME also contains the X.509 certificate chain containing the public key in order to directly verify the signature (assuming its issuing CA is deemed trustworthy). The chain does ...
1
vote
1answer
79 views
How to change (sub)key usage of a PGP key?
gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...
1
vote
1answer
318 views
Smart card compatible with Schlumberger (Gemalto) Cryptoflex 16K and USB reader
Another question related to previous ones A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? and About performance of Smard card for performing 3DES in a MD5 hash
We need ...
0
votes
3answers
210 views
Brute forcing ssh keys
My problem is a common one: I deleted my SSH key, and forgot to set rm to point to a .trash file. I have the public key, and I need to get in this server. I am not doing this on anyone else's server. ...
0
votes
2answers
183 views
In depth security: splitting key in different places
I use AES encryption on a website. At the moment, the key is stored in the source of the PHP script that does the encryption/decryption process thanks to openssl.
I know that it isn't secure, so I ...
0
votes
3answers
273 views
How to store a private RSA key for an application?
I was wondering how an application that have a private key will keep it secure?
If the private key is outside the binary, then anybody can access it, but store it in the binary doesn't make it more ...
0
votes
3answers
264 views
Are there flaws in this simple key exchange?
I'm reviewing for a computer security exam. Here is a simple scenario:
Suppose that someone suggests the following way to confirm that the two of you are both in possession of the same secret key. ...
0
votes
2answers
190 views
Where do I securely store application-specific symmetric key?
I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere.
From a similar ...
0
votes
1answer
141 views
Password protection of encryption and signature keys
I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code)
The basic ...
0
votes
1answer
54 views
PCI 3.6.6 cryptographic key procedures include split knowledge
My question is, if you run your own company and there are no employees and you still qualify under assessment D what do you do in a case like this where it is requiring 2 or more people? On a related ...
0
votes
1answer
104 views
What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?
Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange?
Can the server be configured to use weak key sizes for ...
0
votes
1answer
94 views
Key distribution advice
I have been thinking for days about that problem! The application is based on a student system management. I am implementing database encryption on a column level and The encryption occurs at the ...
0
votes
3answers
86 views
Implement server serial key for server software
Me and my friend want to sell game server-side software, but we want some sort of control, over use of that software.
For example, we want some sort of serial key system, so only verified/paid ...
0
votes
1answer
266 views
How do I securely store and retrieve a many-time use key?
I am performing some symmetric database encryption/decryption in .net. I am using a single 256 bit private key.
(1) Where do I store this key when not in use?
(2) How do I securely retrieve this ...
0
votes
1answer
513 views
What are the potential vulnerabilities in a SAML-based SSO approach?
What level of access would an attacker need to obtain to compromise a SAML-based SSO system?
Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
0
votes
0answers
124 views
How to create a portable password storage [closed]
I want to have a portable way to store my passwords and key pairs. While I know that this already exists e.g. as Apps for iOS or Android and counterparts for OS X or Windows which can sync and ...
0
votes
1answer
227 views
What is purpose of --s2k-* GnuPG options? [closed]
When I use gpg --symmetric --s2k- and press tab some options appear:
--s2k-cipher-algo
--s2k-count
--s2k-digest-algo
--s2k-mode
What do those options do?
-1
votes
1answer
147 views
GPG advantages / disadvantages, is it useful or secure? [closed]
I thinking about GPG, is very widely used, but is secure? Why and where we using GPG?
I found an article from 2002, but is very old.
