Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

4
votes
3answers
374 views

Are there any serious problems with this technique for generating symmetric keys?

I'm using a technique borrowed out of a book by Bruce Schneier and Niels Ferguson called Practical Cryptography. Basically, it boils down to this: Bob does this: pubk_A = Alice's public key ...
4
votes
1answer
38 views

PGP keys varying only in attached signatures

Here is a few questions revolving around the same core problem. Let's say I generate a PGP keypair. I now get the keypair signed by person A at signing party X. In the evening, I give my now-signed ...
4
votes
1answer
278 views

Storing License Keys

I'm creating an application which generates licenses key and stores this in a database (the licenses are checked online). I don't wish to store these license unhashed, in case the database is stolen. ...
4
votes
1answer
71 views

Recommended symmetric key usage period

Let's assume that there are two nodes A and B connected over a network. Both have a single pre-shared symmetric key (e.g., AES-128) and exchange messages. What is the recommended period, until the ...
4
votes
1answer
3k views

Exchange of DEK and KEK (encryption keys) between app server and key server

In my application, it is required to encrypt a user's data before inserting it into the mysql database. I am using AES algorithm to encrypt the data using a 256 bit hash (and is calling it Data ...
4
votes
1answer
505 views

Symmetric key management

I am currently employing GNU Crypto in Java and I am now deciding on the best way to store the keys. The question Storage of 'secrets', keystores, HSMs and the rest has led me to believe the ...
4
votes
1answer
193 views

Key Management for PCI and Payment automation

We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
4
votes
3answers
245 views

Security in wireless ad hoc sensor network (without physical access)

I want to know without taking physical access, what are the methods that can steal the data in a node. When talking about eavesdropping, how can an attacker sniff the packets? Do they need to listen ...
4
votes
1answer
1k views

Truecrypt - One keyfile multiple passwords

Is it possible to create one keyfile that opens a Truecrypt volume and this keyfile is protected (aes encryption fe) with a password? The use case is a True crypt volume accessed by multiple ...
4
votes
1answer
551 views

Help understanding PCI-DSS when using password based encryption from automatically generated keys

I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS. We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the ...
4
votes
1answer
658 views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile website to make my service also available for other mobile operating systems. Now, ...
3
votes
1answer
503 views

Is this security/encryption scheme secure?

I'm rolling my own, personal threetags.com-style 'encrypted data in the cloud' webapp (I didn't like the UI, and lack of non-browser client). However, I have absolutely no experience with security ...
3
votes
4answers
1k views

Asymmetric crypto: Decrypt own messages without having private key

I have built a messages system for my website. Users can send the admin messages which are stored in the DB after being AES-encrypted. I think that using asymmetric crypto (RSA through openssl) ...
3
votes
6answers
2k views

Are there any “real world” implementations of secret-sharing encryption schemes?

Imagine something like TrueCrypt where user A can decrypt his files, or any 3 of the 10 directors in his organization can decrypt user A's files. As I understand it this is similar to the way the ...
3
votes
4answers
206 views

Are there Ciphers designed to be slow?

To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to ...
3
votes
2answers
270 views

What is the purpose of 'Version:' in PGP public key

PGP public keys look something like -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.9 (GNU/Linux) mQGiBEl2HAgRBAC9IZGQE3NRWFoXV7CcVRbo7xMe+nGPRMTOocA0pcv9N67R6CAZ ... -----END PGP PUBLIC ...
3
votes
2answers
366 views

Storing the master key in the app server binary

Imagine you have a master key to encrypt/decrypt the data saved in your database of your app service. What is the risk of having this key embedded in your app service code to store this key in the app ...
3
votes
2answers
632 views

Change 'Key Usage' of a certificate

Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
3
votes
3answers
120 views

Encrypting a fixed format message with commands and transmitting over the internet

Linked to: Encrypting a fixed format message? I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my ...
3
votes
2answers
99 views

Do I ultimately have to hold a key in my head?

To preface, I'm not an IT security person, just a layman intrigued by the logic. I had this question while reading about Ladar Levison turning a key to his email service on paper to the government. ...
3
votes
3answers
3k views

What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?

Is it better to create a separate ssh-key for each host and user or just using the id_rsa key for all host to authenticate? Could one id_rsa be a malpractice for the privacy/anonymity policies? ...
3
votes
4answers
2k views

Why do APIs use API Keys instead of Usernames?

It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
3
votes
2answers
351 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
4answers
438 views

Generating OpenPGP key pair with restrictions

I intend to generate an OpenPGP RSA key pair where a part (~half) of the private key is as I specify, i.e. a specific string. Are there tools for generating a key pair with such restrictions, or will ...
3
votes
4answers
1k views

Using dynamic keys

It is intuitively clear that, the less materials a cryptanalyst has available to work on, the lower would be his chance of success. This implies that the security of encryption of a message could be ...
3
votes
2answers
775 views

Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?

Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption. Should slow hash function (like bcrypt) be applied to password before using it with ...
3
votes
1answer
331 views

Hybrid key management doing it wrong?

I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
3
votes
1answer
1k views

Storage of 'secrets', keystores, HSMs and the rest

I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
3
votes
2answers
181 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: ...
3
votes
1answer
3k views

How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc

Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data? My goal is to allow my application to ...
3
votes
1answer
80 views

How do I sign another person's key and make the signature expire?

I'm using gnupg and I've just seen that people can sign keys with an expiration attached. The expiration of individual signatures can be seen in gpg --list-sigs <KEY> when setting this in your ...
3
votes
1answer
106 views

Can we build a key exchange protocol without certificates?

Assume that the server and the client both has some secret key K. Is it possible to have a key exchange protocol with authentication between them such that MITM attack cannot hold and if the key is ...
3
votes
1answer
152 views

Design of system based on HTTPS, Client Certificates and custom CA

I have the following system: 2 application servers. At the beginning is installed the first server and later is installed the second one. A client access from a browser to both servers Application ...
3
votes
1answer
314 views

Help on interpretation of FIPS-140 paragraph

This is from the FIPS 140-2 standard: Cryptographic keys stored within a cryptographic module shall be stored either in plaintext form or encrypted form. Plaintext secret and private ...
3
votes
1answer
1k views

What is the best practice for storing a secret on the cloud?

This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
3
votes
1answer
209 views

What dangers are there in storing my private key on different servers?

This question is specifically concerned with storing keys in the cloud, and is somewhat applicable. But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and ...
3
votes
1answer
734 views

How to use DPAPI under load balance environment

DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on ...
3
votes
2answers
137 views

Signing my certificate by using my smart card and eID card?

In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication. I ...
3
votes
1answer
236 views

How secure is to store encryption keys or SSH Keys on LPAR?

I want to store SSH keys (used to connect to some devices that have sensitive data) and the encryption/decryption keys of a database application. They will be inside a LPAR (logical partition) in our ...
3
votes
1answer
64 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
3
votes
1answer
86 views

GPG master key without email address

I would like to create a new GPG key. Going through a couple of thread it seems like the most popular scheme for maximum security is to have an offsite master (sign-only) key which provides a shell ...
3
votes
1answer
134 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
3
votes
1answer
283 views

DPAPI equivalent on linux?

I have an app server and a db server. I want to send certain data to the db encrypted, using a DEK (data encryption key). Ideally, this DEK is read protected on the linux file system and encrypted ...
3
votes
1answer
284 views

Key Management: storing encrypted key in database and decrypted key in session variable

Edit: Rephrased title to hopefully get some interest on what I would have thought was a common issue ? I am developing a website using php/mySQL to store non-commercial data and it will be clearly ...
3
votes
2answers
168 views

How can you securely generate keys on AWS?

Our application needs to generate secure keys for long term storage on AWS using openssl. But I've seen some instance where entropy falls dangerously low on AWS machines and this doesn't appear to be ...
2
votes
3answers
2k views

RSA 4096 with AES 256 Encryption Process Using PyCrypto

I have the following process for encrypting and decrypting data in a python script using the PyCrypto module: Encryption - Server A AES 256 shared key is generated Associated IV is generated Data ...
2
votes
2answers
251 views

Can unencrypted keys & logins be kept out of program memory?

No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will ...
2
votes
3answers
622 views

In depth security: splitting key in different places

I use AES encryption on a website. At the moment, the key is stored in the source of the PHP script that does the encryption/decryption process thanks to openssl. I know that it isn't secure, so I ...
2
votes
5answers
2k views

How are ProtonMail keys distributed?

There is a service called ProtonMail. It encrypts email on the client side, stores encrypted message on their servers, and then the recipient decrypts it, also on the client side and the system ...
2
votes
1answer
147 views

Passing generated keys to another process

I am doing a project in which one process generates a key using a distributed algorithm. I need to pass this key to the calling process or procedure. Generally speaking, one can do this in the ...