Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

7
votes
1answer
1k views

Encrypting sensitive data in software and storing/decrypting it on a server

I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing. I'm developing software which has 2 parts - a C# program run ...
1
vote
1answer
457 views

How to change (sub)key usage of a PGP key?

gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...
9
votes
2answers
3k views

What is a good general purpose GnuPG key setup?

Since most key types can be used for multiple purposes, namely certification, authentication, encryption and signatures, one could simply use one key for everything - which is a bad idea, as ...
7
votes
1answer
1k views

Is it secure to transfer an RSA public key by email?

I've set up my VPS'ssh server to accept only key-based identification: I disabled password-based connection. As a consequence I am connecting from home with an RSA key generated prior to password ...
0
votes
1answer
212 views

Key distribution advice

I have been thinking for days about that problem! The application is based on a student system management. I am implementing database encryption on a column level and The encryption occurs at the ...
5
votes
3answers
311 views

An OS that does not trust its RAM?

I wonder if it is possible to write a kernel that would keep all of its RAM encrypted, storing the key in the CPU cache, so that the machine would be resistant to cold-boot attacks?
-2
votes
1answer
666 views

GPG advantages / disadvantages, is it useful or secure? [closed]

I thinking about GPG, is very widely used, but is secure? Why and where we using GPG? I found an article from 2002, but is very old.
2
votes
1answer
3k views

Where to store Java keystore password?

We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
1
vote
3answers
4k views

How to store a private RSA key for an application?

I was wondering how an application that have a private key will keep it secure? If the private key is outside the binary, then anybody can access it, but store it in the binary doesn't make it more ...
0
votes
3answers
162 views

Implement server serial key for server software

Me and my friend want to sell game server-side software, but we want some sort of control, over use of that software. For example, we want some sort of serial key system, so only verified/paid ...
2
votes
2answers
708 views

Encrypt+Signing data: PKCS#7 / CMS or do-it-your-own way?

Currently I'm saving an array of AES keys into a keychain as JSON, saved as a text file / SQL text column: { [ { encryptedAesKey:RsaEncryptedBytesBase64Encoded==, ...
13
votes
2answers
3k views

How many GPG keys should I make?

I am learning how to use GPG keys, and I am wondering what is the threshold people generally use to maintain separate GPG keys. Maintaining an incredibly large number of keys is not good since it ...
1
vote
1answer
222 views

AES128 and IV for app crypto

We have some columns in some tables that are sensitive and would like to protect them "anyways". Also, since Azure SQL demands application level encryption, we have to roll our own. There would be a ...
2
votes
4answers
1k views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or ...
3
votes
4answers
1k views

Using dynamic keys

It is intuitively clear that, the less materials a cryptanalyst has available to work on, the lower would be his chance of success. This implies that the security of encryption of a message could be ...
2
votes
1answer
151 views

Passing generated keys to another process

I am doing a project in which one process generates a key using a distributed algorithm. I need to pass this key to the calling process or procedure. Generally speaking, one can do this in the ...
28
votes
7answers
6k views

Should I change the private key when renewing a certificate?

My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
1
vote
2answers
309 views

How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)

I have a newer private key I have to import into an older server. How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
4
votes
5answers
3k views

How can I explain the concept of public and private keys without technical jargon? [duplicate]

Possible Duplicate: Principle of asymmetric algorithm in plain english In the spirit of How can I explain SQL injection without technical jargon?, do you have any suggestions on how to ...
0
votes
1answer
220 views

Password protection of encryption and signature keys

I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code) The basic ...
4
votes
1answer
199 views

Key Management for PCI and Payment automation

We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
8
votes
2answers
453 views

Key management scheme in PHP that is compliant with NIST SP 800-57

We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management I wonder if there're any open-source or commercial PHP solutions ...
5
votes
1answer
5k views

Encrypting data for Android mobile app

I am creating a mobile app for Android. This is my first mobile app by the way. I have decided to store data used in my app in a SQLite database in the target Android device. The data I am storing ...
148
votes
7answers
12k views

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
1
vote
3answers
638 views

Validate hmac with hashed stored key

What if an HMAC is correctly generated and sent with the data to the server, so far I know the server needs to know the original data with which the MAC was created in order to re-create the MAC and ...
2
votes
3answers
714 views

In depth security: splitting key in different places

I use AES encryption on a website. At the moment, the key is stored in the source of the PHP script that does the encryption/decryption process thanks to openssl. I know that it isn't secure, so I ...
9
votes
3answers
818 views

AES using derived keys / IVs. Does it introduce a weakness?

I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application. Obviously in order to re-use this key, a unique ...
6
votes
1answer
102 views

What is the best way to manage package signing keys?

I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment. I have initially created a signing ...
4
votes
1answer
632 views

Help understanding PCI-DSS when using password based encryption from automatically generated keys

I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS. We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the ...
2
votes
1answer
166 views

Security of re-encryption with a list of pre-computed password based keys

I have a problem where an encrypted file stored on a server needs to be decrypted through a precomputed list of passwords that are used one time only - OTP applied to encryption basically. The file is ...
3
votes
1answer
226 views

What dangers are there in storing my private key on different servers?

This question is specifically concerned with storing keys in the cloud, and is somewhat applicable. But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and ...
1
vote
1answer
545 views

How to protect encryption key while application is using it

I made an J2SE application that uses AES (in CBC mode using BouncyCastle library) to encrypt application config file & some user provided files. I stored the raw AES key in a file that is ...
0
votes
3answers
1k views

Are there flaws in this simple key exchange?

I'm reviewing for a computer security exam. Here is a simple scenario: Suppose that someone suggests the following way to confirm that the two of you are both in possession of the same secret key. ...
4
votes
1answer
284 views

Storing License Keys

I'm creating an application which generates licenses key and stores this in a database (the licenses are checked online). I don't wish to store these license unhashed, in case the database is stolen. ...
4
votes
3answers
257 views

Security in wireless ad hoc sensor network (without physical access)

I want to know without taking physical access, what are the methods that can steal the data in a node. When talking about eavesdropping, how can an attacker sniff the packets? Do they need to listen ...
14
votes
2answers
7k views

Best Practice: “One per-user ssh key” or “multiple per-host ssh keys” [duplicate]

Possible Duplicate: What’s the common pragmatic strategy for managing key pairs? I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when ...
3
votes
4answers
1k views

Asymmetric crypto: Decrypt own messages without having private key

I have built a messages system for my website. Users can send the admin messages which are stored in the DB after being AES-encrypted. I think that using asymmetric crypto (RSA through openssl) ...
5
votes
2answers
5k views

Creating user specific authentication methods in SSH

I have configured sshd on an Ubuntu server to use key authentication and it is working fine. I had to disable password authentication for key authentication to work. Server is always accessed via ...
14
votes
2answers
4k views

What is a Yubi key and how does it work?

How do Yubi keys work? Are there any alternatives?
1
vote
1answer
160 views

How dependable can data encryption be without re-entry of password on startup?

I posted a comment awhile back, and thought I would turn it into a question. Example: There is a feature in the Microsoft SQL Server for full database encryption, which seems to have an option that ...
1
vote
1answer
805 views

How do I securely store and retrieve a many-time use key?

I am performing some symmetric database encryption/decryption in .net. I am using a single 256 bit private key. (1) Where do I store this key when not in use? (2) How do I securely retrieve this ...
4
votes
3answers
1k views

What does it mean for a digital certificate to be “signed”?

When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
1
vote
1answer
630 views

Smart card compatible with Schlumberger (Gemalto) Cryptoflex 16K and USB reader

Another question related to previous ones A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? and About performance of Smard card for performing 3DES in a MD5 hash We need ...
3
votes
2answers
386 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
5
votes
2answers
283 views

Authenticating client without hardcoding key?

A basic question, but I'm not a master and this is puzzling me- How is it possible to authenticate a client from the server's perspective? i.e. imagine you're the server, and you want to give the ...
8
votes
2answers
3k views

Using RSA with 3DES instead of plain 3DES. Does it make sense?

I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And ...
1
vote
1answer
1k views

Google custom Search Engine api key: is it confidential?

Normally, I'd say yes, api keys should be kept secret, and Google's api console even says that. However, I'm just making an ajax get call and all the info is in the clear on my page in order to ...
1
vote
1answer
745 views

What is purpose of --s2k-* GnuPG options? [closed]

When I use gpg --symmetric --s2k- and press tab some options appear: --s2k-cipher-algo --s2k-count --s2k-digest-algo --s2k-mode What do those options do?
3
votes
2answers
835 views

Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?

Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption. Should slow hash function (like bcrypt) be applied to password before using it with ...
8
votes
2answers
2k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.