Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

4
votes
1answer
551 views

Help understanding PCI-DSS when using password based encryption from automatically generated keys

I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS. We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the ...
2
votes
1answer
158 views

Security of re-encryption with a list of pre-computed password based keys

I have a problem where an encrypted file stored on a server needs to be decrypted through a precomputed list of passwords that are used one time only - OTP applied to encryption basically. The file is ...
3
votes
1answer
209 views

What dangers are there in storing my private key on different servers?

This question is specifically concerned with storing keys in the cloud, and is somewhat applicable. But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and ...
1
vote
1answer
502 views

How to protect encryption key while application is using it

I made an J2SE application that uses AES (in CBC mode using BouncyCastle library) to encrypt application config file & some user provided files. I stored the raw AES key in a file that is ...
0
votes
3answers
894 views

Are there flaws in this simple key exchange?

I'm reviewing for a computer security exam. Here is a simple scenario: Suppose that someone suggests the following way to confirm that the two of you are both in possession of the same secret key. ...
4
votes
1answer
278 views

Storing License Keys

I'm creating an application which generates licenses key and stores this in a database (the licenses are checked online). I don't wish to store these license unhashed, in case the database is stolen. ...
4
votes
3answers
245 views

Security in wireless ad hoc sensor network (without physical access)

I want to know without taking physical access, what are the methods that can steal the data in a node. When talking about eavesdropping, how can an attacker sniff the packets? Do they need to listen ...
13
votes
2answers
7k views

Best Practice: “One per-user ssh key” or “multiple per-host ssh keys” [duplicate]

Possible Duplicate: What’s the common pragmatic strategy for managing key pairs? I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when ...
3
votes
4answers
1k views

Asymmetric crypto: Decrypt own messages without having private key

I have built a messages system for my website. Users can send the admin messages which are stored in the DB after being AES-encrypted. I think that using asymmetric crypto (RSA through openssl) ...
4
votes
2answers
4k views

Creating user specific authentication methods in SSH

I have configured sshd on an Ubuntu server to use key authentication and it is working fine. I had to disable password authentication for key authentication to work. Server is always accessed via ...
9
votes
2answers
3k views

What is a Yubi key and how does it work?

How do Yubi keys work? Are there any alternatives?
1
vote
1answer
152 views

How dependable can data encryption be without re-entry of password on startup?

I posted a comment awhile back, and thought I would turn it into a question. Example: There is a feature in the Microsoft SQL Server for full database encryption, which seems to have an option that ...
1
vote
1answer
740 views

How do I securely store and retrieve a many-time use key?

I am performing some symmetric database encryption/decryption in .net. I am using a single 256 bit private key. (1) Where do I store this key when not in use? (2) How do I securely retrieve this ...
4
votes
3answers
1k views

What does it mean for a digital certificate to be “signed”?

When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
1
vote
1answer
597 views

Smart card compatible with Schlumberger (Gemalto) Cryptoflex 16K and USB reader

Another question related to previous ones A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? and About performance of Smard card for performing 3DES in a MD5 hash We need ...
3
votes
2answers
352 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
5
votes
2answers
270 views

Authenticating client without hardcoding key?

A basic question, but I'm not a master and this is puzzling me- How is it possible to authenticate a client from the server's perspective? i.e. imagine you're the server, and you want to give the ...
8
votes
2answers
2k views

Using RSA with 3DES instead of plain 3DES. Does it make sense?

I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And ...
1
vote
1answer
952 views

Google custom Search Engine api key: is it confidential?

Normally, I'd say yes, api keys should be kept secret, and Google's api console even says that. However, I'm just making an ajax get call and all the info is in the clear on my page in order to ...
0
votes
1answer
665 views

What is purpose of --s2k-* GnuPG options? [closed]

When I use gpg --symmetric --s2k- and press tab some options appear: --s2k-cipher-algo --s2k-count --s2k-digest-algo --s2k-mode What do those options do?
3
votes
2answers
776 views

Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?

Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption. Should slow hash function (like bcrypt) be applied to password before using it with ...
7
votes
2answers
2k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
10
votes
2answers
2k views

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository, with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or ...
7
votes
2answers
2k views

PCI Compliant Key Management solutions that don't cost a fortune

We are relatively small software company who has a requirement to store PAN's for our customers. Hosted payment solutions just don't fit our product requirements. We literally have 3 lines of ...
3
votes
1answer
331 views

Hybrid key management doing it wrong?

I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
9
votes
3answers
7k views

What is the DUKPT Key Derivation Function?

I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
29
votes
4answers
5k views

How can PrivateSky not see your data?

PrivateSky is a website that promises encrypted "cloud-like" secure information exchange. They promise that except the sender and receiver, nobody can see your data. After testing it yesterday, I do ...
0
votes
1answer
1k views

What are the potential vulnerabilities in a SAML-based SSO approach?

What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
3
votes
1answer
236 views

How secure is to store encryption keys or SSH Keys on LPAR?

I want to store SSH keys (used to connect to some devices that have sensitive data) and the encryption/decryption keys of a database application. They will be inside a LPAR (logical partition) in our ...
3
votes
1answer
735 views

How to use DPAPI under load balance environment

DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on ...
21
votes
2answers
10k views

where to store a key for encryption

I am looking for a way to store a key used for password encryption. I am using a mysql db which would store a user name and an encrypted password that would be encrypted using ...
7
votes
4answers
1k views

can ssh passwordless public key authentication be ok if combined with a VPN?

Having a debate with a coworker about the merits & faults of public key authentication with ssh. I'm basically wondering what all the possible merits and faults are, especially in regards to ...
6
votes
2answers
1k views

How do open source projects handle secure artifacts?

Specifically, how are things like keystores handled, or other items needed to build or run an app? In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web ...
4
votes
2answers
2k views

How to store IV and key temporarily but securely

I am using .NET 4.0 to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once ...
3
votes
1answer
1k views

Storage of 'secrets', keystores, HSMs and the rest

I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
6
votes
3answers
129 views

Should I make sure to get all of my OpenPGP uids are signed?

Should I make sure that I get all of the uids associated to my OpenPGP key signed, or is it enough to have one of them signed? If Bob can guarantee that alice@example.com belongs to Alice, I can't ...
5
votes
4answers
352 views

How do you guarantee that you don't lose a keyfile?

I am toying with the idea of adding keyfiles to various things that I encrypt. However what's been keeping me from adopting them is guaranteeing that I don't lose the keyfile while still keeping ...
20
votes
3answers
2k views

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single ...
6
votes
1answer
3k views

Creating a “key server” (HIPAA compliance with AWS)

I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to ...
6
votes
2answers
656 views

What happens if two parties have a same pair of public&private keys

we know that we have to create Private key on server and generate its public key and create a certificate. But what if we get a private key which someone already has. Isn't the security becomes weak ...
6
votes
3answers
3k views

How can I convert my encypted PGP secret key for use performing SSH authentication?

I wish to covert my PGP key (RSA) to be used performing SSH authentication. After some searching, I found openpgp2ssh, which appears to be an appropriate tool. Everything works swimmingly for my ...
11
votes
4answers
4k views

Does symmetric encryption provide data integrity?

Let's say I have one server that encrypts a file with a symmetric key, e.g. AES-CBC, and sends it to clients that decrypt it. Does that provide data integrity when decrypted? Or is it possible for ...
9
votes
5answers
8k views

What does “key with length of x bits” mean?

I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
6
votes
1answer
142 views

Creating a Private Key using Human Intervention

In a hypothetical system, lets say that a design requirement is that people who snoop around the database of a web application (sysadmin gone rogue, or what have you), do not have access to the plain ...
2
votes
3answers
2k views

RSA 4096 with AES 256 Encryption Process Using PyCrypto

I have the following process for encrypting and decrypting data in a python script using the PyCrypto module: Encryption - Server A AES 256 shared key is generated Associated IV is generated Data ...
15
votes
3answers
6k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
13
votes
2answers
3k views

What's wrong with storing private keys in the cloud?

I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
1
vote
2answers
962 views

Need example and working Security Token Service (STS)?

Can anyone explain or post any link to a simple example and introduction about the Security Token Service (STS)?
6
votes
2answers
278 views

How protective should we be of an SSL client certificate?

We've got an application where the database connection requires an SSL client certificate. How protective do we need to be of this certificate? What are the implications if someone else gets it? I ...
26
votes
3answers
7k views

What useful things can I do with the html5 “keygen” element?

There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari. Here's what it looks like: <form action="processkey.cgi" method="post" ...