Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

5
votes
2answers
302 views

How are symmetric cryptographic keys stored?

If you have a symmetric key which is negotiated via SRP protocol between a mobile device (e.g. smartphone) and a server, what would be a safe way to persist this resulting key on each side? On the ...
5
votes
1answer
659 views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...
5
votes
2answers
234 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
5
votes
3answers
515 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
5
votes
1answer
1k views

Distributing API Keys to Mobile Apps

I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs ...
4
votes
3answers
611 views

Safe storage service for private keys

Is it currently technically (as opposed to financially) possible to provide a fairly secure means of providing a storage facility for private keys, not excluding physical verification etc? As in, you ...
4
votes
2answers
547 views

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 [...
4
votes
2answers
323 views

Sharing RSA keys between PGP and SSH protocols: Does this pose a security risk?

If I generate a PGP subkey that only has the authentication capablity and use this to generate an SSH keypair to authenticate Git for example, does this pose a security threat? When I do, should I ...
4
votes
1answer
2k views

how to secure Android Market public key

Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
4
votes
4answers
121 views

Proof that client app is using the recipient's public encryption key

I'm trying to implement a web app(lication), which allows to share data automatically with connected users. Data will be encrypted end-to-end asymmetrically on the clients. My first plan was to share ...
4
votes
3answers
152 views

Do I ultimately have to hold a key in my head?

To preface, I'm not an IT security person, just a layman intrigued by the logic. I had this question while reading about Ladar Levison turning a key to his email service on paper to the government. ...
4
votes
1answer
4k views

Storage of 'secrets', keystores, HSMs and the rest

I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
4
votes
2answers
2k views

When should I use Message layer encryption vs transport layer encryption

Basically I will be having to secure a connection between different hops. Therefore even if TLS is widely known to be the best in class, I am wondering that in such a case message based encryption ...
4
votes
1answer
288 views

Unique SSL keys for load-balanced hosts

Given a setup with multiple SSL-terminating load-balancers in a failover configuration, is it a bad idea to have a unique TLS private key for each one of the hosts? They would all share the same FQDN.
4
votes
1answer
2k views

What is purpose of --s2k-* GnuPG options? [closed]

When I use gpg --symmetric --s2k- and press tab some options appear: --s2k-cipher-algo --s2k-count --s2k-digest-algo --s2k-mode What do those options do?
4
votes
1answer
104 views

Infinite one time pads, brute force multiple pads?

So based on my understanding using the same key for encrypting two completely random plain texts when using an otp cipher will still retain perfectly secret. This is based on the answers on this ...
4
votes
1answer
4k views

Is knowing the decrypted and encrypted data enough to find the key?

Let's say an attacker knows the encrypted content, the decrypted content and the algorithm used: can he get the key that was used to encrypt the content or does it make it easier to find the key out? ...
4
votes
3answers
771 views

How can I secure the secret key?

I am a bit confused about securing the secret encyption key. Here is the scenario: I need to encrypt some data (file) This data will be read by a program (say written in C/C++). Both the program ...
4
votes
2answers
192 views

Question about the SessionLock paper

Some time ago there was a big fuzz over Firesheep: by listening to wifi traffic your login session can be stolen which is very bad because now somebody can e.g. send emails on your behalf. Some people ...
4
votes
3answers
467 views

Are there any serious problems with this technique for generating symmetric keys?

I'm using a technique borrowed out of a book by Bruce Schneier and Niels Ferguson called Practical Cryptography. Basically, it boils down to this: Bob does this: pubk_A = Alice's public key ...
4
votes
1answer
245 views

Why use “App Secret” in mobile applications?

I see some SaaS require to import "App Secret" into your application also with "Application Key". I understand the "Applicaton Key", but can not understand the "App Secret". Here is why: I can ...
4
votes
2answers
2k views

Expiration / enforce change of passphrase for private ssh keys

Out of curiosity, and also to check whether this is doable at all: Is there any way using standard tools to assign an expiry date [only] to the passphrase of an ssh private key, or to enforce the ...
4
votes
1answer
168 views

Recommended symmetric key usage period

Let's assume that there are two nodes A and B connected over a network. Both have a single pre-shared symmetric key (e.g., AES-128) and exchange messages. What is the recommended period, until the ...
4
votes
1answer
4k views

How do I share my S/MIME public key?

I have setup S/MIME encryption for my email address, and I'd like to allow people to download the public key from my website, rather than having to first receive an email from me. I want the public ...
4
votes
1answer
3k views

What is the best practice for storing a secret on the cloud?

This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
4
votes
1answer
318 views

What dangers are there in storing my private key on different servers?

This question is specifically concerned with storing keys in the cloud, and is somewhat applicable. But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and ...
4
votes
1answer
452 views

Storing License Keys

I'm creating an application which generates licenses key and stores this in a database (the licenses are checked online). I don't wish to store these license unhashed, in case the database is stolen. ...
4
votes
1answer
573 views

Help on interpretation of FIPS-140 paragraph

This is from the FIPS 140-2 standard: Cryptographic keys stored within a cryptographic module shall be stored either in plaintext form or encrypted form. Plaintext secret and private ...
4
votes
2answers
1k views

DEK, KEK and Master key - simple explanation

This article is intended to be a simplified explanation sans drill-down for people wanting to understand these concepts/terms. What are DEK, KEK and MEK/Master key?
4
votes
1answer
963 views

GPG master key without email address

I would like to create a new GPG key. Going through a couple of thread it seems like the most popular scheme for maximum security is to have an offsite master (sign-only) key which provides a shell ...
4
votes
1answer
1k views

Symmetric key management

I am currently employing GNU Crypto in Java and I am now deciding on the best way to store the keys. The question Storage of 'secrets', keystores, HSMs and the rest has led me to believe the ...
4
votes
1answer
240 views

Key Management for PCI and Payment automation

We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : http://...
4
votes
3answers
285 views

Security in wireless ad hoc sensor network (without physical access)

I want to know without taking physical access, what are the methods that can steal the data in a node. When talking about eavesdropping, how can an attacker sniff the packets? Do they need to listen ...
4
votes
1answer
78 views

What medium for storing full-disk encryption keys is easy-to-use as well as easy-to-destroy?

If I were to frequently work on sensitive data on a LUKS partition and wanted to be able to quickly destroy the keys to it, I figure it would make sense to— encrypt that partition with a key file, ...
4
votes
2answers
209 views

Securing HSM-stored symmetric data encryption keys (AES) in memory on server

My project requires me to encrypt sensitive user data using symmetric data encryption (AES). I will be storing the AES key (DEK) in a HSM-based key management service (ie. Azure Key Vault / AWS KMS) ...
4
votes
2answers
546 views

Signing my certificate by using my smart card and eID card?

In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication. I ...
4
votes
1answer
212 views

Can I ask GPG keyservers to name all keys signed by a particular key?

Given the alleged possibility that an adversary might attempt to acquire my (OFFLINE) Secret Certification Key and Passphrase and sign other keys with it, including a key they made with my User-...
4
votes
1answer
1k views

Help understanding PCI-DSS when using password based encryption from automatically generated keys

I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS. We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the ...
4
votes
1answer
119 views

My OpenPGP private keys are set up with sub-keys. What happens if I revoke a sub-key and re-issue a new one?

I have set up my OpenPGP keys with sub-keys, following the general instructions laid out in "Creating the perfect GPG keypair." The general gist is that you create a "master keypair" which is not ...
4
votes
1answer
58 views

Merge a second OpenPGP key pair into user id of other key

I have OpenPGP key pairs for two of my email addresses. When I created them, I did not know that it was possible to just add another user id to the first key pair. Then I found out it is possible from ...
4
votes
2answers
284 views

How to properly transition from standard PGP keys to using subkeys?

When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like ...
4
votes
2answers
790 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
4
votes
2answers
1k views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
4
votes
1answer
76 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
4
votes
1answer
124 views

Centralized key management for IOS and Android Code Signing

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines. I see systems like ...
4
votes
1answer
210 views

Does RekeyLimit property in sshd_config enforce re-keying / key re-exchange?

I have set the RekeyLimit property in sshd_config and tried to perform a SSH. However, I could not see rekeying happening in the verbose logs, all I see is the log message below at the start of the ...
3
votes
4answers
1k views

Asymmetric crypto: Decrypt own messages without having private key

I have built a messages system for my website. Users can send the admin messages which are stored in the DB after being AES-encrypted. I think that using asymmetric crypto (RSA through openssl) ...
3
votes
1answer
1k views

How to encrypt the data such that only the user (owner) can decrypt them

Here is the system: The client side of our system generates confidential data that needs to be encrypted. Only the user should be able to read them, by that, I mean that even us who managed the data ...
3
votes
4answers
333 views

Are there Ciphers designed to be slow?

To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to ...
3
votes
3answers
4k views

RSA 4096 with AES 256 Encryption Process Using PyCrypto

I have the following process for encrypting and decrypting data in a python script using the PyCrypto module: Encryption - Server A AES 256 shared key is generated Associated IV is generated Data ...