Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

3
votes
4answers
3k views

Using dynamic keys

It is intuitively clear that, the less materials a cryptanalyst has available to work on, the lower would be his chance of success. This implies that the security of encryption of a message could be ...
3
votes
4answers
524 views

Generating OpenPGP key pair with restrictions

I intend to generate an OpenPGP RSA key pair where a part (~half) of the private key is as I specify, i.e. a specific string. Are there tools for generating a key pair with such restrictions, or will ...
3
votes
2answers
140 views

Can I store a pair of keys on iOS secure element?

I would like to know if I can use the iPhone's secure element to store a pair of keys. I need to store them in the safest emplacement, and I can't think of a better one than the secure element.
3
votes
1answer
1k views

What is purpose of --s2k-* GnuPG options? [closed]

When I use gpg --symmetric --s2k- and press tab some options appear: --s2k-cipher-algo --s2k-count --s2k-digest-algo --s2k-mode What do those options do?
3
votes
1answer
450 views

Hybrid key management doing it wrong?

I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
3
votes
2answers
223 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: ...
3
votes
1answer
4k views

How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc

Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data? My goal is to allow my application to ...
3
votes
2answers
53 views

Comparing allegedly identical OpenPGP keys published through different channels

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like ...
3
votes
1answer
1k views

How to authenticate in a website with public/private keys?

I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing? ...
3
votes
2answers
1k views

Expiration / enforce change of passphrase for private ssh keys

Out of curiosity, and also to check whether this is doable at all: Is there any way using standard tools to assign an expiry date [only] to the passphrase of an ssh private key, or to enforce the ...
3
votes
1answer
223 views

Can we build a key exchange protocol without certificates?

Assume that the server and the client both has some secret key K. Is it possible to have a key exchange protocol with authentication between them such that MITM attack cannot hold and if the key is ...
3
votes
1answer
81 views

Is the ssh-copy-id command secure?

I have 2 Ubuntu 14.04 servers with openssh-server installed on both. I've set up key-based authentication using RSA keys, without passphrase, so that I can run automated backup scripts, to a remote ...
3
votes
1answer
39 views

Strategy to migrate Passwords securely from one application to another

We are working on a tool that exports data from Source Application "S" to CSV files. These CSV files are manually migrated to box where the Target Application "T" resides. Each line in this CSV is ...
3
votes
1answer
89 views

Should I revoke & regenerate PGP private keys after computer is serviced by Apple Store?

I recently had an issue with my MacBook where it wouldn't boot. So I took it in to the apple store, and they said that they would need to send it off to a service center to diagnose and repair it. I ...
3
votes
1answer
68 views

New certificate but what about the keys?

One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a ...
3
votes
1answer
63 views

Multiple OpenPGP encryption keys signed by a single certificatation key?

Say I have several different email accounts and I want to use a different encryption key for each of them but still have them all certified under one identity. Is this a good idea and how would I do ...
3
votes
1answer
2k views

Is adding apt keys using wget secure?

Many (I would even say most) projects that have Debian repo give instructions like this (https://www.dotdeb.org/instructions/): 3. Fetch and install the GnuPG key wget ...
3
votes
2answers
237 views

Is android's FDE secure from offline attacks?

Android provides FDE, but it uses lockscreen pin, which is (at least in my case) fairly weak (like a 4-digit PIN). Does it mean that my FDE could be easily broken by offline attack? Or maybe master ...
3
votes
3answers
1k views

Storing SSH private keys on an Android device

(I'm not sure if this better belongs on unix.se or android.se, but since it's primarily security-related, I'm asking it here) I use my Android device to access servers for quick on-the-go ...
3
votes
1answer
598 views

Is it important to keep my pastebin developer key private?

I would like for my application to enable users to save their programs to Pastebin through the Pastebin api. This requires a developer key, which is automatically created with each account. Keeping ...
3
votes
2answers
496 views

Verifying the authenticity of a public key without manual intervention?

In RSA encryption it is said that ensuring the authenticity of the public key can be as important as the protection of the private key. An effective way of doing this is to have key custodians ...
3
votes
2answers
82 views

Does TLS rotate the shared secret periodically?

After the initial shared secret is agreed upon between the client an server through the TLS handshake does the shared secret get rotated periodically ?
3
votes
1answer
38 views

PKCS#11 session object security

The CKA_TOKEN attribute identifies whether the object is a token object or a session object. We can believe that when the PKCS#11 object has CKA_TOKEN attribute set to true, then it is securely ...
3
votes
1answer
81 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...
3
votes
1answer
52 views

Distribution of Application API Token

I wrote a simple twitter client for command-line use. For such application, twitter requires two types of tokens, namely application identification, user OAuth Token. The second one is to allow ...
3
votes
2answers
63 views

What is the best way to organize OpenPGP keys?

I've always used OpenPGP as a single private/public pair of keys for (S)igning and (E)ncryption. But learning about OpenPGP subkeys, it's recommended to use separate keys for (C)ertification, ...
3
votes
1answer
54 views

GPG key expired on mykeyring, but still valid on keyserver

Can someone help me in explaining this: I have an old and expired GPG key, on my keyring the key lists correctly as expired: myself@mypc:~$ gpg --list-sig --fingerprint DDF70E72 pub 1024D/DDF70E72 ...
3
votes
1answer
274 views

Vault Secret server best practices

Recently Hashicorp released a secret management solution called Vault. Which is a free and open source general secret storage, acting as a vault for passwords, encryption keys, and hash salts. I am ...
3
votes
1answer
101 views

Best practice of deprecating old OpenPGP subkeys when migrating to a new subkey pair?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The ...
3
votes
1answer
228 views

PGP Owner Trust Field & Signature Trust Field Distinction

I'm reading Cryptography and Network Security Principles and Practices (5th ed, p584) and reading about PGP keyrings, I'm a little confused about the differences between the owner trust field and the ...
3
votes
2answers
358 views

Is it dangerous to use the same key (RSA) for both encryption (PGP) and authentication (SSH)?

Alice wants to send an encrypted message to Bob, but she also wants to connect to Carol's server. Are there any dangers associated with using the same RSA key for both PGP and SSH (other than a lack ...
3
votes
2answers
52 views

Preventing/Detecting forgery of logs generated in a potentially hostile environment

I have an application that runs on some host machine and generates logs. Later in the day those logs are securely transmitted to my machine. The problem is that while the logs are being generated I ...
3
votes
1answer
328 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
3
votes
1answer
273 views

How secure is to store encryption keys or SSH Keys on LPAR?

I want to store SSH keys (used to connect to some devices that have sensitive data) and the encryption/decryption keys of a database application. They will be inside a LPAR (logical partition) in our ...
3
votes
2answers
1k views

DEK, KEK and Master key - simple explanation

This article is intended to be a simplified explanation sans drill-down for people wanting to understand these concepts/terms. What are DEK, KEK and MEK/Master key?
3
votes
1answer
285 views

How to use subkeys for encryption and signing with Enigmail?

I'm having an issue with Enigmail. Here's an example to highlight my problem. Alice and Bob wish to communicate securely using Enigmail. For extra security, they both decide to create keys using ...
3
votes
1answer
185 views

Can TPM “Storage Keys” be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
3
votes
1answer
67 views

should ~/.cache/keyring-* be cleared?

I am using gnupg 1.4.15 ls ~/.cache/keyring-* shows many keyring directories. GPG_AGENT_INFO variable is pointing only to the latest one. Should I manually delete all the other keyring agents? Is ...
3
votes
1answer
349 views

Best practices for Private Key management

How should I go about handling my RSA Private Key for my high-security Rails web application? This may seem like a "soft" question, not related to cryptography per-se, but is nevertheless very ...
3
votes
2answers
130 views

Management of server keys

I plan to put an SSH server on micro-controller devices. There shall be many devices distributed in a wide range. The identity of the server is checked with the server key. The server needs to store ...
3
votes
1answer
1k views

Key Management: storing encrypted key in database and decrypted key in session variable

Edit: Rephrased title to hopefully get some interest on what I would have thought was a common issue ? I am developing a website using php/mySQL to store non-commercial data and it will be clearly ...
3
votes
1answer
59 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
3
votes
2answers
31 views

What can I do with the removed Masterkey?

I intend to start using GnuPG respective mail encryption with GnuPG. So I created a key pair with a short expiry date to gain some understanding. I read some stuff about removing the secret masterkey ...
3
votes
0answers
94 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
3
votes
2answers
750 views

Protecting decryption key on server

What is the most suitable way to encrypt and decrypt sensitive data on a public cloud server disk without storing the decryption key on the server in plaintext? REQUIREMENTS In our SaaS web/mobile ...
3
votes
0answers
413 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
5answers
183 views

Does publishing the md5sum of a private key compromise the private key in any meaningful way?

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an ...
2
votes
2answers
362 views

Can unencrypted keys & logins be kept out of program memory?

No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will ...
2
votes
3answers
1k views

In depth security: splitting key in different places

I use AES encryption on a website. At the moment, the key is stored in the source of the PHP script that does the encryption/decryption process thanks to openssl. I know that it isn't secure, so I ...
2
votes
1answer
260 views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...