Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

2
votes
4answers
2k views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or ...
2
votes
1answer
98 views

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs: Stop using 32bit key ids It takes 4 seconds to ...
2
votes
2answers
138 views

Distributing public keys; with or without a sub-key?

Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does ...
2
votes
1answer
408 views

Using Diffie–Hellman key protocol to create a safe secret key

Let's say, I have a friend far from me and I want to send some secret messages to him. I have to say, I'm pretty newbie in security. That's why I'm wondering, does the Diffie–Hellman key exchange ...
2
votes
1answer
836 views

AES key management

I am encrypting a secret in a db field. I am encrypting using AES with a 256-bit key and a random IV per encryption. They AES key is hard coded in the code. Each IV is stored in clear in another ...
2
votes
1answer
25 views

Multiple OpenPGP encryption keys signed by a single certificatation key?

Say I have several different email accounts and I want to use a different encryption key for each of them but still have them all certified under one identity. Is this a good idea and how would I do ...
2
votes
2answers
242 views

Does a self-signed certificate offer more protection than a public key?

I'm having a hard time finding the practical benefits of transmitting a self-signed certificate over simply a public key. I understand that a self-signed certificate proves the integrity of the public ...
2
votes
2answers
225 views

Expiration / enforce change of passphrase for private ssh keys

Out of curiosity, and also to check whether this is doable at all: Is there any way using standard tools to assign an expiry date [only] to the passphrase of an ssh private key, or to enforce the ...
2
votes
1answer
58 views

Security implication of exporting private key

I have a key pair stored in GPG Keyring. If I export it to an ASCII Armored format, am I removing any layers of security as long as the exported key stays on the same server as the key ring itself? My ...
2
votes
2answers
115 views

RSA key exposure

Is there any limit to the number bytes that an RSA key can be used before it can be exposed. In Symmetric encryption a Key is not recommended to be used to encrypt more than specific amount of data ...
2
votes
1answer
1k views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
2
votes
1answer
182 views

Security of re-encryption with a list of pre-computed password based keys

I have a problem where an encrypted file stored on a server needs to be decrypted through a precomputed list of passwords that are used one time only - OTP applied to encryption basically. The file is ...
2
votes
2answers
3k views

DUKPT - Sample data other then in X9.24

I wrote some code that does PIN encryption/decryption according to rules in X9.24. It works great with examples provided in ANSI doc, but doesn't work with actual device from the client. Where can I ...
2
votes
1answer
581 views

Secure private key storage

In light of BadUSB, storing private keys on a USB flash drive is not the best way. What about writing private keys to a CD? What I am worried about is whenever I plug my private key storage device ...
2
votes
1answer
73 views

SSH key passphrase update and multiply locations

I have a ssh key which I use to upload code to github. the private key is located on several locations from where I upload/download data. I wonder how can I update (or expire) old keys after I update ...
2
votes
1answer
213 views

Is it necessary to remove the primary secret GPG key from your laptop if it has full-disk encryption?

According to a number of articles, e.g. "Creating the Perfect GPG Keypair," it is advisable to have a number of subkeys in your GPG key, one for encryption, and one for signing, and then to (a) back ...
2
votes
2answers
68 views

Can the GPG master secret key be stored as read-only?

Once you have generated your master PGP key, will the "data" in the private key ever change? For instance, if you add another subkey, uid, or any other data to the master key, do these changes need ...
2
votes
2answers
380 views

How to maintain security and trust with a PGP keypair for a team or group of people?

I've seen many instances where a company or organization generates and uses a PGP keypair for a team or group of people. Most likely they all have a copy of the private and public keys on their ...
2
votes
1answer
621 views

How to change (sub)key usage of a PGP key?

gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...
2
votes
1answer
4k views

Where to store Java keystore password?

We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
2
votes
1answer
1k views

How do I securely store and retrieve a many-time use key?

I am performing some symmetric database encryption/decryption in .net. I am using a single 256 bit private key. (1) Where do I store this key when not in use? (2) How do I securely retrieve this ...
2
votes
1answer
1k views

What is purpose of --s2k-* GnuPG options? [closed]

When I use gpg --symmetric --s2k- and press tab some options appear: --s2k-cipher-algo --s2k-count --s2k-digest-algo --s2k-mode What do those options do?
2
votes
2answers
40 views

DEK, KEK and Master keying - simple explentation

This article is intended to be a simplified explanation sans drill-down for people wanting to understand the concept terms. What is DEK, KEK and MEK/Master key ?
2
votes
1answer
37 views

Is it possible re-key OpenVPN on the fly

Is it possible re-key OpenVPN on the fly with a new PSK without killing an restarting it with a new config? it will be started with a PSK but i want to change it soon after start and periodically.
2
votes
1answer
41 views

Best practice of deprecating old OpenPGP subkeys when migrating to a new subkey pair?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The ...
2
votes
1answer
155 views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
2
votes
1answer
115 views

Strategy for encryption before cloud storage

Apologies if this has been asked before. I am looking to encrypt documents before storing in the cloud. There will be a separate metadata storage, which could be either internal or cloud hosted. My ...
2
votes
1answer
49 views

Digital Certificate Repository Integrity

I am trying to figure out if there is an automatic way to determine if a digital certificate repository has been tampered with. Does anyone know of a way to do so?
2
votes
1answer
59 views

Is android's FDE secure from offline attacks?

Android provides FDE, but it uses lockscreen pin, which is (at least in my case) fairly weak (like a 4-digit PIN). Does it mean that my FDE could be easily broken by offline attack? Or maybe master ...
2
votes
3answers
236 views

Best practices for HSM's used by test and production systems

Should a test/demo/non-prod system be prohibited from using the same HSM as production? Since the same master key would be used for both test and prod it seems like it could raise eyebrows but I can't ...
2
votes
2answers
413 views

Where to store a key for system wide encryption/decryption?

I have a web application where (among other things) customers can upload files and administrators can then download those files. The uploaded files are stored on ServerA and the web application used ...
2
votes
1answer
1k views

Storing encryption keys on a server using Node.js and MySQL

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for ...
2
votes
2answers
62 views

How secure is switching keys if breaking the key is an intractable problem?

Let's say that you create a system where a secret is hidden and revealed by a particular key. As well, the key can be broken, but it would take thousands of years. If you keep switching the keys ...
2
votes
2answers
505 views

Why doesn't Bitlocker mix the password with stored key?

Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of ...
2
votes
2answers
717 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
2
votes
2answers
155 views

Is there a hard-to-spoof identifier associated with a physical hard disk

I would like to salt the pass phrase with the drive id in such a way that, if the disk were imaged to a new drive with a different id, (e.g. by a government forensics specialist) then the image would ...
2
votes
1answer
182 views

Where can I find resources to help me implement a key server?

I would like to implement a fairly basic but nonetheless robust key server for generating and managing symmetric encryption keys. Are there guidelines or best practices out there that I should peruse? ...
2
votes
0answers
57 views

Vault Secret server best practices

Recently Hashicorp released a secret management solution called Vault. Which is a free and open source general secret storage, acting as a vault for passwords, encryption keys, and hash salts. I am ...
2
votes
1answer
46 views

How to use subkeys for encryption and signing with Enigmail?

I'm having an issue with Enigmail. Here's an example to highlight my problem. Alice and Bob wish to communicate securely using Enigmail. For extra security, they both decide to create keys using ...
2
votes
1answer
61 views

Can TPM Storage Keys be Created Outside TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
2
votes
1answer
30 views

Merge a second OpenPGP key pair into user id of other key

I have OpenPGP key pairs for two of my email addresses. When I created them, I did not know that it was possible to just add another user id to the first key pair. Then I found out it is possible from ...
2
votes
1answer
26 views

Is it okay to omit the 'Version:' line in a PGP public key? [duplicate]

The software I use to generate my PGP keys doesn't include the 'Version:' line that most PGP software includes by default. Almost every public key I've seen begins like this: -----BEGIN PGP PUBLIC ...
2
votes
0answers
88 views

How is Tresorit client-side encryption key stored and managed?

I am using Tresorit on Mac OS X and iPhone. When I am using it there is always applied client-side encryption before posting the file to cloud. The key used for encryption is AES-256 and CFB mode of ...
2
votes
1answer
427 views

Protecting decryption key on server

What is the most suitable way to encrypt and decrypt sensitive data on a public cloud server disk without storing the decryption key on the server in plaintext? REQUIREMENTS In our SaaS web/mobile ...
2
votes
0answers
125 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
2
votes
0answers
120 views

secure key management using smart card

I have a scenario where I want to encrypt the file data on client machine along with smart card authentication. I have followed a link that states that for smart cards, private key never leaves The ...
2
votes
2answers
90 views

Management of server keys

I plan to put an SSH server on micro-controller devices. There shall be many devices distributed in a wide range. The identity of the server is checked with the server key. The server needs to store ...
1
vote
1answer
214 views

What's the point of public key servers, if they usually don't require any authentication at all upon upload?

Do they offer any benefits at all to the security of key distribution?
1
vote
3answers
131 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
1
vote
2answers
250 views

Using 1-day expiration GPG keys only… any disadvantages?

From the thread Does GPG key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...