Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

3
votes
4answers
524 views

Generating OpenPGP key pair with restrictions

I intend to generate an OpenPGP RSA key pair where a part (~half) of the private key is as I specify, i.e. a specific string. Are there tools for generating a key pair with such restrictions, or will ...
3
votes
2answers
121 views

Can I store a pair of keys on iOS secure element?

I would like to know if I can use the iPhone's secure element to store a pair of keys. I need to store them in the safest emplacement, and I can't think of a better one than the secure element.
3
votes
1answer
1k views

What is purpose of --s2k-* GnuPG options? [closed]

When I use gpg --symmetric --s2k- and press tab some options appear: --s2k-cipher-algo --s2k-count --s2k-digest-algo --s2k-mode What do those options do?
3
votes
1answer
444 views

Hybrid key management doing it wrong?

I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
3
votes
2answers
221 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: ...
3
votes
1answer
4k views

How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc

Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data? My goal is to allow my application to ...
3
votes
2answers
46 views

Comparing allegedly identical OpenPGP keys published through different channels

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like ...
3
votes
1answer
1k views

How to authenticate in a website with public/private keys?

I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing? ...
3
votes
2answers
1k views

Expiration / enforce change of passphrase for private ssh keys

Out of curiosity, and also to check whether this is doable at all: Is there any way using standard tools to assign an expiry date [only] to the passphrase of an ssh private key, or to enforce the ...
3
votes
1answer
220 views

Can we build a key exchange protocol without certificates?

Assume that the server and the client both has some secret key K. Is it possible to have a key exchange protocol with authentication between them such that MITM attack cannot hold and if the key is ...
3
votes
1answer
76 views

Is the ssh-copy-id command secure?

I have 2 Ubuntu 14.04 servers with openssh-server installed on both. I've set up key-based authentication using RSA keys, without passphrase, so that I can run automated backup scripts, to a remote ...
3
votes
1answer
39 views

Strategy to migrate Passwords securely from one application to another

We are working on a tool that exports data from Source Application "S" to CSV files. These CSV files are manually migrated to box where the Target Application "T" resides. Each line in this CSV is ...
3
votes
1answer
84 views

Should I revoke & regenerate PGP private keys after computer is serviced by Apple Store?

I recently had an issue with my MacBook where it wouldn't boot. So I took it in to the apple store, and they said that they would need to send it off to a service center to diagnose and repair it. I ...
3
votes
1answer
66 views

New certificate but what about the keys?

One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a ...
3
votes
1answer
61 views

Multiple OpenPGP encryption keys signed by a single certificatation key?

Say I have several different email accounts and I want to use a different encryption key for each of them but still have them all certified under one identity. Is this a good idea and how would I do ...
3
votes
1answer
2k views

Is adding apt keys using wget secure?

Many (I would even say most) projects that have Debian repo give instructions like this (https://www.dotdeb.org/instructions/): 3. Fetch and install the GnuPG key wget ...
3
votes
2answers
219 views

Is android's FDE secure from offline attacks?

Android provides FDE, but it uses lockscreen pin, which is (at least in my case) fairly weak (like a 4-digit PIN). Does it mean that my FDE could be easily broken by offline attack? Or maybe master ...
3
votes
3answers
1k views

Storing SSH private keys on an Android device

(I'm not sure if this better belongs on unix.se or android.se, but since it's primarily security-related, I'm asking it here) I use my Android device to access servers for quick on-the-go ...
3
votes
1answer
581 views

Is it important to keep my pastebin developer key private?

I would like for my application to enable users to save their programs to Pastebin through the Pastebin api. This requires a developer key, which is automatically created with each account. Keeping ...
3
votes
2answers
481 views

Verifying the authenticity of a public key without manual intervention?

In RSA encryption it is said that ensuring the authenticity of the public key can be as important as the protection of the private key. An effective way of doing this is to have key custodians ...
3
votes
1answer
28 views

PKCS#11 session object security

The CKA_TOKEN attribute identifies whether the object is a token object or a session object. We can believe that when the PKCS#11 object has CKA_TOKEN attribute set to true, then it is securely ...
3
votes
1answer
73 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...
3
votes
1answer
49 views

Distribution of Application API Token

I wrote a simple twitter client for command-line use. For such application, twitter requires two types of tokens, namely application identification, user OAuth Token. The second one is to allow ...
3
votes
2answers
61 views

What is the best way to organize OpenPGP keys?

I've always used OpenPGP as a single private/public pair of keys for (S)igning and (E)ncryption. But learning about OpenPGP subkeys, it's recommended to use separate keys for (C)ertification, ...
3
votes
1answer
52 views

GPG key expired on mykeyring, but still valid on keyserver

Can someone help me in explaining this: I have an old and expired GPG key, on my keyring the key lists correctly as expired: myself@mypc:~$ gpg --list-sig --fingerprint DDF70E72 pub 1024D/DDF70E72 ...
3
votes
1answer
98 views

Best practice of deprecating old OpenPGP subkeys when migrating to a new subkey pair?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The ...
3
votes
1answer
205 views

PGP Owner Trust Field & Signature Trust Field Distinction

I'm reading Cryptography and Network Security Principles and Practices (5th ed, p584) and reading about PGP keyrings, I'm a little confused about the differences between the owner trust field and the ...
3
votes
2answers
349 views

Is it dangerous to use the same key (RSA) for both encryption (PGP) and authentication (SSH)?

Alice wants to send an encrypted message to Bob, but she also wants to connect to Carol's server. Are there any dangers associated with using the same RSA key for both PGP and SSH (other than a lack ...
3
votes
2answers
50 views

Preventing/Detecting forgery of logs generated in a potentially hostile environment

I have an application that runs on some host machine and generates logs. Later in the day those logs are securely transmitted to my machine. The problem is that while the logs are being generated I ...
3
votes
1answer
317 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
3
votes
1answer
272 views

How secure is to store encryption keys or SSH Keys on LPAR?

I want to store SSH keys (used to connect to some devices that have sensitive data) and the encryption/decryption keys of a database application. They will be inside a LPAR (logical partition) in our ...
3
votes
2answers
869 views

DEK, KEK and Master key - simple explanation

This article is intended to be a simplified explanation sans drill-down for people wanting to understand these concepts/terms. What are DEK, KEK and MEK/Master key?
3
votes
1answer
260 views

How to use subkeys for encryption and signing with Enigmail?

I'm having an issue with Enigmail. Here's an example to highlight my problem. Alice and Bob wish to communicate securely using Enigmail. For extra security, they both decide to create keys using ...
3
votes
1answer
176 views

Can TPM “Storage Keys” be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
3
votes
1answer
58 views

should ~/.cache/keyring-* be cleared?

I am using gnupg 1.4.15 ls ~/.cache/keyring-* shows many keyring directories. GPG_AGENT_INFO variable is pointing only to the latest one. Should I manually delete all the other keyring agents? Is ...
3
votes
1answer
338 views

Best practices for Private Key management

How should I go about handling my RSA Private Key for my high-security Rails web application? This may seem like a "soft" question, not related to cryptography per-se, but is nevertheless very ...
3
votes
2answers
125 views

Management of server keys

I plan to put an SSH server on micro-controller devices. There shall be many devices distributed in a wide range. The identity of the server is checked with the server key. The server needs to store ...
3
votes
1answer
1k views

Key Management: storing encrypted key in database and decrypted key in session variable

Edit: Rephrased title to hopefully get some interest on what I would have thought was a common issue ? I am developing a website using php/mySQL to store non-commercial data and it will be clearly ...
3
votes
2answers
30 views

What can I do with the removed Masterkey?

I intend to start using GnuPG respective mail encryption with GnuPG. So I created a key pair with a short expiry date to gain some understanding. I read some stuff about removing the secret masterkey ...
3
votes
0answers
90 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
3
votes
0answers
400 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
5answers
182 views

Does publishing the md5sum of a private key compromise the private key in any meaningful way?

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an ...
2
votes
2answers
355 views

Can unencrypted keys & logins be kept out of program memory?

No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will ...
2
votes
3answers
1k views

In depth security: splitting key in different places

I use AES encryption on a website. At the moment, the key is stored in the source of the PHP script that does the encryption/decryption process thanks to openssl. I know that it isn't secure, so I ...
2
votes
1answer
240 views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...
2
votes
2answers
435 views

How does Wuala store symmetric key?

As far as I understand Wuala (so called secure cloud storage) is not using the original (user provided) password to encrypt data so what role does original password play in their system? I think they ...
2
votes
1answer
190 views

Passing generated keys to another process

I am doing a project in which one process generates a key using a distributed algorithm. I need to pass this key to the calling process or procedure. Generally speaking, one can do this in the ...
2
votes
1answer
3k views

Are SSH keys and PGP keys the same thing?

I have a 3072 bit RSA key that I generated for use with SSH. Can this key-pair be used with PGP/GPG, or do I need to generate a new pair of keys separately for use in email encryption? Are the two ...
2
votes
2answers
289 views

Using 1-day expiration GPG keys only… any disadvantages?

From the thread Does GPG key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
2
votes
3answers
259 views

AES Key Management / How To Swap Encryption Key

I'm currently using AES 256 for the encryption of my web application and the security policy context specifies that the encryption key must be replaced once every few months. When that happens what ...