Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

0
votes
1answer
324 views

PCI 3.6.6 cryptographic key procedures include split knowledge

My question is, if you run your own company and there are no employees and you still qualify under assessment D what do you do in a case like this where it is requiring 2 or more people? On a related ...
0
votes
1answer
40 views

Multiple user encryption-key store

Let's say I have an application that accesses an encrypted datastore, and I want the admins to be able to unlock the datastore upon application startup (and then the application will have access to ...
0
votes
1answer
20 views

One user ID of a trusted key has unknown trust

I observed today that Thunderbird/Enigmail (24.2.0/1.6) does not allow me to select a key for encrypting mails to one of the addresses associated with the key, even though others work. Help sites ...
0
votes
1answer
36 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...
0
votes
2answers
84 views

What are the Standard Practices for Securely Storing Encryption Keys in Databases

I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ? To add a ...
0
votes
3answers
126 views

What are the MitM implications of a stolen client-side private key?

Many VoIP handsets support client-side SSL authentication for auto-provisioning. Unfortunately, some devices must be programmed with their client-side keys. (Keys generated on low-entropy devices are ...
0
votes
2answers
137 views

How do key servers resolve conflicts?

According to the PGP network FAQ While a number of key servers exist, it is only necessary to send your key to one of them. The key server will take care of the job of sending your key to all ...
0
votes
1answer
115 views

What are techniques for end users to select keys on a smartcard?

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy? For example suppose I have a government issued ID that ...
0
votes
2answers
284 views

How to implement shamir's secret sharing algorithm using AES_ENCYRPT

I am using MySQL AES_ENCRYTP() and AES_DECRYPT() to store sensitive details in a database, and currently storing the key in a php file outside of the web root with read access only. The key file looks ...
0
votes
1answer
725 views

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange? Can the server be configured to use weak key sizes for ...
0
votes
1answer
175 views

Key distribution advice

I have been thinking for days about that problem! The application is based on a student system management. I am implementing database encryption on a column level and The encryption occurs at the ...
0
votes
3answers
136 views

Implement server serial key for server software

Me and my friend want to sell game server-side software, but we want some sort of control, over use of that software. For example, we want some sort of serial key system, so only verified/paid ...
0
votes
1answer
566 views

What is purpose of --s2k-* GnuPG options? [closed]

When I use gpg --symmetric --s2k- and press tab some options appear: --s2k-cipher-algo --s2k-count --s2k-digest-algo --s2k-mode What do those options do?
0
votes
1answer
966 views

What are the potential vulnerabilities in a SAML-based SSO approach?

What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
0
votes
0answers
14 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
0
votes
0answers
21 views

What are some of the threat models that affect key mangement? [closed]

I am currently trying to to conduct some research into traditional key management and how we can apply these techniques to use them in the cloud. What are some base threat models I should be trying ...
0
votes
0answers
29 views

Secure data with server and RSA? [duplicate]

the RSA system uses a private key to read the content encrypted with the public key. If I make a game for mobile, and want to save the data : I guess I cannot save the private key on the device. If ...
0
votes
2answers
110 views

Password management [duplicate]

I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
-1
votes
3answers
908 views

Brute forcing ssh keys

My problem is a common one: I deleted my SSH key, and forgot to set rm to point to a .trash file. I have the public key, and I need to get in this server. I am not doing this on anyone else's server. ...
-1
votes
1answer
543 views

GPG advantages / disadvantages, is it useful or secure? [closed]

I thinking about GPG, is very widely used, but is secure? Why and where we using GPG? I found an article from 2002, but is very old.
-1
votes
1answer
32 views

Implementing a product key system?

Say I have a piece software that allows people to download a trial version that can then be unlocked. Would the following steps below be an effective way to implement a key system for unlocking the ...
-1
votes
0answers
20 views

PCI-DSS: Protect any keys used to secure cardholder data against disclosure and misuse [on hold]

How to implement PCI-DSS requirement 3.5? (Protect any keys used to secure cardholder data against disclosure and misuse.) I use a JCEKS keystore, passphrase protected, to store my keys (RSA 2048 ...
-2
votes
2answers
113 views

Is this a possible solution to the impractical requirements of using a One Time Pad?

For the sake of example, lets say there are two people named, Bob, and Jim. The Problem Bob wants to send Jim a long secret message, and he decides to use a OTP to encrypt his message. Both Bob and ...