Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

1
vote
1answer
724 views

Smart card compatible with Schlumberger (Gemalto) Cryptoflex 16K and USB reader

Another question related to previous ones A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? and About performance of Smard card for performing 3DES in a MD5 hash We need ...
1
vote
0answers
21 views

Checklist for Data Communication Review in ERP Solution

I am looking out for a checklist for data communication review within ERP application. I understand some of the checks would be related to digital signature, TLS/SSL use, Key Life Cycle management ...
1
vote
0answers
40 views

Manual IPsec and session key(s)

I am evaluating IPsec. I have determined it is best for my case to not use AH (will use PSK for authentication). One issue I have is that at the start there will be no connectivity, so IKE will not ...
1
vote
0answers
24 views

how IKE (Internet Key Exchange) protocol reacts to the replay attack?

I mean how IKE in any mode (quick,aggressive, main) responds to an attacker that tries to replay one or more messages?
1
vote
1answer
56 views

GPG: Detaching Public Subkeys - why can't I do it?

I understand the benefits of using subkeys. I also know that, in the case of private keys it is possible to detach the subkeys from the master key, since there are times when a user may prefer not to ...
1
vote
0answers
33 views

CCM instead of key wrap

Is there any instance of NIST or other encryption standards using AES-CCM to encrypt/authenticate key data? I would like to use CCM over a keywrap function, but cannot find any precedent for this in ...
1
vote
1answer
135 views

Any way to revoke old key pair?

There is a many-year-old 1024 DSA key in the public keyservers under my name. There is a 2048 ELG-E subkey for it. I didn't create these keys, they were created for me by a former employer without my ...
1
vote
0answers
68 views

Clear EFS Cache at Set Interval

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so ...
1
vote
0answers
95 views

AWS IAM User vs STS

I'm trying to better understand the potential of AWS Secure Token Service, and looking for thoughts on how best to solve a particular problem. Let's say I have a bunch of IAM users that are currently ...
1
vote
0answers
219 views

SSH using pre-existing session (symmetric) keys

Is there at present a way to open a SSH connection using pre-existing symmetric session keys? In other words, if I create a list of symmetric keys can I send that list to the recipient on a CD or USB ...
1
vote
0answers
51 views

Key Distribution using multicast

I am trying to come up with a solution for a system where i need to generate a key (Kn) from time to time and distribute it to a large number of servers in a private network. Since it has to be a ...
1
vote
0answers
192 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
0answers
303 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
1
vote
0answers
557 views

How to securely delete an OpenVPN connection profile

I store my OpenVPN profile (keys) in an encrypted drive but I run OpenVPN inside an OS that is not encrypted. When I finish my OpenVPN session and disconnect, the connection profiles are still there ...
1
vote
2answers
725 views

GSM A5/1 encryption: Key management

I'm currently studying the A5/1 algorithm used for GSM encryption. I understood how thanks to the symmetric private Key and a public counter frame one can encrypt the communication between A and B. ...
1
vote
0answers
374 views

Import securely RSA private key through PKCS#11

I have a cryptographic device that supports the following mechanisms: How I could securely import RSA private key into it? Because there is no support for wrap/unwrap using symmetric key is there ...
1
vote
0answers
194 views

“Keyset does not exist” when using SignData function with RSA

"Keyset does not exist". I know that there are tons of question about this error, but mine is totally different. I'm not gona use the key from windows certificate store, but load the public key & ...
1
vote
0answers
116 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
0
votes
4answers
2k views

Brute forcing ssh keys

My problem is a common one: I deleted my SSH key, and forgot to set rm to point to a .trash file. I have the public key, and I need to get in this server. I am not doing this on anyone else's server. ...
0
votes
3answers
629 views

Is using a numbers station to transmit a one-time-pad as key actually insecure?

We all know the two most important problems related to a “one-time-pad”: The one-time-pad needs to be truly random (which I think is logic, as pseudo random generators are quick but predictable). ...
0
votes
2answers
118 views

Safety of Encryption Keys

I'm trying to figure out the best way to encrypt passwords for a forums site I'm working on. I've decided I'm going to use an encryption such as blowfish. From my understanding, you have a key, and ...
0
votes
2answers
139 views

pgp decryption on public pc

When I want to decrypt mails on a public PC (café), encrypted with GPG, in e.g. gmail with the extension "Mailvelope" or equal - how would that be possible? I found tools to run from an USB stick ...
0
votes
3answers
2k views

Are there flaws in this simple key exchange?

I'm reviewing for a computer security exam. Here is a simple scenario: Suppose that someone suggests the following way to confirm that the two of you are both in possession of the same secret key. ...
0
votes
2answers
77 views

How hard would it be to scramble crypto keys in memory on command?

I'm looking for a way locate a set of keys in memory on command. Use case would be cold boot attack prevention: a trigger on rack open, scramble the keys in memory followed by shutdown in full disk ...
0
votes
2answers
157 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
0
votes
1answer
280 views

Password protection of encryption and signature keys

I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code) The basic ...
0
votes
2answers
91 views

What is the meaning of “Key Deletion” operation?

In the context of Key Management and encryption/decryption, what does "Deleting a Key" mean exactly? What are the implications of "Key Deletion", in terms of: Decryption of the old data (i.e. data ...
0
votes
1answer
109 views

I want to store a large number of relatively short-lived symmetric keys

Each encrypted blob will have a well-defined, but different lifetime. Some will be around for 5 minutes, some for a day, some for a week, none for over a month. I would like to be able to "delete" ...
0
votes
2answers
88 views

Securing communications in decentralized network of servers

Lets consider the following setup: One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and ...
0
votes
1answer
61 views

Encyption Key Storage and floating point encryption

I am working on a web application where I need to encrypt some fields based on user configuration and display the decrypted information. The field values can be text or integers or floats. We are ...
0
votes
1answer
32 views

Key Extraction via electrical signal processing

Looking for a link to what I believe was recent research that was similar to "RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis" - but instead of being based on acoustic emanations, the ...
0
votes
2answers
108 views

Can I generate multiple PGP key pairs for later use

I was just wondering if I can generate couple of PGP key pairs and save them for later use or backup. In addition can I be sure that other wont generate and use some of my key pairs in the meantime. I ...
0
votes
1answer
168 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
0
votes
1answer
75 views

MITM protection, key distribution

I want to make sure each of my apps users only get their own data, and that nobody tampers with it or sniffs it in a MITM fashion. Encryption of everything should be the solution, right? But how do I ...
0
votes
2answers
194 views

how to store key securely [duplicate]

I will receive some secret key from server which I will use as an authentication key for a MAC function in the future. But my question is how do I store this key securely on my machine? Will I have to ...
0
votes
1answer
633 views

PCI 3.6.6 cryptographic key procedures include split knowledge

My question is, if you run your own company and there are no employees and you still qualify under assessment D what do you do in a case like this where it is requiring 2 or more people? On a related ...
0
votes
1answer
67 views

Sharing Derived Unique Key Per Transaction (DUKPT) Base Derivation Key (BDK) with a partner

Assumptions: We have devices out in the field injected with keys derived from our one and only BDK. The devices encrypt data using the injected derived key. All our devices connect to our server ...
0
votes
1answer
100 views

Is it secure to not expire keys in symmetric encryption?

Note that this question describe hypothetical case, that is never meant to be used in real world. Server communicates with clients with message structure: client_id, initialization_vector, encrypted ...
0
votes
1answer
51 views

Security without TLS certificates

after getting an answer to Security over multi-streaming such as SCTP i have found that i do not have the capacity to give a public key or certificate to the other end securely (to be sure MitM cannot ...
0
votes
1answer
28 views

Guidelines for time for encryption key regeneration

I am looking at using a third party key distribution protocol. I do not have much details of the internals itself. However I am required to configure the time for regeneration of the (128 bit ...
0
votes
1answer
55 views

Distinguishing between tokens and actual PANs for tokens based on reversible cryptographic functions

I’m researching a possibility of implementing KEK and DEK servers compliant with PCI-DSS requirements. PCI Tokenization Guidelines states: “The tokenization solution should include a mechanism for ...
0
votes
1answer
49 views

PKCS#12 File - security impacts when imported in Web Browser or Windows Store?

When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password. How does the browser or operating system manage this password? Is it secure?
0
votes
1answer
117 views

How are Cloud based HSMs used for Encryption by an application that is on premise (behind the enterprise firewall)?

Amazon CloudHSM (It is Safenet in the backend), Safenet Luna HSM SaaS version and other cloud HSM providers provide Key Management and encryption services on device in the cloud. From my research, I ...
0
votes
2answers
184 views

Key Management/storage system

In my firm we have a couple of thousand hardware devices, installed externally, that all send back data to a central server. They send back data about every hour. Each of these hardware devices ...
0
votes
2answers
82 views

Public Key Transfer between two Applications

I have a Service written in c# which uses asymmetric Encryption to Encrypt Data, and a client application which Decrypts the Encrypted data received from the service. How can I do the following ...
0
votes
2answers
158 views

How to combine a key and a password in practice

Alice wants to encrypt her data. She is not comfortable with using only a password. While she prefers to use a properly random crypto key, she isn't confident she can protect the key file from theft ...
0
votes
1answer
138 views

How can I generate some public and private keys on both sides with low overhead?

We have an Authority Center (CA) generating some public and private keys for each client (more than one pair for each client). One method for sending keys to client is sharing a secret key between CA ...
0
votes
1answer
218 views

Multi user symmetric key encryption

I realize SIMILAR questions have been asked before but I'm looking for certain specifics I can't seem to find elsewhere. The following question closely resembles mine but falls short for me on ...
0
votes
1answer
131 views

Multiple user encryption-key store

Let's say I have an application that accesses an encrypted datastore, and I want the admins to be able to unlock the datastore upon application startup (and then the application will have access to ...
0
votes
1answer
262 views

One user ID of a trusted key has unknown trust

I observed today that Thunderbird/Enigmail (24.2.0/1.6) does not allow me to select a key for encrypting mails to one of the addresses associated with the key, even though others work. Help sites ...