Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

0
votes
2answers
245 views

What are the Standard Practices for Securely Storing Encryption Keys in Databases

I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ? To add a ...
0
votes
3answers
214 views

What are the MitM implications of a stolen client-side private key?

Many VoIP handsets support client-side SSL authentication for auto-provisioning. Unfortunately, some devices must be programmed with their client-side keys. (Keys generated on low-entropy devices are ...
0
votes
1answer
201 views

What are techniques for end users to select keys on a smartcard?

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy? For example suppose I have a government issued ID that ...
0
votes
2answers
546 views

How to implement shamir's secret sharing algorithm using AES_ENCYRPT

I am using MySQL AES_ENCRYTP() and AES_DECRYPT() to store sensitive details in a database, and currently storing the key in a php file outside of the web root with read access only. The key file looks ...
0
votes
1answer
1k views

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange? Can the server be configured to use weak key sizes for ...
0
votes
1answer
247 views

Key distribution advice

I have been thinking for days about that problem! The application is based on a student system management. I am implementing database encryption on a column level and The encryption occurs at the ...
0
votes
3answers
194 views

Implement server serial key for server software

Me and my friend want to sell game server-side software, but we want some sort of control, over use of that software. For example, we want some sort of serial key system, so only verified/paid ...
0
votes
1answer
2k views

What are the potential vulnerabilities in a SAML-based SSO approach?

What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
0
votes
1answer
74 views

Safely encrypting data received through HTTPS

I am receiving sensitive data over an HTTPS connection and need to store this on disk, encrypted so no one can tamper with it, but for reading later on. Each user in the system has a password. The ...
0
votes
0answers
45 views

Is it dangerous to use the same key (RSA) for both encryption (PGP) and authentication (SSH)?

Alice wants to send an encrypted message to Bob, but she also wants to connect to Carol's server. Are there any dangers associated with using the same RSA key for both PGP and SSH (other than a lack ...
0
votes
1answer
66 views

What are the best practices to store payment processor dev/API keys?

I am integrating with multiple payment processors which have their set of public/private keys. This would be used in conjuction with per user keys, to bill clients. I was wondering what is the best ...
0
votes
0answers
27 views

Distribution of key by server

I have read that in asymmetric cryptography, a system admin can generate key pairs on the server. After that, the users will be given the generated key pairs and this is an efficient way of doing this ...
0
votes
1answer
24 views

JKS is readable without providing a password

I'm at that stage in application development where I'm forced to tinker with openssl and keytool again. I was surprised to find that I could list and export certs from a JKS key store without ...
0
votes
1answer
39 views

Single vs server specific ssh keys?

This question has a bit to do with procedure. Is it better for a person to have one single ssh key pair and share the public key where needed. Alternatively is it better to have server specific keys? ...
0
votes
0answers
14 views

Why do PGP Keys have expiration dates? [duplicate]

I read a tutorial to get started with PGP and so far I understand the importance and the difference between encryption, decryption, signing, and verifying. However, I don't understand why a key has ...
0
votes
0answers
55 views

How should I organize my keys?

Suppose I have a set of computers with variegate level of trust (for example): I fully trust my own desktop pc at home I trust a bit also my smartphone, but I know it could be stolen I trust a bit ...
0
votes
0answers
76 views

How does Spideroak manage encryption keys

I'm trying to understand the following from SpiderOak's engineering page (sorry I'm on a mobile phone so have no access to formatting functions like quote blocks): "SpiderOak uses a nested series of ...
0
votes
0answers
93 views

secure key management using smart card

I have a scenario where I want to encrypt the file data on client machine along with smart card authentication. I have followed a link that states that for smart cards, private key never leaves The ...
0
votes
0answers
41 views

RSA, SSLStream - KeyExchange

I'm using sslstream to communicate a client and a server, and i need to use RSA encryption, i have made some tests with a brute keyexchange, using sslStream.write(modulusPublicKey). And receiving like ...
0
votes
2answers
184 views

Security Modules - Hardware vs. Software

In terms of PCI requirements and compliance, is a software-based key management module like Gazzang zTrustee an acceptable solution to the PCI requirements that a (hardware) HSM solution like AWS ...
0
votes
1answer
161 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
0
votes
0answers
29 views

Secure data with server and RSA? [duplicate]

the RSA system uses a private key to read the content encrypted with the public key. If I make a game for mobile, and want to save the data : I guess I cannot save the private key on the device. If ...
0
votes
2answers
160 views

Password management [duplicate]

I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
-1
votes
4answers
106 views

Can I “hide” the private key, while still allowing it to be used?

Let's say you assign SSH keypairs to all users on your system; none of these "low trust" users have root privileges. You want the users to be able to use their keys in SSH connections, however, you ...
-1
votes
2answers
172 views

How to securely store users' private keys? [closed]

I'm building an application that needs to store a public/private key pair generated by the user. What's the best way to do this? Encrypt the private key in the db with some application-generated ...
-1
votes
1answer
78 views

Implementing a product key system?

Say I have a piece software that allows people to download a trial version that can then be unlocked. Would the following steps below be an effective way to implement a key system for unlocking the ...
-2
votes
2answers
140 views

Is this adaptation of using a One Time Pad safe?

For example, lets say there are two people named, Bob, and Jim. Bob wants to send Jim a long secret message, and he decides to use a OTP to encrypt his message. Both Bob and Jim know a secret ...
-2
votes
1answer
788 views

GPG advantages / disadvantages, is it useful or secure? [closed]

I thinking about GPG, is very widely used, but is secure? Why and where we using GPG? I found an article from 2002, but is very old.
-3
votes
1answer
71 views

AES 256 bit key to plaintext conversion? [closed]

I'm a little rusty on cryptography, but I have successfully acquired a 256 bit key that is used for encryption and I want to know if it is possible to reverse it into its corresponding plain text ...