Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
857
questions
3
votes
1
answer
152
views
Is it reasonable to have the software hold something that the user can't tamper with?
I want to create a piece of software that will hold some information, the program works offline and I want to make sure that information can't be tampered with.
The program can create or alter it's ...
- 133
3
votes
4
answers
2k
views
Rotating storage encryption keys
If I can change the key for my encrypted storage without taking the system offline to re-encrypt the storage or seeing any sign of a background rebuild occurring, it rather implies that what I ...
- 18.6k
3
votes
4
answers
615
views
Generating OpenPGP key pair with restrictions
I intend to generate an OpenPGP RSA key pair where a part (~half) of the private key is as I specify, i.e. a specific string. Are there tools for generating a key pair with such restrictions, or will ...
user1633
3
votes
1
answer
459
views
Are there any known collisions of a "long" (64 bit) OpenPGP key ID?
We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
- 1,710
3
votes
6
answers
890
views
Good way to protect lots of private keys
I'm working on a software which deals with lots (several millions) of RSA private keys. Keysize is 2048, I'm going to store them in database in PEM format.
I want keys to be encrypted to mitigate ...
- 131
3
votes
1
answer
552
views
How do I change the expiry date of an ElGamal subkey?
I have a GPG key which has an ElGamal subkey (elg2048). Frankly, I don't remember why that is or whether I actually need it - I just have it. Now, I've just changed the expiry date of the key overall, ...
- 449
3
votes
1
answer
151
views
Will Adobe have to re-sign all their previous publications?
Adobe recently published their PGP private key by accident. They have now issued a new one. But will they need to re-sign (with their new key) everything that was signed with their old key? As ...
- 625
3
votes
1
answer
3k
views
ECDH vs DH secret key size
In the past couple of weeks I have been reading about DH and ECDH which are key exchanging algorithm to compute a shared secret key. According to advices, it is better to use DH with key size 2048 ...
- 133
3
votes
1
answer
10k
views
What is the the meaning of "out-of-band" in "out-of-band key exchange"?
When we say "out-of-band exchange of symmetric keys", what does "out-of-band" mean?
- 121
3
votes
2
answers
1k
views
Can I store a pair of keys on iOS secure element?
I would like to know if I can use the iPhone's secure element to store a pair of keys. I need to store them in the safest emplacement, and I can't think of a better one than the secure element.
- 83
3
votes
2
answers
2k
views
Envelope Encryption with asymmetric keys vs KMS
In Envelope encryption a symmetric secret key is used to sign the data and then another key is used to encrypt the secret to produce an encrypted secret key. The encrypted messages is packaged with ...
- 163
3
votes
1
answer
3k
views
AES key management
I am encrypting a secret in a db field.
I am encrypting using AES with a 256-bit key and a random IV per encryption.
They AES key is hard coded in the code. Each IV is stored in clear in another ...
- 135
3
votes
2
answers
2k
views
Encrypt+Signing data: PKCS#7 / CMS or do-it-your-own way?
Currently I'm saving an array of AES keys into a keychain as JSON, saved as a text file / SQL text column:
{
[
{
encryptedAesKey:RsaEncryptedBytesBase64Encoded==,
...
- 2,183
3
votes
1
answer
761
views
Hybrid key management doing it wrong?
I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
- 33
3
votes
2
answers
303
views
Encrypting a fixed format message?
I'm planning to send across TWO pieces of information over the internet from machine A
A site identifier which will be like:
$SiteName = "EXAMPLE" (in plaintext)
Encoded text which will be like:
$...
- 1,087
3
votes
1
answer
176
views
Why are key IDs typically the *last* digits of the key hash?
With PGP for example, the "properties" of the following key are:
pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02]
6713B62DC36CE36403C724B1FFD641CF2BD6571B
uid [...
- 33
3
votes
2
answers
2k
views
Is it a good idea to use asymmetric encryption for a chat application?
I am reading design documents of an internal Whats-app like chat application.
Developers are planning to use asymmetric encryption to encrypt all messages.
Every user will have a public/private key ...
- 710
3
votes
1
answer
349
views
Secure high-portability way to store passwords?
I'm developing a cross-platform Java desktop application which uses a password to derive a cryptographic key. I'd like to add a "Remember me" feature that stores this cryptographic key on the hard ...
- 183
3
votes
1
answer
11k
views
How to store openssl CA private key securely [duplicate]
We are in the phase of implementing SSL certificates for UI access to our components (we have an internal Root CA to whom we send the CSR generated in openSSL) and we're wondering where would be the ...
- 1,578
3
votes
2
answers
604
views
What is sent between an HSM and an application?
When an application calls an HSM using PKCS#11/KSP/etc. what is actually exchanged between the two? For example, if a CA needs to sign a CRL, is the entire CRL actually sent to the HSM for signing?
- 33
3
votes
3
answers
3k
views
Hardware-backed Keychain for iOS and Android
I'm researching on hardware-backed keychain for iOS and Android, in order to store some certificates in hardware rather than software. According to Android docs (https://source.android.com/security/...
- 441
3
votes
1
answer
1k
views
How to import primary secret key from backup into GnuPG?
I've seen "Re-import secret primary key in GnuPG" which is pretty much the issue I'm seeing, but I haven't had any luck with GnuPG 1.4.20 (from GPGTools) or GnuPG 2.1.
Even if I delete my entire ~/....
3
votes
1
answer
370
views
Recommendation Key Management and Storage in Cloud Storage
I am currently researching about key management in the cloud storage and looking for alternative for it. The current system stores encryption key for each file in the server and each key is encrypted ...
- 133
3
votes
1
answer
2k
views
PKCS#11 session object security
The CKA_TOKEN attribute identifies whether the object is a token
object or a session object.
We can believe that when the PKCS#11 object has CKA_TOKEN attribute set to true, then it is securely ...
- 1,119
3
votes
1
answer
5k
views
How to process or manage Key-Encryption-Key using HSM?
Let's consider two Encryption keys:
1.Data-Encryption-Key(DEK)
2.Key-Encryption-Key(KEK)
KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
- 615
3
votes
1
answer
232
views
Advice on using encryption for self training app
I am self training on using encryption. I am a php developer and in my spare time I am building an online app that provides basic cms features to help me understand encryption design more. I am using ...
- 73
3
votes
1
answer
350
views
Is sharing private key with CDN dangerous?
When you use a Content Delivery Network (CDN) and want to enable HTTPS, you need to import your certificate there. So you should provide your Private Key to the CDN. Is this secure? I mean CDN can log ...
- 169
3
votes
3
answers
3k
views
How to get PGP key passphrase out of Thunderbird?
I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it ...
- 89
3
votes
1
answer
786
views
Why is Debian not showing the GPG signatures on keys that Arch Linux is?
I downloaded a Qubes OS ISO and I'm trying to verify its legitimacy using this guide. GPG was behaving weirdly, so I created a separate user with a separate keyring to reproduce the issue.
When I try ...
- 167
3
votes
1
answer
247
views
Why do people check the passport on key signing events?
I find the common procedure of key signing parties a little awkward:
Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
- 131
3
votes
1
answer
382
views
Does GnuPG check for revocation certificates on keyserver automaticaly?
If a key was revoked, I may not know if the revocation key was published just after I downloaded the key with gpg --recv-key.
Does GnuPG grant that it is up to date before using a key? Or do I need ...
- 349
3
votes
2
answers
187
views
Is there a difference between getting encryption key versus encrypted data from server in terms of security
Suppose we have web and application servers and trying to encrypt credit card information for our financial web application. Communication between web and app servers are secured through SSL/TLS. Lets ...
- 33
3
votes
1
answer
695
views
Should I revoke & regenerate PGP private keys after computer is serviced by Apple Store?
I recently had an issue with my MacBook where it wouldn't boot. So I took it in to the apple store, and they said that they would need to send it off to a service center to diagnose and repair it. I ...
- 1,359
3
votes
1
answer
309
views
Multiple OpenPGP encryption keys signed by a single certificatation key?
Say I have several different email accounts and I want to use a different encryption key for each of them but still have them all certified under one identity. Is this a good idea and how would I do ...
- 297
3
votes
1
answer
4k
views
Is adding apt keys using wget secure?
Many (I would even say most) projects that have Debian repo give instructions like this (https://www.dotdeb.org/instructions/):
3. Fetch and install the GnuPG key
wget http://www.dotdeb.org/dotdeb....
- 289
3
votes
1
answer
1k
views
Is it necessary to remove the primary secret GPG key from your laptop if it has full-disk encryption?
According to a number of articles, e.g. "Creating the Perfect GPG Keypair," it is advisable to have a number of subkeys in your GPG key, one for encryption, and one for signing, and then to (a) back ...
- 1,359
3
votes
1
answer
822
views
Security implications of setting the same password on private key and PKCS12/JKS?
Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
- 133
3
votes
2
answers
2k
views
Verifying the authenticity of a public key without manual intervention?
In RSA encryption it is said that ensuring the authenticity of the public key can be as important as the protection of the private key.
An effective way of doing this is to have key custodians ...
- 4,025
3
votes
2
answers
5k
views
DUKPT - Sample data other then in X9.24
I wrote some code that does PIN encryption/decryption according to rules in X9.24.
It works great with examples provided in ANSI doc, but doesn't work with actual device from the client.
Where can I ...
- 131
3
votes
1
answer
2k
views
How can I store and manage my GPG key pair securely?
I've taken measures and thoughts on how to securely store and manage my key pair. In the process of it a few questions arose, which I'm not capable of answering yet. My key pair will be used to ...
- 33
3
votes
2
answers
626
views
OpenPGP keys on smartcard: what is the real-world security gain of keeping master key offline?
When keeping OpenPGP keys for daily use on a smartcard (a Yubikey, say), what are, from a security point of view, the advantages of keeping the master key offline as compared to simply keeping the ...
3
votes
1
answer
430
views
Why are passphrases protecting GPG / SSH private keys needed? [duplicate]
SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed ...
- 6,015
3
votes
2
answers
586
views
Proper security for IoT device
I'm developing a product with simple Cortex-M MCU (with no OS on board, firmware on bare metal) and internet connectivity via external module.
How do I make it secure? More specifically, how do I ...
- 133
3
votes
3
answers
373
views
Using a windows partition as a decoy
I'm interested in setting up a laptop that dual boots Windows 7 and openSUSE. The plan is to encrypt the openSUSE partition and require a USB thumb drive with the encryption key for it to boot. Where ...
- 33
3
votes
3
answers
2k
views
How to manage PGP private keys?
I am trying to find out a way to protect files that will be stored on a drive accessible to the public. Using permissions is not an option in this case, so I am planning to encrypt the files using PGP ...
- 1,097
3
votes
2
answers
217
views
How do we change the public key in our commercial app?
We have a commercial library that uses a public key to sign an XML request that goes up to our license server. The response that comes back is XML that has been signed with our private key, and the ...
- 503
3
votes
1
answer
902
views
Storing encryption keys [closed]
Think of this scenario:
you've got an application that manages some files
some of these files contain sensitive data that should be encrypted on disk
the application is configured to start by itself ...
- 641
3
votes
1
answer
509
views
Use one subkey for signing + encrypting
I'm phasing out my old OpenPGP key and am creating a new one. I plan to lock away the main key and do daily work only with subkeys.
The subkeys will be valid for a year and I'll add new ones after ...
- 191
3
votes
1
answer
347
views
private key passphrase protected, symmetric key location
If I protect my private key with a passphrase, then it will be encrypted
Where is the symmetric key stored for it ? Is it somehow in the certificate itself? What if I have specified that it's not ...
- 1,578
3
votes
1
answer
901
views
How secure is data at rest on Android/iOS mobile devices
We have a need to store security keys on a mobile device, i.e. iOS and Android consumer apps. The app uses those keys in an offline scenario to 'self validate' the signatures of its data. (it can also ...
- 141