Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
2
votes
2answers
23 views
Change 'Key Usage' of a certificate
Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
7
votes
2answers
1k views
Data Encryption and Key Management in C#
Which route to take, what are the pros and cons, which is more secure..
Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
6
votes
2answers
68 views
Backup schedule for Encryption Keys
How often should encryption keys be backed up?
Should this be done on the same schedule as the encrypted content/configuration? That seems excessive, as the keys do not change as often.
Perhaps ...
5
votes
3answers
77 views
Does IPSec use IKE or ISAKMP?
Does the IPSec protocol suite use IKE or ISAKMP?
RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol ...
6
votes
1answer
1k views
Is SSL key generation client-side, server-side, or both?
Who generates the session keys for a SSL symmetric encryption? Is it the client for both client and server where client generates part of it while the server generates the other part?
11
votes
4answers
1k views
Security of passphrase-protected private key
If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
0
votes
1answer
52 views
PCI 3.6.6 cryptographic key procedures include split knowledge
My question is, if you run your own company and there are no employees and you still qualify under assessment D what do you do in a case like this where it is requiring 2 or more people? On a related ...
4
votes
1answer
118 views
Truecrypt - One keyfile multiple passwords
Is it possible to create one keyfile that opens a Truecrypt volume and this keyfile is protected (aes encryption fe) with a password?
The use case is a True crypt volume accessed by multiple ...
3
votes
3answers
150 views
How to secure SSH such that multiple users can log in to one account?
Consider a generic up-to-date Linux distro hosting a web server. I need three humans to occasionally SSH into the same user account to perform some action that can only be done by that particular user ...
6
votes
6answers
272 views
Is leaking the hash of your encryption key a security risk?
I've been trying to design a simple archive format, that allows me to just bundle a bunch of encrypted files together.
The idea, I currently have is to embed not the encryption key but a truncated ...
3
votes
1answer
81 views
Distributing API Keys to Mobile Apps
I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs ...
4
votes
0answers
171 views
Migrating GPG master keys as subkeys to new master key
Currently I have 3 private GPG pairs which are all master keys.
I want to convert these keys into subkeys for a new key pair (and keep that in the vault).
I have read the following thread ...
1
vote
1answer
64 views
How to have Thunderbird include a root certificate?
An eMail signed via S/MIME also contains the X.509 certificate chain containing the public key in order to directly verify the signature (assuming its issuing CA is deemed trustworthy). The chain does ...
2
votes
4answers
255 views
Why do APIs use API Keys instead of Usernames?
It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
0
votes
3answers
205 views
Brute forcing ssh keys
My problem is a common one: I deleted my SSH key, and forgot to set rm to point to a .trash file. I have the public key, and I need to get in this server. I am not doing this on anyone else's server. ...
1
vote
1answer
126 views
Exchange of DEK and KEK (encryption keys) between app server and key server
In my application, it is required to encrypt a user's data before inserting it into the mysql database. I am using AES algorithm to encrypt the data using a 256 bit hash (and is calling it Data ...
0
votes
2answers
180 views
Where do I securely store application-specific symmetric key?
I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere.
From a similar ...
2
votes
1answer
195 views
What is the best practice for storing a secret on the cloud?
This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
3
votes
1answer
119 views
Symmetric key management
I am currently employing GNU Crypto in Java and I am now deciding on the best way to store the keys.
The question Storage of 'secrets', keystores, HSMs and the rest has led me to believe the ...
10
votes
2answers
1k views
What vulnerabilities could be caused by a wildcard SSL cert?
In a comment on this answer, AviD says:
"There are numerous security issues with wildcard SSL certs."
So, what are the problems? I understand that the same private key is being used in multiple ...
2
votes
2answers
207 views
Encrypt+Signing data: PKCS#7 / CMS or do-it-your-own way?
Currently I'm saving an array of AES keys into a keychain as JSON, saved as a text file / SQL text column:
{
[
{
encryptedAesKey:RsaEncryptedBytesBase64Encoded==,
...
7
votes
3answers
1k views
Additional security of keyfile on top of a master password for KeePass
I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model.
However my biggest remaining concern is the ...
0
votes
1answer
94 views
What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?
Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange?
Can the server be configured to use weak key sizes for ...
5
votes
1answer
276 views
Encrypting sensitive data in software and storing/decrypting it on a server
I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing.
I'm developing software which has 2 parts - a C# program run ...
1
vote
1answer
75 views
How to change (sub)key usage of a PGP key?
gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...
3
votes
2answers
146 views
What is a good general purpose GnuPG key setup?
Since most key types can be used for multiple purposes, namely certification, authentication, encryption and signatures, one could simply use one key for everything - which is a bad idea, as ...
1
vote
1answer
176 views
AES128 and IV for app crypto
We have some columns in some tables that are sensitive and would like to protect them "anyways". Also, since Azure SQL demands application level encryption, we have to roll our own. There would be a ...
6
votes
1answer
239 views
Is it secure to transfer an RSA public key by email?
I've set up my VPS'ssh server to accept only key-based identification: I disabled password-based connection.
As a consequence I am connecting from home with an RSA key generated prior to password ...
0
votes
1answer
92 views
Key distribution advice
I have been thinking for days about that problem! The application is based on a student system management. I am implementing database encryption on a column level and The encryption occurs at the ...
1
vote
3answers
140 views
Validate hmac with hashed stored key
What if an HMAC is correctly generated and sent with the data to the server, so far I know the server needs to know the original data with which the MAC was created in order to re-create the MAC and ...
-1
votes
1answer
136 views
GPG advantages / disadvantages, is it useful or secure? [closed]
I thinking about GPG, is very widely used, but is secure? Why and where we using GPG?
I found an article from 2002, but is very old.
2
votes
1answer
289 views
Where to store Java keystore password?
We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
0
votes
3answers
256 views
How to store a private RSA key for an application?
I was wondering how an application that have a private key will keep it secure?
If the private key is outside the binary, then anybody can access it, but store it in the binary doesn't make it more ...
0
votes
3answers
86 views
Implement server serial key for server software
Me and my friend want to sell game server-side software, but we want some sort of control, over use of that software.
For example, we want some sort of serial key system, so only verified/paid ...
1
vote
4answers
299 views
SSH: reusing public keys and known-man-in-the-middle
Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key):
Best Practice: “One per-user ssh key” or ...
3
votes
2answers
180 views
A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
2answers
210 views
How many GPG keys should I make?
I am learning how to use GPG keys, and I am wondering what is the threshold people generally use to maintain separate GPG keys. Maintaining an incredibly large number of keys is not good since it ...
9
votes
2answers
3k views
where to store a key for encryption
I am looking for a way to store a key used for password encryption. I am using a mysql db which would store a user name and an encrypted password that would be encrypted using ...
4
votes
2answers
2k views
mysql AES_ENCRYPT key length
AES_ENCRYPT uses a 128 bit long key to encrypt the data, but how does mysql handle longer or shorter keys? I found out that pycrypto for instances recomend to transform the key by using md5 sha1 sha2, ...
5
votes
1answer
2k views
Creating a “key server” (HIPAA compliance with AWS)
I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to ...
3
votes
4answers
160 views
Using dynamic keys
It is intuitively clear that, the less materials a cryptanalyst has available to work on, the lower would be his chance of success. This implies that the security of encryption of a message could be ...
20
votes
7answers
1k views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
1
vote
1answer
97 views
Passing generated keys to another process
I am doing a project in which one process generates a key using a distributed algorithm. I need to pass this key to the calling process or procedure. Generally speaking, one can do this in the ...
1
vote
2answers
89 views
How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)
I have a newer private key I have to import into an older server.
How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
17
votes
3answers
2k views
What useful things can I do with the html5 “keygen” element?
There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari.
Here's what it looks like:
<form action="processkey.cgi" method="post" ...
3
votes
5answers
383 views
How can I explain the concept of public and private keys without technical jargon? [duplicate]
Possible Duplicate:
Principle of asymmetric algorithm in plain english
In the spirit of How can I explain SQL injection without technical jargon?, do you have any suggestions on how to ...
2
votes
2answers
309 views
Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?
Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption.
Should slow hash function (like bcrypt) be applied to password before using it with ...
8
votes
2answers
276 views
Key management scheme in PHP that is compliant with NIST SP 800-57
We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management
I wonder if there're any open-source or commercial PHP solutions ...
0
votes
1answer
141 views
Password protection of encryption and signature keys
I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code)
The basic ...
3
votes
1answer
99 views
Key Management for PCI and Payment automation
We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
