Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

3
votes
1answer
45 views

Centralized key management for IOS and Android Code Signing

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines. I see systems like ...
3
votes
2answers
38 views

What is the best way to organize OpenPGP keys?

I've always used OpenPGP as a single private/public pair of keys for (S)igning and (E)ncryption. But learning about OpenPGP subkeys, it's recommended to use separate keys for (C)ertification, ...
0
votes
1answer
72 views

Questions on the variations of RSA keys

I've built a simple application that reads in an RSA key, checks the header and starts identifying properties of the RSA key to make sure it is valid (Using child_process in express to run $ ...
1
vote
2answers
27 views

How to export secret keys from GnuPG including photo IDs?

I'm trying to create an OpenPGP key with a photo ID using GnuPG and then export it, so it can be imported on a different computer. Whatever tests I've done the photo ID never appears after the import ...
-5
votes
0answers
32 views

If there is a fair way handshake secret? [on hold]

If there is a fair way handshake secret key ? I mean such way that it doesn't favour none of site.
4
votes
3answers
445 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
7
votes
2answers
286 views

Building a backdoor for full disk encryption

I have all my data encrypted on my laptop. All the backup hard drives are also encrypted. I know all the keys by heart and I could pick up any disk, enter the password and restore everything with it. ...
0
votes
0answers
3 views

total effective key length of the AESX-192 [migrated]

If I have a AESX-192 be a block cipher which is similar to DESX but has the DES being replaced by AES and the AES key size is 192 bits. How should I compute the total effective key length of the ...
0
votes
1answer
133 views

Tie key to computer

I have client server application. Is it possible to tie an encryption key to some computer (say my client) such that is key is stolen attacker won't be able to use that key from another computer? ...
3
votes
2answers
50 views

Securing HSM-stored symmetric data encryption keys (AES) in memory on server

My project requires me to encrypt sensitive user data using symmetric data encryption (AES). I will be storing the AES key (DEK) in a HSM-based key management service (ie. Azure Key Vault / AWS KMS) ...
10
votes
4answers
6k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
0
votes
1answer
40 views

Securing HSM's Login Keys

I have an PKCS#11 enabled application which interacts with HSM to store TDES keys. The HSM is initialized with the Security Officer (SO) password provided by the user while the application was first ...
1
vote
1answer
63 views

what is the best way to know if the entered decryption key is correct?

I was searching for a way to store the encryption key of AES_ENCRYPT and found a good answer here: where to store a key for encryption However, now I am trying to use "Type in the encryption key when ...
7
votes
1answer
1k views

Has the leaked D-Link windows signing key been revoked?

Recently news broke as to D-Link mistakenly publishing a private code-signing key as part of an open source framework. The D-Link key was leaked in late February, and expired on September 3, it ...
3
votes
2answers
33 views

Comparing allegedly identical OpenPGP keys published through different channels

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like ...
0
votes
2answers
275 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
2
votes
2answers
598 views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
3
votes
1answer
70 views

Does RekeyLimit property in sshd_config enforce re-keying / key re-exchange?

I have set the RekeyLimit property in sshd_config and tried to perform a SSH. However, I could not see rekeying happening in the verbose logs, all I see is the log message below at the start of the ...
3
votes
2answers
21 views

What can I do with the removed Masterkey?

I intend to start using GnuPG respective mail encryption with GnuPG. So I created a key pair with a short expiry date to gain some understanding. I read some stuff about removing the secret masterkey ...
13
votes
1answer
225 views

Yubikey / GPG with OpenSSH signed key

I am currently looking into the possibility of using Yubikey (NEO)'s to store the private SSH keys of my users. By searching the internet I've found several places that explain how you can generate a ...
1
vote
1answer
28 views

What are the Consequences of OpenPGP Key Collisions?

In this answer to GPG keys & SHA-1, there's the sentence: However, since PGP keys are usually generated by their users, collision attacks are not a problem. They might conceivably be a problem ...
25
votes
4answers
7k views
4
votes
2answers
159 views

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 ...
4
votes
1answer
59 views

Infinite one time pads, brute force multiple pads?

So based on my understanding using the same key for encrypting two completely random plain texts when using an otp cipher will still retain perfectly secret. This is based on the answers on this ...
4
votes
1answer
54 views

Merge a second OpenPGP key pair into user id of other key

I have OpenPGP key pairs for two of my email addresses. When I created them, I did not know that it was possible to just add another user id to the first key pair. Then I found out it is possible from ...
3
votes
2answers
160 views

Is android's FDE secure from offline attacks?

Android provides FDE, but it uses lockscreen pin, which is (at least in my case) fairly weak (like a 4-digit PIN). Does it mean that my FDE could be easily broken by offline attack? Or maybe master ...
3
votes
2answers
55 views

Can I store a pair of keys on iOS secure element?

I would like to know if I can use the iPhone's secure element to store a pair of keys. I need to store them in the safest emplacement, and I can't think of a better one than the secure element.
7
votes
4answers
634 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
2
votes
1answer
206 views

Vault Secret server best practices

Recently Hashicorp released a secret management solution called Vault. Which is a free and open source general secret storage, acting as a vault for passwords, encryption keys, and hash salts. I am ...
13
votes
3answers
994 views

How do I protect my OpenPGP key on my computer?

How do I protect my OpenPGP key on my computer? If I make a backup of my private key I will keep it secure, but if someone gets access to my computer he/she will can get all my keys through Kleopatra ...
5
votes
2answers
4k views

MySQL AES_ENCRYPT key length

AES_ENCRYPT uses a 128 bit long key to encrypt the data, but how MySQL handle longer or shorter keys? I found out that PyCrypto for instances recomend to transform the key by using MD5, SHA-1, SHA-2, ...
5
votes
1answer
21 views

Transparent key management for client computers

I'm tasked with adding a backup feature to our software. This backup feature should store the customer's database on external memory. One of the requirements for this feature is that the backup should ...
15
votes
3answers
4k views

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure because if the key is compromised or ...
24
votes
4answers
15k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
5
votes
3answers
6k views

Extracting the PGP keyid from the public key file

Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block? I found the hexa value of the key in the binary file, but I guess the position is based on ...
5
votes
1answer
776 views

What is the “PGP Global Directory Verification Key”?

In the server keys of the MIT, there is several signatures from "PGP Global Directory Verification Key". Example (from http://pgp.mit.edu/pks/lookup?op=vindex&search=0xB63024F96C73DA99): sig ...
0
votes
0answers
35 views

On the Import Client Key screen in Bitvise what is numeric field just next to the Location Profile dropdown?

What is this field for? I know I saved a profile in the beginning, and I want this private key to be attached to just the profile that I'm using, but what on earth is that numeric field for?
3
votes
1answer
62 views

Is the ssh-copy-id command secure?

I have 2 Ubuntu 14.04 servers with openssh-server installed on both. I've set up key-based authentication using RSA keys, without passphrase, so that I can run automated backup scripts, to a remote ...
4
votes
0answers
76 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
1
vote
1answer
65 views

Is it safe to publish my development private key?

For my development environment, the following three SSL files allow me to access my application from https://localhost on my local machine. Private key: server.key Certificate signing request: ...
1
vote
1answer
80 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
0
votes
3answers
131 views

How to store encryption key securely?

Say I have symmetric key which I want to store securely. One way is I will store this key on file system encrypted using user password. Then user at windows startup will enter password which will be ...
1
vote
2answers
212 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
1
vote
3answers
332 views

Prevent or detect key copy

This question can be classified as somewhat two interrelated questions - or two goals. Main aim is basically to authenticate client to server, but remain secure even if someone steals the key from ...
21
votes
5answers
4k views

PCI Encryption Key Management

(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously). I currently ...
16
votes
1answer
7k views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
26
votes
3answers
8k views

What is a good general purpose GnuPG key setup?

Since most key types can be used for multiple purposes, namely certification, authentication, encryption and signatures, one could simply use one key for everything - which is a bad idea, as ...
4
votes
1answer
81 views

My OpenPGP private keys are set up with sub-keys. What happens if I revoke a sub-key and re-issue a new one?

I have set up my OpenPGP keys with sub-keys, following the general instructions laid out in "Creating the perfect GPG keypair." The general gist is that you create a "master keypair" which is not ...
2
votes
2answers
129 views

How often should TLS Session Ticket Keys be rotated?

I am configuring a non-sticky load balanced cluster of HTTPS servers. To enable TLS session resumption when a previous client reconnects to a different server in the cluster I will be configuring ...
-1
votes
1answer
78 views

Why are pgp keys limited to a number of bits?

I am wondering : why does pgp keys have a fixed number of bits. They can be 2048,4096, but why not 56000 or 23 bits ? Is there a specification, or ISO, that was made to limit thoses Keys. Why? If a ...