Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

1
vote
0answers
17 views

CCM instead of key wrap

Is there any instance of NIST or other encryption standards using AES-CCM to encrypt/authenticate key data? I would like to use CCM over a keywrap function, but cannot find any precedent for this in ...
1
vote
1answer
40 views

Any way to revoke old key pair?

There is a many-year-old 1024 DSA key in the public keyservers under my name. There is a 2048 ELG-E subkey for it. I didn't create these keys, they were created for me by a former employer without my ...
1
vote
0answers
15 views

Two keys in ~/.ssh directory [migrated]

I originally had a DSA public key in my ~/.ssh directory on my server id_dsa.pub. The corresponding private key id_dsa is stored on my local machine. I then generated an RSA key pair directly inside ...
1
vote
1answer
33 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strenght ? (PBKDF2 as both ...
0
votes
1answer
21 views

JKS is readable without providing a password

I'm at that stage in application development where I'm forced to tinker with openssl and keytool again. I was surprised to find that I could list and export certs from a JKS key store without ...
0
votes
0answers
25 views

Distribution of key by server

I have read that in asymmetric cryptography, a system admin can generate key pairs on the server. After that, the users will be given the generated key pairs and this is an efficient way of doing this ...
1
vote
1answer
44 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
1
vote
1answer
220 views

Secure private key storage

In light of BadUSB, storing private keys on a USB flash drive is not the best way. What about writing private keys to a CD? What I am worried about is whenever I plug my private key storage device ...
2
votes
2answers
98 views

How to properly transition from standard PGP keys to using subkeys?

When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like ...
0
votes
1answer
35 views

Single vs server specific ssh keys?

This question has a bit to do with procedure. Is it better for a person to have one single ssh key pair and share the public key where needed. Alternatively is it better to have server specific keys? ...
5
votes
1answer
72 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
1
vote
2answers
47 views

Management of server keys

I plan to put an SSH server on micro-controller devices. There shall be many devices distributed in a wide range. The identity of the server is checked with the server key. The server needs to store ...
4
votes
2answers
95 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
2
votes
1answer
233 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
1
vote
1answer
191 views

Protecting decryption key on server

What is the most suitable way to encrypt and decrypt sensitive data on a public cloud server disk without storing the decryption key on the server in plaintext? REQUIREMENTS In our SaaS web/mobile ...
0
votes
1answer
28 views

PKCS#12 File - security impacts when imported in Web Browser or Windows Store?

When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password. How does the browser or operating system manage this password? Is it secure?
-3
votes
1answer
63 views

AES 256 bit key to plaintext conversion? [closed]

I'm a little rusty on cryptography, but I have successfully acquired a 256 bit key that is used for encryption and I want to know if it is possible to reverse it into its corresponding plain text ...
1
vote
1answer
39 views

Bus smart ticketing systems and EMV

I have recently started to study the smart ticketing systems. Most of the modern systems support the use of EMVCo standards for buying tickets in the bus. Also, in each bus usually there are more than ...
24
votes
4answers
3k views

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single ...
76
votes
7answers
36k views

How should I distribute my public key?

I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
11
votes
3answers
2k views

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure because if the key is compromised or ...
0
votes
0answers
14 views

Why do PGP Keys have expiration dates? [duplicate]

I read a tutorial to get started with PGP and so far I understand the importance and the difference between encryption, decryption, signing, and verifying. However, I don't understand why a key has ...
4
votes
1answer
114 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of ...
3
votes
3answers
105 views

Best practices to copy private keys to mobile devices

I would like to copy an ssh key to my Android phone. However, I have displaced the connection cable for my computer. I am looking for a safe way to transfer the key to the device. Obviously, I don't ...
19
votes
2answers
5k views
0
votes
1answer
158 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
68
votes
12answers
12k views

Where do you store your personal private GPG key?

So, I want to start using pass, but I need a GPG key for this. This application will store all of my passwords, which means it's very important that I don't lose my private key, once generated. Hard ...
-1
votes
4answers
95 views

Can I “hide” the private key, while still allowing it to be used?

Let's say you assign SSH keypairs to all users on your system; none of these "low trust" users have root privileges. You want the users to be able to use their keys in SSH connections, however, you ...
3
votes
3answers
151 views

Safe storage service for private keys

Is it currently technically (as opposed to financially) possible to provide a fairly secure means of providing a storage facility for private keys, not excluding physical verification etc? As in, you ...
223
votes
7answers
170k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
3
votes
1answer
237 views

How does firefox sync password recovery work?

According to Mozilla Sync-new-security-model, Firefox servers are not able to decrypt your sync data without your password. So I figured that, the browser generates a key from your password, encrypts ...
1
vote
3answers
73 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
6
votes
5answers
5k views

Does IPSec use IKE or ISAKMP?

Does the IPSec protocol suite use IKE or ISAKMP? RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol ...
11
votes
3answers
3k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
0
votes
0answers
53 views

How should I organize my keys?

Suppose I have a set of computers with variegate level of trust (for example): I fully trust my own desktop pc at home I trust a bit also my smartphone, but I know it could be stolen I trust a bit ...
0
votes
2answers
65 views

Public Key Transfer between two Applications

I have a Service written in c# which uses asymmetric Encryption to Encrypt Data, and a client application which Decrypts the Encrypted data received from the service. How can I do the following ...
0
votes
2answers
103 views

Key Management/storage system

In my firm we have a couple of thousand hardware devices, installed externally, that all send back data to a central server. They send back data about every hour. Each of these hardware devices ...
0
votes
1answer
105 views

How can I generate some public and private keys on both sides with low overhead?

We have an Authority Center (CA) generating some public and private keys for each client (more than one pair for each client). One method for sending keys to client is sharing a secret key between CA ...
0
votes
1answer
63 views

How are Cloud based HSMs used for Encryption by an application that is on premise (behind the enterprise firewall)?

Amazon CloudHSM (It is Safenet in the backend), Safenet Luna HSM SaaS version and other cloud HSM providers provide Key Management and encryption services on device in the cloud. From my research, I ...
2
votes
1answer
44 views

Security implication of exporting private key

I have a key pair stored in GPG Keyring. If I export it to an ASCII Armored format, am I removing any layers of security as long as the exported key stays on the same server as the key ring itself? My ...
3
votes
2answers
246 views

How Securely Store Sensitive Data on Mobile Appliation

i want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a ...
4
votes
2answers
280 views

Continued Use of Kerberos

I posted this question over on Crypto.SE, but didn't get any takers and thought it might be more suited for this site as it were, so I'm cross posting it here. I was recently looking through the Mac ...
4
votes
6answers
3k views

How are ProtonMail keys distributed?

There is a service called ProtonMail. It encrypts email on the client side, stores encrypted message on their servers, and then the recipient decrypts it, also on the client side and the system ...
3
votes
1answer
103 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized ...
1
vote
1answer
137 views

One public key contains all subkeys?

I've created a keypair with gpg2 --gen-key Then I created a subkey only for signing. If I clearly understand the process I have now 3 pub/priv pairs. The master, one for encrypting and one for ...
1
vote
1answer
63 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
18
votes
3answers
2k views

Migrating GPG master keys as subkeys to new master key

Currently I have 3 private GPG pairs which are all master keys. I want to convert these keys into subkeys for a new key pair (and keep that in the vault). I have read the following thread ...
2
votes
0answers
93 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
2
votes
1answer
285 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...