Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

2
votes
1answer
353 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strength? (PBKDF2 as both ...
11
votes
2answers
5k views

Is it secure to transfer an RSA public key by email?

I've set up my VPS'ssh server to accept only key-based identification: I disabled password-based connection. As a consequence I am connecting from home with an RSA key generated prior to password ...
4
votes
2answers
591 views

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 [...
11
votes
4answers
1k views

What to do when you can’t protect mobile app secret keys?

We have a mobile app for iOS and Android available in the Apple and Google Play stores. The app communicates with our server’s Web Services over HTTPS. We have attackers able to spoof the app traffic....
3
votes
1answer
14 views

Creating subkeys for an existing OpenPGP key

I have an existing OpenPGP key which has been used infrequently. All capabilities appear to be bound to the master key, there are no subkeys. /home/user/.gnupg/pubring.gpg ---------------------------...
0
votes
1answer
17 views

Replace certificates simultaneously on remote servers?

A third party server sends us signed messages that we verify. When its certificate is about to expire, the third party generates a new key pair and sends us the new certificate. At some point, the ...
3
votes
2answers
921 views

How to securely store sensitive data on mobile application?

I want to develop a mobile bank app (Windows Phone, Android, iOS) that interact with a bank channel. First time when user opens application the key exchange process begins and at end of this process ...
4
votes
2answers
1k views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
11
votes
3answers
3k views

Additional security of keyfile on top of a master password for KeePass

I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model. However my biggest remaining concern is the ...
2
votes
2answers
61 views

Why use dedicated SSH keys for different hosts (like GitHub)?

I recently discovered github-keygen, a tool that helps you set up SSH for use with GitHub. One of the things the tool does is to create a new SSH private key dedicated to GitHub exchanges; the manual ...
3
votes
1answer
61 views

Question about AES-CBC IVs

I'm writing a Java program that encrypts strings with AES-CBC encryption. (Eventually I'm going to add steganography functions too). As you are well aware, CBC needs an IV in order to encrypt the ...
4
votes
1answer
77 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
0
votes
0answers
17 views

How can I create many-to-one keys in Doctrine/Zend/PHP?

I'm using Zend with Doctrine 2 to store data in a database. For a given user, I encrypt the data with a randomly-generated key specific to that user, and encrypt the key with that user's password ...
1
vote
2answers
87 views

Suggestion on asymmetric (hybrid encryption) encryption for big file

We will be using following commands to encrypt to firmware file at server and that will be decrypted on the embedded board using decryption command mentioned below, Following command will be used to ...
1
vote
0answers
23 views

Key distribution for zeromq [closed]

We're evaluating zeromq for a publisher/subscriber model where the publisher could change after each session. The public keys have to be distributed in advance. It seems that zeromq has its own ...
0
votes
1answer
48 views

Grabbing ChaCha20 key from ram

There are various other posts which talk about grabbing a key from ram such as http://electronics.stackexchange.com/questions/198274/storing-a-secure-key-in-an-embedded-devices-memory How would you ...
3
votes
2answers
789 views

Protecting decryption key on server

What is the most suitable way to encrypt and decrypt sensitive data on a public cloud server disk without storing the decryption key on the server in plaintext? REQUIREMENTS In our SaaS web/mobile ...
1
vote
1answer
58 views

Key rotation benefits of a multi-key hierarchy

I think I have a decent grasp of the problems associated with key rotation, and as I'm working through them determining an approach for key management on an application I keep stumbling up against ...
4
votes
1answer
215 views

Does RekeyLimit property in sshd_config enforce re-keying / key re-exchange?

I have set the RekeyLimit property in sshd_config and tried to perform a SSH. However, I could not see rekeying happening in the verbose logs, all I see is the log message below at the start of the ...
9
votes
4answers
608 views

Print or burn encryption key? [duplicate]

I'm thinking of setting up a cloud backup for home computers, and to increase privacy I want to encrypt the data with my own encryption key. The "cloud" would give me a chance to restore data in ...
5
votes
1answer
96 views

Can you extract the encryption key of a computer with full disk encryption via malware?

I recently discovered the subject of cold boot attacks which are able to extract the encryption key of the ram memory after the computer has shut down. and from what I understand is that law ...
0
votes
0answers
29 views

I want to deploy from GitLab to AWS - so where exactly do I store my private key?

This seems like an odd and simple question, but I'm trying to get my head around the principle of "never check a private key into version control". I'm trying to build a startup of sorts, where ...
-1
votes
2answers
54 views

Store encrypted data locally on the phone that the Android and iOS app itself decrypts

I have an iOS and Android app where our "secret sauce" is a bunch of numbers (weights, actually) stored in a database. Our app uses these numbers to compare what the user of the app has given it, and ...
-1
votes
1answer
31 views

Safest place to store a credential/key on iOS Android device?

I'm developing a game which has an accounting system very similar to the one used in Geometry Dash, where the user can also upload levels or vote on them, without the need to be registered with an ...
10
votes
2answers
457 views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
2
votes
3answers
140 views

Are there any systems to mitigate the risk of losing a Signing Key?

I want to design a system that hinges on ECDSA. All messages are signed using the algorithm, and this is used to prevent spoofing. However, if a user were to somehow lose control of their key, they ...
66
votes
3answers
12k views

Why shouldn't I bring a computer to a key-signing party?

I'm looking at the event description for the key-signing party at an upcoming BSD conference, and it's mentioned that I shouldn't bring my computer in to the event: Things to bring no ...
0
votes
1answer
153 views

Is this a good scheme for storing encrypted user credentials?

We are building a service that manages multiple user accounts. For that reason, we need to store the credentials to a user's accounts using a symmetrical algorithm so they can be retrieved for the ...
20
votes
1answer
10k views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
4
votes
1answer
127 views

Centralized key management for IOS and Android Code Signing

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines. I see systems like ...
0
votes
1answer
101 views

Questions on the variations of RSA keys

I've built a simple application that reads in an RSA key, checks the header and starts identifying properties of the RSA key to make sure it is valid (Using child_process in express to run $ ...
0
votes
2answers
101 views

C# .Net most secure way to store RSA Key Pair in Windows

At the moment I am looking into the most secure way to store a private RSA key on Windows. Making it as much usable for the end user as possible, while keeping the security to its highest. As this ...
56
votes
5answers
175k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
1
vote
0answers
82 views

How to crack (get secret from) Android Keystore System

I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to ...
0
votes
0answers
20 views

Key Distribution Center Key Protocol Analysis

http://i68.tinypic.com/fwu92v.png As shown in the image, why is Circle 1 to be B and Circle 2 to be A? Why is not the opposite, that is, Circle 1 to be A and Circle 2 to be B? like this picture ...
3
votes
1answer
43 views

Relatively simple OTP code generated by SafeNet MobilePass

I noticed something peculiar while logging into the VPN of the company I work for. I generated a one-time passcode from MobilePass, and the code displayed was “010010”. I captured an image of this ...
4
votes
1answer
78 views

What medium for storing full-disk encryption keys is easy-to-use as well as easy-to-destroy?

If I were to frequently work on sensitive data on a LUKS partition and wanted to be able to quickly destroy the keys to it, I figure it would make sense to— encrypt that partition with a key file, ...
0
votes
1answer
31 views

Why must the master key be stronger than the session key?

If I am going to use a master key to generate a session key, the master key must be "stronger" than the session key. For instance, I should not be distributing a 128-bit AES keys with a 56-bit DES ...
2
votes
1answer
56 views

How to manage employee OpenPGP keys?

I am trying to create a secured policy for storing and maintaining keys between users of my company. I am rather new to OpenPGP and thus need some advice. Currently, the idea is: Generate a master ...
5
votes
4answers
9k views

Extracting the PGP keyid from the public key file

Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block? I found the hexa value of the key in the binary file, but I guess the position is based on ...
1
vote
0answers
27 views

Dynamic Key Management in WPA through Radius server

Can anybody tell me in detail (or provide good links), how the dynamic key management is done by the authentication server in WPA? In other words, let's say I gave my credentials to the authentication ...
0
votes
0answers
67 views

How do I securely encrypt and store database encryption keys? [duplicate]

I have a database with encrypted information, and want to encrypt each entry with a different key. Then I want to store the encrypted keys in another database. I know I have to encrypt the keys before ...
0
votes
0answers
115 views

Secure Handshake and register for Auth

The registration The Start - pre-authentication Let's assume there are Alice and Bob. They know each others public keys and each of them generates a random string - Bob's Bobkey and Alice's Alicekey....
0
votes
2answers
43 views

Does PKI signature verification require secure distribution of public keys?

I'm looking at a software project where the GPG public keys of the maintainers are found on a website using HTTP. According to the GNU Privacy Handbook, "The signature is verified using the ...
2
votes
2answers
81 views

Is there a difference between getting encryption key versus encrypted data from server in terms of security

Suppose we have web and application servers and trying to encrypt credit card information for our financial web application. Communication between web and app servers are secured through SSL/TLS. Lets ...
5
votes
1answer
129 views

How to share an encryption key between different PHP applications?

I'm working with the php-encryption library to provide integration between two different applications. On one side, I have a corporative application that holds all data from users. This application ...
0
votes
0answers
38 views

Preventing a key from being found by analysis

Lets say Alice wants to send an encrypted message to Bob. They both know a secret key. Alice uses the key to encrypt the message and Bob uses the key to decrypt the message. Now, if the handshake ...
1
vote
2answers
103 views

Does unsecure delivery of keys and certs make a VPN useless?

I had to install an OpenVPN service onto a fresh, disconnected computer, but the keys and certs were delivered through an insecure computer with a highly suspect connection. Let's assume that the ...
14
votes
6answers
23k views

What does “key with length of x bits” mean?

I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
51
votes
4answers
20k views

What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?

Is it better to create a separate ssh-key for each host and user or just using the id_rsa key for all host to authenticate? Could one id_rsa be a malpractice for the privacy/anonymity policies? ...