Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
9
votes
2answers
3k views
where to store a key for encryption
I am looking for a way to store a key used for password encryption. I am using a mysql db which would store a user name and an encrypted password that would be encrypted using ...
6
votes
1answer
2k views
How can I enumerate all the saved RSA keys in the Microsoft CSP?
I have an application that is creating several keys and storing them in various stores (in this case the Machine store).
How can I enumerate all the keys on a given Windows system?
...
3
votes
2answers
379 views
How do open source projects handle secure artifacts?
Specifically, how are things like keystores handled, or other items needed to build or run an app?
In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web ...
10
votes
6answers
765 views
Shouldn't GPG key fetching use a secure connection?
If I run this for example:
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451
then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) ...
72
votes
3answers
44k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
28
votes
6answers
9k views
How should I distribute my public key?
I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
9
votes
5answers
1k views
Storing private asymmetric key in application binary?
I would like to give a daemon-style process (i.e. no user interaction) access to a shared secret key so that it can access a shared, encrypted data file. User applications accessing the same encrypted ...
10
votes
3answers
740 views
What's the common pragmatic strategy for managing key pairs?
I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH.
Originally when I learned about PKI, I created a single ...
6
votes
5answers
3k views
What does “key with length of x bits” mean?
I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
12
votes
4answers
783 views
Is Steganography considered encryption and subject to USA export restrictions?
I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
5
votes
3answers
468 views
Where do I securely store the key for a system where the source is visible?
I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there.
I've ...
5
votes
2answers
589 views
Generating one-time tokens from API-key?
I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site.
I intend to distribute secret API-keys to ...
3
votes
2answers
503 views
When should I use Message layer encryption vs transport layer encryption
Basically I will be having to secure a connection between different hops. Therefore even if TLS is widely known to be the best in class, I am wondering that in such a case message based encryption ...
8
votes
5answers
7k views
Compute the AES-encryption key given the plaintext and its ciphertext?
I'm tasked with creating database tables in Oracle which contain encrypted
strings (i.e., the columns are RAW). The strings are encrypted by the application
(using AES, 128-bit key) and stored in ...
5
votes
4answers
294 views
How do you guarantee that you don't lose a keyfile?
I am toying with the idea of adding keyfiles to various things I encrypt. However whats been keeping me from adopting them is garanteeing that I don't loose the keyfile while still keeping security.
...
3
votes
2answers
181 views
A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
2answers
157 views
Encrypting a fixed format message?
I'm planning to send across TWO pieces of information over the internet from machine A
A site identifier which will be like:
$SiteName = "EXAMPLE" (in plaintext)
Encoded text which will be like:
...
23
votes
6answers
1k views
Is using a public-key for logging in to SSH any better than saving a password?
Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
19
votes
2answers
3k views
Web Application encryption key management
In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions:
...
5
votes
2answers
708 views
Using TPM with DMcrypt?
Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
12
votes
6answers
624 views
How can the impact of cold boot attacks be minimized?
Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
10
votes
3answers
574 views
Key management in cloud datacenters
In terms of infrastructure, how do Cloud providers (organizations providing SaaS, PaaS, or IaaS via the cloud) manage keys and cryptography?
From my understanding, "private" datacenters tend to ...
9
votes
4answers
2k views
Does symmetric encryption provide data integrity?
Let's say I have one server that encrypts a file with a symmetric key, e.g. AES-CBC, and sends it to clients that decrypt it. Does that provide data integrity when decrypted? Or is it possible for ...
8
votes
3answers
742 views
Security implications of storing the password hash along an encrypted AES key
I am using the PKCS#5 standard to generate a key using a random and unique salt and the user's password in input. Consider this key as the "encryption" key.
The "encryption" key is used to encrypt a ...
8
votes
3answers
25k views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
13
votes
3answers
1k views
What are the chances to generate the same ssh key?
I could generate ssh keys on the client like (without password):
ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v
and copy the generated id_rsa.pub to the server:
ssh-copy-id -i ...
11
votes
2answers
1k views
What's wrong with storing private keys in the cloud?
I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
7
votes
3answers
1k views
Additional security of keyfile on top of a master password for KeePass
I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model.
However my biggest remaining concern is the ...
4
votes
2answers
2k views
mysql AES_ENCRYPT key length
AES_ENCRYPT uses a 128 bit long key to encrypt the data, but how does mysql handle longer or shorter keys? I found out that pycrypto for instances recomend to transform the key by using md5 sha1 sha2, ...
3
votes
2answers
216 views
How many GPG keys should I make?
I am learning how to use GPG keys, and I am wondering what is the threshold people generally use to maintain separate GPG keys. Maintaining an incredibly large number of keys is not good since it ...
3
votes
3answers
106 views
Encrypting a fixed format message with commands and transmitting over the internet
Linked to: Encrypting a fixed format message?
I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my ...
7
votes
2answers
2k views
Best Practice: “One per-user ssh key” or “multiple per-host ssh keys” [duplicate]
Possible Duplicate:
What’s the common pragmatic strategy for managing key pairs?
I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when ...
3
votes
1answer
489 views
Storage of 'secrets', keystores, HSMs and the rest
I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
0
votes
2answers
190 views
Where do I securely store application-specific symmetric key?
I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere.
From a similar ...
