Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

21
votes
2answers
10k views

where to store a key for encryption

I am looking for a way to store a key used for password encryption. I am using a mysql db which would store a user name and an encrypted password that would be encrypted using ...
19
votes
6answers
2k views

Shouldn't GPG key fetching use a secure connection?

If I run this for example: gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451 then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) ...
10
votes
2answers
3k views

How many GPG keys should I make?

I am learning how to use GPG keys, and I am wondering what is the threshold people generally use to maintain separate GPG keys. Maintaining an incredibly large number of keys is not good since it ...
8
votes
3answers
5k views

How can I enumerate all the saved RSA keys in the Microsoft CSP?

I have an application that is creating several keys and storing them in various stores (in this case the Machine store). How can I enumerate all the keys on a given Windows system? ...
6
votes
2answers
1k views

How do open source projects handle secure artifacts?

Specifically, how are things like keystores handled, or other items needed to build or run an app? In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web ...
179
votes
7answers
129k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
63
votes
6answers
27k views

How should I distribute my public key?

I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
11
votes
5answers
14k views

Compute the AES-encryption key given the plaintext and its ciphertext?

I'm tasked with creating database tables in Oracle which contain encrypted strings (i.e., the columns are RAW). The strings are encrypted by the application (using AES, 128-bit key) and stored in ...
143
votes
7answers
11k views

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
21
votes
3answers
2k views

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single ...
25
votes
7answers
6k views

Should I change the private key when renewing a certificate?

My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
9
votes
5answers
8k views

What does “key with length of x bits” mean?

I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
14
votes
2answers
7k views

Best Practice: “One per-user ssh key” or “multiple per-host ssh keys” [duplicate]

Possible Duplicate: What’s the common pragmatic strategy for managing key pairs? I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when ...
12
votes
4answers
843 views

Key management in cloud datacenters

In terms of infrastructure, how do Cloud providers (organizations providing SaaS, PaaS, or IaaS via the cloud) manage keys and cryptography? From my understanding, "private" datacenters tend to ...
11
votes
4answers
4k views

Does symmetric encryption provide data integrity?

Let's say I have one server that encrypts a file with a symmetric key, e.g. AES-CBC, and sends it to clients that decrypt it. Does that provide data integrity when decrypted? Or is it possible for ...
10
votes
5answers
2k views

Storing private asymmetric key in application binary?

I would like to give a daemon-style process (i.e. no user interaction) access to a shared secret key so that it can access a shared, encrypted data file. User applications accessing the same encrypted ...
8
votes
4answers
1k views

Where do I securely store the key for a system where the source is visible?

I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there. I've ...
14
votes
4answers
2k views

What are the chances to generate the same ssh key?

I could generate ssh keys on the client like (without password): ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v and copy the generated id_rsa.pub to the server: ssh-copy-id -i ...
13
votes
4answers
1k views

Is Steganography considered encryption and subject to USA export restrictions?

I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
5
votes
2answers
892 views

Generating one-time tokens from API-key?

I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site. I intend to distribute secret API-keys to ...
4
votes
2answers
1k views

When should I use Message layer encryption vs transport layer encryption

Basically I will be having to secure a connection between different hops. Therefore even if TLS is widely known to be the best in class, I am wondering that in such a case message based encryption ...
1
vote
1answer
753 views

How do I securely store and retrieve a many-time use key?

I am performing some symmetric database encryption/decryption in .net. I am using a single 256 bit private key. (1) Where do I store this key when not in use? (2) How do I securely retrieve this ...
5
votes
4answers
352 views

How do you guarantee that you don't lose a keyfile?

I am toying with the idea of adding keyfiles to various things that I encrypt. However what's been keeping me from adopting them is guaranteeing that I don't lose the keyfile while still keeping ...
3
votes
2answers
366 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
2answers
181 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: ...
0
votes
3answers
387 views

Is using a numbers station to transmit a one-time-pad as key actually insecure?

We all know the two most important problems related to a “one-time-pad”: The one-time-pad needs to be truly random (which I think is logic, as pseudo random generators are quick but predictable). ...
56
votes
10answers
8k views

Where do you store your personal private GPG key?

So, I want to start using pass, but I need a GPG key for this. This application will store all of my passwords, which means it's very important that I don't lose my private key, once generated. Hard ...
37
votes
6answers
4k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
30
votes
2answers
6k views

Web Application encryption key management

In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions: ...
26
votes
2answers
2k views

Criteria for Selecting an HSM

A very sensitive application has to protect several different forms of data, such as passwords, credit cards, and secret documents - and encryption keys, of course. As an alternative to developing a ...
15
votes
3answers
66k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
8
votes
2answers
3k views

What is a good general purpose GnuPG key setup?

Since most key types can be used for multiple purposes, namely certification, authentication, encryption and signatures, one could simply use one key for everything - which is a bad idea, as ...
13
votes
6answers
1k views

How can the impact of cold boot attacks be minimized?

Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
7
votes
2answers
2k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
16
votes
3answers
6k views

What vulnerabilities could be caused by a wildcard SSL cert?

In a comment on this answer, AviD says: "There are numerous security issues with wildcard SSL certs." So, what are the problems? I understand that the same private key is being used in multiple ...
13
votes
2answers
3k views

What's wrong with storing private keys in the cloud?

I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
11
votes
3answers
2k views

Additional security of keyfile on top of a master password for KeePass

I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model. However my biggest remaining concern is the ...
10
votes
2answers
2k views

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository, with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or ...
8
votes
3answers
1k views

Security implications of storing the password hash along an encrypted AES key

I am using the PKCS#5 standard to generate a key using a random and unique salt and the user's password in input. Consider this key as the "encryption" key. The "encryption" key is used to encrypt a ...
4
votes
1answer
2k views

how to secure Android Market public key

Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
3
votes
2answers
2k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
7
votes
1answer
1k views

Is it secure to transfer an RSA public key by email?

I've set up my VPS'ssh server to accept only key-based identification: I disabled password-based connection. As a consequence I am connecting from home with an RSA key generated prior to password ...
6
votes
3answers
343 views

Vulnerabilities with DB backed session tokens

A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to ...
4
votes
2answers
3k views

mysql AES_ENCRYPT key length

AES_ENCRYPT uses a 128 bit long key to encrypt the data, but how does mysql handle longer or shorter keys? I found out that pycrypto for instances recomend to transform the key by using md5 sha1 sha2, ...
3
votes
1answer
1k views

Storage of 'secrets', keystores, HSMs and the rest

I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
3
votes
3answers
120 views

Encrypting a fixed format message with commands and transmitting over the internet

Linked to: Encrypting a fixed format message? I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my ...
5
votes
3answers
303 views

An OS that does not trust its RAM?

I wonder if it is possible to write a kernel that would keep all of its RAM encrypted, storing the key in the CPU cache, so that the machine would be resistant to cold-boot attacks?
3
votes
2answers
169 views

Export non-extractable private key from Keychain on OS X

I have a PKI certificate in Keychain Access.app on OS X 10.9, together with the private key. The manual page for /usr/bin/security indicates that there is a -x option for security import to specify ...
2
votes
1answer
1k views

How do I share my S/MIME public key?

I have setup S/MIME encryption for my email address, and I'd like to allow people to download the public key from my website, rather than having to first receive an email from me. I want the public ...
2
votes
4answers
1k views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or ...