Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

learn more… | top users | synonyms

4
votes
3answers
482 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
4
votes
2answers
83 views

Centralized key management for IOS and Android Code Signing

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines. I see systems like ...
0
votes
2answers
26 views

Does PKI signature verification require secure distribution of public keys?

I'm looking at a software project where the GPG public keys of the maintainers are found on a website using HTTP. According to the GNU Privacy Handbook, "The signature is verified using the ...
4
votes
1answer
151 views

Does RekeyLimit property in sshd_config enforce re-keying / key re-exchange?

I have set the RekeyLimit property in sshd_config and tried to perform a SSH. However, I could not see rekeying happening in the verbose logs, all I see is the log message below at the start of the ...
2
votes
1answer
688 views

Protecting decryption key on server

What is the most suitable way to encrypt and decrypt sensitive data on a public cloud server disk without storing the decryption key on the server in plaintext? REQUIREMENTS In our SaaS web/mobile ...
1
vote
1answer
41 views

Key rotation benefits of a multi-key hierarchy

I think I have a decent grasp of the problems associated with key rotation, and as I'm working through them determining an approach for key management on an application I keep stumbling up against ...
0
votes
1answer
91 views

Questions on the variations of RSA keys

I've built a simple application that reads in an RSA key, checks the header and starts identifying properties of the RSA key to make sure it is valid (Using child_process in express to run $ ...
3
votes
0answers
90 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
3
votes
0answers
399 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
0answers
59 views

Manual IPsec and session key(s)

I am evaluating IPsec. I have determined it is best for my case to not use AH (will use PSK for authentication). One issue I have is that at the start there will be no connectivity, so IKE will not ...
2
votes
0answers
184 views

How is Tresorit client-side encryption key stored and managed?

I am using Tresorit on Mac OS X and iPhone. When I am using it there is always applied client-side encryption before posting the file to cloud. The key used for encryption is AES-256 and CFB mode of ...
2
votes
0answers
45 views

CCM instead of key wrap

Is there any instance of NIST or other encryption standards using AES-CCM to encrypt/authenticate key data? I would like to use CCM over a keywrap function, but cannot find any precedent for this in ...
2
votes
0answers
209 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
1
vote
0answers
24 views

SSH Keybased authentication using NitroKey

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my ...
1
vote
0answers
20 views

key hierarchy management and master key

Now, I have this equation, {{K_ab}K_bs}K_as. K_ab is encrypted by K_bs then whole packet is encrypted by K_as I think the key structure is K_as is the master key, K_bs is under K_as and K_ab is the ...
1
vote
0answers
46 views

Key Hierarchy and key Encryption

If i have two 56-bit DES keys, and I use these two key to encrypt a 256-bit AES key. Like this: K_AT encrypts K_BT and K_BT encrypts K What is the effective security of key K? Is it 2 X 56 Bits?
1
vote
0answers
99 views

Multi-Region MySQL Deployment on AWS - How to Encrypt?

Problem: AWS offers the managed RDS MySQL database service in which you can encrypt and manage keys using AWS's Key Management System (KMS). Unfortunately encrypted database snapshots cannot be copied ...
1
vote
0answers
42 views

Checklist for Data Communication Review in ERP Solution

I am looking out for a checklist for data communication review within ERP application. I understand some of the checks would be related to digital signature, TLS/SSL use, Key Life Cycle management ...
1
vote
0answers
58 views

how IKE (Internet Key Exchange) protocol reacts to the replay attack?

I mean how IKE in any mode (quick,aggressive, main) responds to an attacker that tries to replay one or more messages?
1
vote
0answers
114 views

Clear EFS Cache at Set Interval

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so ...
1
vote
0answers
170 views

secure key management using smart card

I have a scenario where I want to encrypt the file data on client machine along with smart card authentication. I have followed a link that states that for smart cards, private key never leaves The ...
1
vote
0answers
276 views

SSH using pre-existing session (symmetric) keys

Is there at present a way to open a SSH connection using pre-existing symmetric session keys? In other words, if I create a list of symmetric keys can I send that list to the recipient on a CD or USB ...
1
vote
0answers
56 views

Key Distribution using multicast

I am trying to come up with a solution for a system where i need to generate a key (Kn) from time to time and distribute it to a large number of servers in a private network. Since it has to be a ...
1
vote
0answers
292 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
0answers
807 views

How to securely delete an OpenVPN connection profile

I store my OpenVPN profile (keys) in an encrypted drive but I run OpenVPN inside an OS that is not encrypted. When I finish my OpenVPN session and disconnect, the connection profiles are still there ...
1
vote
0answers
557 views

Import securely RSA private key through PKCS#11

I have a cryptographic device that supports the following mechanisms: How I could securely import RSA private key into it? Because there is no support for wrap/unwrap using symmetric key is there ...
1
vote
0answers
239 views

“Keyset does not exist” when using SignData function with RSA

"Keyset does not exist". I know that there are tons of question about this error, but mine is totally different. I'm not gona use the key from windows certificate store, but load the public key & ...
1
vote
0answers
128 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
0
votes
0answers
17 views

EMV key management

For EMV transactions, I was trying to understand the keys required and its related management. Based on my limited understanding I was able to understand the ecosystem entities that exist i.e. ...
0
votes
0answers
31 views

Storing Keys on Embedded Devices

What is a reasonable way of storing private keys/certs on an embedded device that doesn't have trust-zone, TPM or write-once storage? Without hardware backing the key-storage the key must be stored in ...
0
votes
0answers
37 views

On the Import Client Key screen in Bitvise what is numeric field just next to the Location Profile dropdown?

What is this field for? I know I saved a profile in the beginning, and I want this private key to be attached to just the profile that I'm using, but what on earth is that numeric field for?
0
votes
0answers
20 views

What is the goal of sign a key in BrowserID certificate?

I'm learning about the Mozilla Auth. it has an implementation of SRP protocol in https://github.com/mozilla/fxa-auth-server/blob/master/docs/overview.md and his client; example is ...
0
votes
0answers
34 views

Online Personalisation of Terminal-HSM key management

In Germany, there is a widely used key management called Online Personalisation of Terminal-HSM (OPT, Online-Personalisierung von Terminal-HSM). I would like to get details about it and to compare it ...
0
votes
0answers
879 views

Decrypt Private Key

I have a private key together with a certificate in a pem file. The part of the private key starts with: -----BEGIN ENCRYPTED PRIVATE KEY----- I have a passphrase for it. I need to bring it back ...
0
votes
0answers
37 views

Distribution of key by server

I have read that in asymmetric cryptography, a system admin can generate key pairs on the server. After that, the users will be given the generated key pairs and this is an efficient way of doing this ...
0
votes
0answers
103 views

How should I organize my keys?

Suppose I have a set of computers with variegate level of trust (for example): I fully trust my own desktop pc at home I trust a bit also my smartphone, but I know it could be stolen I trust a bit ...