Tag Info

Hot answers tagged

20

There is a standard for that, and, more generally, for all communications with a PKI. It is called CMP. Revocation requests are specified in section 5.3.9. Now, finding a PKI that actually implements CMP... this may be challenging.


14

What about something like Verbatim's Archival Grade Gold DVD-R>? It gives 4 GB storage. They claim a life of "up to 100 years" but I find no independent verification. Frankly I'm skeptical. But maybe you can boost your chances by just burning the same data on to multiple disks and hope any failures are uncorrelated? I'd buy disks from different lots or ...


7

You cannot reconstruct an OpenPGP key based on it's fingerprint. The fingerprint is a hash value of the public key, so calculating the fingerprint of a key is a one-way operation. But: if somebody only distributes his key's fingerprint, he will almost certainly have distributed his public key on the key server network, from where you can pull it. Given you ...


5

The problem is probably not so much algorithmic security. The problem is that if there is a security problem with one of the applications that you also have a security problem the other application. Furthermore, it may be that some kind of attacks on the protocol may be made possible because you share keys. In other words, this is not a good idea with ...


3

As far as I do understand, you want to convert an authentication subkey to an SSH key, and authenticate using this. If I generate a PGP subkey that only has the authentication capablity and use this to generate an SSH keypair to authenticate Git for example, does this pose a security threat? Whether this is reasonable or not depends on what you're ...


3

I'm also interested in the practicalities of paper backup, in particular tools that allow adding error-detection and error-correction capabilities similar to what RAR does for archives (i.e. dial-your-desired-security), and perhaps encodings that are more efficient and/or robust in the face of OCR than, say, base64. Have you considered combining paper ...


3

@curious_cat has a great answer. I'm going to add a few other areas, though. First, what's your budget for this? You need the budget in three areas: Capital and operational expenditure for inital start-up buying HD-Rosetta capable addressable microscopes, equipment to etch stone or clay tablets, OCR scanners that can handle stone or clay tablets, etc. ...


3

Backups and Archives Oh My! Based on my unscientific Googling First issues first, let's turn this into a scientific exercise (library science!), the decisions you make today will affect people that you haven't (or might never) meet. You've mentioned two of your three options for key management; analogue and digital. Have you considered your third ...


1

Could you not generate the encryption key based on a pass phrase given by the user that is encrypting the data? Then that pass phrase would have to be supplied again in order to decrypt the encrypted data. This would of course require the pass phrase to be known and entered by a user so nothing would just magically happen.


1

No, although the reason I see is independent of most of your post. CBC mode is malleable; you should use a MAC too.


1

Not with a PSK. But what you ask for is something OpenVPN provides with it's TLS mode. That will periodically negotiate new keys for you automatically. If you do want the networking to be peer-to-peer, like in PSK mode, you can use configs similar to those in the loopback-server and loopback-client configs in the OpenVPN config files. Something like this ...


1

As @whoami mentioned, it does just move the issue to another place. As you mentioned it allows you to move it out of code (if you've hardcoded it), password protect it (if it was originally just a PEM or whatever on disk), and ACL it to the requisite permissions. The problem is that you do need to know the key to unlock it, and that of course requires ...


1

There is a variation of TLS that uses a Pre-Shared Key instead of certificates, called TLS-PSK. This basically works the same way as usual TLS except the session key is generated in a different way. You should take a look at this.


1

A GPG_AGENT is a program that when asked, (de|en)crypts the data for the caller (in this case using gpg). The 'files' you see are most probably sockets for communicating with the agent. Once the program is closed (or locked), it can't be used, those files don't contain any private information, agents are (generally) pretty-well designed, and won't even ...



Only top voted, non community-wiki answers of a minimum length are eligible