Tag Info

New answers tagged

2

A certificate is your public key and some information about the site and then a lifetime. All this is signed by the issuer CA. The certificate is public and thus also the public key, but the private key is not published. One of our SSL certificates has expired and along with that so has the keys. While the certificate will expire the public and ...


1

If the KMS holds the key then they can read the message. If the KMS is breached, then an attacker can read all messages associated with all keys that they stole. Asymmetric keys where the private key is only held by the recipient only allow the recipient to read the message so there's no worry about peeping KMS systems. If the private key is stolen, it is ...


0

No, you do not ultimately have to hold a key in your head, and neither does Ladar Levison. In fact, many security researchers recommend that people use pass phrases that are too complicated to memorize, write the pass phrases down on paper, and keep them in a wallet or other secure location. Bruce Schneier; Jesper Johansson; Rick Smith; Jianxin Yan, Ross ...


3

RFC 4346 is the source of the "daily" recommendation: An upper limit of 24 hours is suggested for session ID lifetimes, since an attacker who obtains a master_secret may be able to impersonate the compromised party until the corresponding session ID is retired. Lacking any better guidance, you're probably fine going with 24 hours. I'm not aware ...


2

Alternatively, you might consider the JuiceSSH client. It stores your keys in its private app directory. In addition, it encrypts its storage so even jailbroken phones offer some level of protection. Sources: - @JuiceSSH: "External storage won't work as keys are imported into the internal JuiceSSH database". - @JuiceSSH: "They [ssh keys] are stored in an ...



Top 50 recent answers are included