New answers tagged

2

Using the same private key across separate domains is basically secure. If you authenticate to a system, you don't give away you private key, and that system cannot impersonate you. So you can use your key across work and personal systems, and a work system cannot then access your personal systems. However, there are often reasons to use different keys. For ...


5

The problem with this approach is that the same identity is used by every destination, so sites can swap notes to see where you've been and draw correlations that you may not want to expose. There are several ways to solve this issue, such as the one used in the FIDO U2F security key. In this case, the device contains a symmetric key (not an asymmetric key ...


0

Sebastian gave a great answer, but I also wanted to point out that your problem outlines exactly why you want to build a Web of Trust (https://en.m.wikipedia.org/wiki/Web_of_trust) signing other's PGP keys and having them sign yours.


0

2) Use private key to create a signature of the public key. 3) Upload the public key and its signature to the FTP server. 4) Mobile device downloads the public key and its signature. 5) Mobile device uses the public key to verify the signature. Why do this. Anyone who can create a keypair can sign the public key via the corresponding ...


1

It seems OK. Key Encrypting Key (KEK) is quite a confusing name. It puts emphasis on the fact that a particular key is used to encrypt another key (which in turn encrypts data), as if this bare fact somehow increased the security. It doesn't. The additional security comes from something else, and (by me) the name of this scheme should really be Separately ...


-2

Displaying version data is a security vulnerability and should be disabled by default. This is a huge bug in PGP right now and it needs to be addressed by the core maintainers ASAP.


1

However in the case of a simple web app I don't see the benefit of using environment variables which can be configured in the portal. I have not used Azure Key Vault, but it appears that the client application never actually sees the master key: When a SaaS application needs to perform cryptographic operations by using their customers’ keys, Key ...


0

SignServer is used for central code signing of MS and Android applications. Doesn't do iOS yet. Stores the private signature key securely in an HSM, and provides audit etc.


1

The file you're trying to import does not contain the actual private key, as indicated by this line in the output of gpg --list-packets: gnu-dummy S2K, algo: 3, SHA1 protection, hash: 2 The special "dummy" S2K algorithm is applied when GnuPG actually exported a secret key stub to still enable using secret subkeys, but having an offline primary key (on ...


4

No. People with vested interests and deep wallets have put countless man-hours into solving this problem, even when using specialized hardware, and it gets broken over and over. Some game systems used security chips (10NES, anyone?) which validated cartridges and refused to run the system if the signatures did not match. It did not work out too well. If you ...


3

If you are supplying the application that stores and retrieves the encrypted files for the user, here are a few ideas you may want to consider... 1) Rather than encrypting data at the cloud storage, consider encrypting the data files prior to storing in the cloud service. You can find numerous options for encryption libraries on GitHub. 2) Store the Keys ...


2

Phase 1: Symmetric Key Derivation First, the passphrase is used to derive a key for symmetric encryption using a string-to-key function. Several settings can be fine-tuned in GnuPG considering this, like the hashing algorithm and the number of repetitions. From the GnuPG manual: --s2k-digest-algo name Use name as the digest algorithm used to mangle ...


0

According to this article, you can choose which cipher to use for data encryption (which I assume includes key encryption, since it's just a file, right?) from the following list: Cypher: 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 EDIT: After digging around a bit in man pages and on google, you ...



Top 50 recent answers are included