New answers tagged

1

Certificate Pinning is another commonly used control against Data-in-transit attacks. The TLS handshake never starts if the client doesn't receive a Public Key that is within the client's (the mobile app) known Pin List. I used Cert Pinning as a compliment to payload encryption. Perhaps the following are becoming the base standard for sensitive mobile app ...


2

If you're (somewhat) sure that the key is not compromised, I'd simply create a bunch of subkeys and move whatever keys you want to smartcards or other offline places. Adding subkeys is easily possible by using gpg[2] --edit-key and the addkey commands. The usage flags are stored in a signature subpacket, so changing them does not change the key (with ...


0

You can solve this by using deployment tools such as Chef or Ansible. Particularly about Chef, you have the Chef Push to push whatever cookbook (i.e. the key files) to all the nodes (i.e. the servers).


2

Why use dedicated SSH keys for different hosts (like GitHub)? Answer: Revocation. When you lose an SSH key, you have to revoke it on everything it had access to. If you use the same key on GitHub as you use to SSH in to your personal web hosting, you have to remove the key from both places. One key per service means none of your other keys are impacted by ...


0

The GitHub advice is possibly over stating the risk. Using the same ssh key on multiple systems has nothing like the risks associated with having the same password on multiple systems. However, there are some other factors to consider which may result in someone having more than one ssh key. The most obvious reason to have more than one ssh key relates to ...


6

The IV is a random non-secret value. Its sole purpose is to prevent two similar blocks from yielding the same ciphertext as it could give information away about the structure of the plain text. In general you just generate the IV randomly and concatenate it to the ciphertext. The IV must be of the same length as the block for AES-CBC, which is 128 bits. You ...


1

Not an answer but you asked for suggestions and this would be a lot for (SX) comments. (0) openssl pkcs8 -topk8 ... -v2 aes-128-cbc -nocrypt is misleading at best if not wrong. If the output file is not encrypted, it doesn't matter what algorithm is not used to encrypt it. (1) openssl enc -pass file: (or -kfile) reads the first line of the file as a string,...


1

As I understood the problem you are trying to protect the firmware file over web when board needs to be updated(Firmware Update), correct me if I'm wrong. Why you are mixing symmetric and asymmetric cryptography altogether, even you can achieve your goal by only using asymmetric cryptography. As you mentioned you are generating the public and private key ...


1

The ChaCha20 algorithm is simple enough that if you're curious about how it works you could just write your own implementation (but don't use it in production!). RFC 7539 is a simple reference that also comes with examples so you can easily check for correctness as you go along. But the way it works is that you XOR the message with a keystream that is ...


0

I always print my encryption keys. The tools I use is first 7-zip to compress and encrypt the key. Then I use PaperBack to print the 7z file. The advantage of this over other tools is, that the scans can be automatically converted back into files without resorting to OCR. This has always worked for me without problems so far. I trust paper printed with a ...


0

Please use proper equipment for these kind of things. In this case a Encryption key. Store it in a Temper resistant device, like a smart-card or usb-keystore (like this) And make a few 'copies' of the key that you distribute over multiple location. You secure the keys themselves with a pass phrase you store at a DIFFERENT location as where the USB-keys are. ...


2

is it possible to extract the encryption key remotely via malware out off the ram memory, and if possible, how come that the law enforcement does not use this method instead of a cold boot attack? Of course it is possible. The malware requires to achieve privilege elevation ad access the encryption driver's memory; both things can be made difficult, but ...


2

Do not rely on a DVD-R only. While they may last a 100 years, they may also only last one if stored improperly or just accidentally scratched when taken out to be used. If you opt for a DVD, store the key on a paper as well. But the most important question is what you store the DVD or paper in. I would recommend a water tight (protected against flooding) ...


6

I still can use CDs I've burned down over 10 years ago. There are papers from thousands of years ago as well, so it's really a matter about how good are the conditions where the CD or the paper are stored. Anyway, why limit yourself to just either of them? Use both.


2

If the app can access the data locally (on the user's device), then a determined individual can as well. If you really want to keep the values secret you could consider having the app send the user's input to a server (which you would control) which both stores the secret values and computes the value for the user. The server would then send the value back ...


0

Great question, and welcome to the landmine of mobile encryption! Unfortunately the answer really depends on which iPhone model / Android manufacturer your app will be running on. Here's a little dump of what I know. Hopefully it'll get you on the right track! Both iOS and Android provide crypto (encryption) libraries in the OS. You should be able to ...


0

If your application is able to request the key, an malicous application is able too. The only way i know to prevent this is blocking malicous users based on their ip.


0

The four possible key "usages" are Certification: signing other keys Signing: signing data Encryption: decrypting data Authentication: signing authentication tokens When you look at your key using --edit-key, you find the usage listed behind each key and subkey. By default, all that are supported by the key type are attached to the master key (so, RSA ...


1

Using PGP, the answer is to use a signing subkey, you can then attach the subkey to an unusable ("stub") master key and use that in everyday work. If that key is lost, the certification key can be used to designate a new signing subkey; the recipient will need to update the key from a keyserver though. With X.509, no such mechanism exists. For both, you ...


7

It is a matter of speed and convenience, for the most part. Your basic options for signing a key: Both participants set up their computers next to each other, one reads off their fingerprint, the other verifies at the same time, then the key is signed immediately. One participant shows their computer screen with the fingerprint to the other, who writes ...


31

Firstly, that statement doesn't mean "don't bring a computer"; it means " you don't need to bring a computer". Many people going to their first key signing party are likely to assume that, since the keys are intended for use on computers, they will need to bring a computer containing their keys, signatures, or encryption software. What actually happens is ...


73

Quote from Wikipedia: Although PGP keys are generally used with personal computers for Internet-related applications, key signing parties themselves generally do not involve computers, since that would give adversaries increased opportunities for subterfuge. Rather, participants write down a string of letters and numbers, called a public key ...


1

The most secure way to store a private key is to generate it on a smart card or in an HSM. Is that an option? The smart card or HSM can still be used to encrypt and decrypt by whoever has access, but it won't give up the key. You can put the public key wherever you want.


0

If your app running as the user can access a chunk of data, any process running as that user can access it too. As you saw in your investigation of option 2, determined programs will be able to find the data if it's stored without additional encryption. If you implement some encryption, as in option 1, somebody could reverse engineer your application to ...


1

0.0064% (that's .2^6) of the numbers in a random 6 digit string will only have 0's and 1's. You got one. No big deal. It's only a problem if those numbers occur more than 0.0064% of the time or you can predict when they will occur. If you pay attention, and wait long enough, you'll see that 1 in 1,000,000 of the random numbers will be your birth date in ...



Top 50 recent answers are included