Tag Info

New answers tagged

1

key management for (highly sensitive) private keys is usually achieved by storing them within hardware crypto modules (also referred to as HSMs). there are varying levels of hardware crypto modules, which are usually rated in line with the FIPS 140-2 standard The hardware resides either on the machine (e.g. PCI card), or on the network (also known as a ...


1

You don't want to encrypt passwords, because with encryption, the encryption key and the encrypted data can produce the unencrypted data. If someone gains access to your data store, they can recreate the original password. With a hash, you don't store enough info to recreate the original data. All you can do is verify that input data produces the same hash ...


4

Well, let's use proper terminology then. You don't want to encrypt passwords. You want to hash password. This is something completely different. Read this. There is a good password hashing function called "bcrypt" which is internally derived from an encryption algorithm called "Blowfish"; from which came a lot of confusion with some software platforms claim ...


3

You already seem to have realized that there is no way to attach user IDs to subkeys. You cannot impose ultimate trust on others The problem with your concept is that while you can issue ultimate trust on your own devices, you cannot impose this for other users. If they're able to validate your "master" primary key through the web of trust, the other keys ...


1

For each of the operating systems you've listed, you should leverage the operating system's built-in secure storage for the keys rather than attempt to "roll your own" solution. In general, it is not seen as a best practice to use your own encryption as you will continue to have to support, and debug your implementation which may have unforseen ...


2

Some HSM are configurable enough to allow adding functionality within the HSM. However, this will not be doable through PKCS#11, which is an API meant for invocation of cryptographic algorithm on externally provided data. What PKCS#11 offers and is closest to your problem is C_UnwrapKey() that can take as input an encrypted key (key is encrypted with another ...


10

Knowledge is power. In other words, if the user must be able to perform some action and nobody else should be able to do the same action, then there must be some value (a "key") that only the user knows, and nobody else. Moreover, use of a value necessarily means having that value at hand; when you decrypt with a key, then you have that key, at least as ...


1

Secure Storage DEK: Data Encryption Key KEK: Key Encryption Key Master Key: Generally will describe one of the two above keys. Depending on the scheme in which it is implemented. This type of encryption scheme is often used for secure storage. Microsoft Windows is known to use this type of encryption scheme to protect user credentials and other types ...


0

This article is intended to be a simplified explanation sans drill-down for people wanting to understand the concept terms. The terms are used in symmetric key cryptography. DEK - Data Encryption Key The key used to encrypt the data e.g. Key: 1234 with AES 128 as encryption algorithem - 1234 is the DEK KEK - Key Encryption Key e.g. Encrypt (from DEK ...


2

In a PGP setup, encryption occurs with the recipient's public key. In SSH authentication, this is (internally) a signature with the client's private key. If Alice sends a message to Bob and also connects to Carol's server, then Alice will use Bob's public key to encrypt, and here own private key (from a distinct key pair) to sign. No problem here. A ...


1

If B specifically wants the data encrypted end-to-end from the field device to them, then indeed you need devices injected under a BDK known to B -- either you generated and gave to B, or B generated itself and gave to you or your vendor(s)/injection facility(s) -- and preferably not used by or shared with anybody else. You don't say what type(s) of devices ...


0

Running Debian, I naturally assumed all Enigmail dependencies would be installed along with Enigmail, but they were not. The solution was to install the pinentry-qt4 package, which has the description: pinentry-qt4 - "Qt-4-based PIN or pass-phrase entry dialog for GnuPG." The error message, "Key not found or not valid..." threw me off the trail. Still, ...


1

The best solution is to run your session as SELinux user user_u or staff_u, which will much more strictly enforce inter-process communication between other apps and the pin entry app, which runs in gpg_pinentry_t domain. By default, users are mapped to unconfined_u, which offers some protection, but not nearly as much as if you were to run things as user_u ...



Top 50 recent answers are included