Tag Info

New answers tagged

0

Short of asking the Certificate Authorities yourself (preferably with a secondary list of valid CRL and or OCSP download URL's lists) one by one I know none. You could script that, or you could recreate the Repository and create a hash of it. Also checking if the checksums are valid can give you a clue (although it does not show a replaced certificate / ...


0

Instead of using a hardcoded key, you should use mutual SSL authentication. Using an obfuscated key, doesn't add any security, certainly not when you're already using SSL.


2

I think there is an additional problem/challenge with your scheme: Beside the problem of having the key pairs generated by the server, this scheme also allows for a man in the middle attack: A asks for the key of B, server answers with his own key C. Now the server can decrypt, read and encrypt again for B and send the new ciphertext to B. Neither A nor B ...


0

Let me make sure I understand. Your user will run a local application that is capable of decrypting your encrypted file and of storing it (or parts of it) in memory in a readable format. Your adversary is the user; the user is assumed to want to hijack those permissions stored in the encrypted file. I also assume the user is root on that machine so she can ...


3

How the Fingerprint and Long and Short Key IDs are Related Each OpenPGP key has a fingerprint attached, calculated mainly from its public key packet which also contains the creation time. The calculation is defined in RFC 4880, OpenPGP, 12.2. Key IDs and Fingerprints. There are short and long key IDs, which resemble the lower 32 respective 64 bits of the ...


2

There is already an infrastructure to manage trust and it's called "Public Key Infrastructure". This is the basis of all the SSL/TLS protocols used over the internet and websites. The main idea is to designate a Trusted Third Party (TTP) which is recognised by all the parties involved. These TTP issues their public key and they are shipped by default in ...


3

You're correct about how the passphrase works. And, given your situation, I'd advise you to not use an SSH agent. You should also be aware that if someone with root access installs a keylogger on your machine, your passphrase may be compromised. To reduce the risk, you can keep the key on e.g. a USB stick, instead of on the local harddrive. For extra ...


1

Keep in mind that there is no way to tell from the public key alone whether the private key even has a passphrase associated with it, and no way to know what the passphrase is or when it was last changed even with access to the private key (although a good guess may be that if the private key has been rewritten per its last modified timestamp since it was ...


0

Detaching Subkeys in Theory... Detach subkeys does not correspond well with the OpenPGP model of primary keys, subkeys, user IDs, certifications and trust. Both subkeys and user IDs are bound to the primary key, each individually. Certifications are applied on tuples of primary keys and user IDs, trust directly on primary keys. You could very well detach ...


1

The important thing to keep in mind is that the actual encryption keys for the volume are stored in the Trusted Execution Environment (TEE) chip, which is designed to provide secure key storage. The goal of the device is to act as an encryption oracle: you give it some data, it encrypts or decrypts it, then gives you the result. This means that if you take ...


1

Simple answer, no. SSH keys are simple cryptographic keys, if you want to add a validity period to it, you end up in PKI territory. There is an answer on the Ubuntu Stack Exchange site, asking how to make SSH keys expire automatically, but this is to do with using the ssh-agent tool. Alternatively, you can use a third party app installed on your server to ...


1

I think the link you provided above is one off--check here instead, which covers key import (what you need to start with). In short, you'll invoke BCryptImportKey or BCryptImportKeyPair, depending on if you're dealing with symmetric or asymmetric keys. Once imported, use the various functions provided in CNG, probably starting with BCryptDecrypt and ...


1

Encryption works on sequences of bits. It can encrypt anything that can be represented as bits. It cannot encrypt anything that has not been converted to bits. Fortunately, anything in a computer, by definition, is, at some level, a sequence of bits. Conversion of floating-point integers into bits and back is a common thing to do, subject to some standards ...


0

Can't deduce much from your question but if you are responsible for code repository structure then I'd recommend you differentiate config repository and code repository. Where Code repository would have the actual code & config repository would held these secret keys. If I were you, I'd also ensure these secret keys are not stored in plain text and ...


2

Every time you browse GMail or your bank's website using HTTPS from your laptop in a coffee shop or airport, your are broadcasting all sorts of ciphertexts to everyone who cares to listen in. It had better be safe publicly to share ciphertexts. Assuming a great many things about the strengths of the chosen ciphersuite, crypto implementations, and ...


2

Yes, sharing the ciphertext is safe. Kerckhoffs' principle, which modern cryptosystems are designed around, states that the system should be secure if everything about it is known except the specific key used for encryption/decryption. Additionally, security through obscurity is rarely effective. What you're (somewhat) getting at in your question is that of ...


13

Exposure of ciphertext does not inherently decrease is security of the algorithm. However, if the ciphertext is more easily accessible it is more likely to be found by an adversary. If your adversary has means to steal your private/shared keys, rubber hose you, etc its more risky to increase exposure. You may always want to consider that in the future a ...


43

That is exactly what encryption is designed to safely enable. If Bob and Alice could safely share the message without allowing attackers and eavesdroppers access to it, they would not, in fact, need encryption at all. So, yes, it is safe to allow any and everyone access to the ciphertext. You do want to authenticate it so that it cannot be tampered with ...


5

Key servers may never be understood as a source of trust and valid keys. Their only job is to exchange keys, so users of OpenPGP can use the web of trust formed by certifications between keys to validate trusted ones. Access to a Mail Address Does not Imply Impersonation Trusting a key is (for most people) more than just verifying a mail address once. Mail ...


2

It's very important to understand that OpenPGP keyservers are not certificate authorities. They are not responsible for key verification. OpenPGP employs a decentralized trust model, so it's the user's job to verify a key either by directly checking the fingerprint or by using the web of trust (like you already said). When people use keyservers to download ...


0

The Google Maps SDK for iOS sends the app's API key to Google in such a way that any end user of the app can find the app's API key by using an HTTPS proxy. If you happen to be developing on a Mac, you can try this yourself pretty easily using the Charles proxy. Configure Charles to act as a proxy for clients4.google.com. On a Mac you'll need to make ...



Top 50 recent answers are included