Tag Info

New answers tagged

0

As noted in the comments, you seem to be misusing your private key. Your private key should only be held locally. That is, on the hard drive of the computer you're currently sitting at. You mentioned that the private key is located on several locations from where I upload/download data I gather you connect to one of this servers, do some work, and ...


3

Environment variables are the best way to do this, specifically method 2. Docker, by default, does not allow itself to be run by users other than root. Access to the socket is prohibited. I'd say method 2 is reasonably safe, as out of the box if an attacker has root access (and can poke around in your docker containers) you're already in bad shape. Two ...


0

The previous respondent has done a good job of answering your question. However, here is some additional insight. a) Gazzang is no longer going to be selling or supporting their zTrustee solution starting next year 2015 (the support ends in June or July). So all Gazzang customers are looking for other solutions. b) You should also take a look at PCI DSS ...


1

First: you cannot be sure that the API key is private and will remain private. As soon as the device/product/application is on the real world, it can and will be broken. Don't rely on it. And as soon as the key leaks, nothing will stop anybody to simply start sending requests, and you can't tell who is sending, or how to filter or block fraudulent ...


3

What you are referring to is a known-plaintext attack, where you attempt to figure out the key by comparing the encrypted and unencrypted versions of a sample of data. Fortunately, pretty much all major encryption algorithms in use today, including AES, are not known to be susceptible to this kind of attack. Knowing what something decrypts to is completely ...


1

Only if you are signing multiple certificates. Self signing doesn't give any more validation that you are who you claim to be than a public key does, however, if you have, for example, 3 different public keys and all are signed with your same self-signing private key, then someone could verify that all 3 keys are either all invalid or all valid (though they ...


2

None. There's no security benefit. Tools like openssl are designed to work with certificates. This means it's more practical to give openssl a self-signed certificate rather than no cert at all.


0

Yes Although you have taken good precautions against loss or theft of your laptop, you remain vulnerable to electronic attacks. In particular browser-based malware could take control of your computer and steal your PGP key. The point of using subkeys is that you keep the master key somewhere really safe - which is not your everyday laptop. There have been ...


0

You should be able to add the additional subkeys to your master key pair, while still leaving the master keys intact. It doesn't matter if the "master keys" have been used for a while, you don't have to generate new master keys to add subkeys to it. You linked to the article I usually recommend which describes this process, of using gpg --edit-key ...


0

I would create a separate pair. The 1st key should be kept offline, or there isn't much use in having subs....though you must go to the offline machine to sign any keys you get from someone else, then bring them back to the online system. I haven't messed with a personal HSM (Yubikey), but that may be able to ease the pain.


0

You would go through the relatively arduous task of decrypting and re-encrypting data for only one reason: you believe the crypto key has been compromised, but the data have not, or the reverse. If both data and key were compromised. you're toast. No amount of key-changing will save you. If one of key or data were compromised, it might make sense to ...


2

Why you do not do the decryption encryption on demand? Not sure if that work for your case, but here is my thoughts. The data originally come to your web application as plain data right? Then you encrypt the data and store it. Let us assume the following scenario Today I upload file "My_Data1.txt" to your server you encrypt it using an AES key named ...


3

Encryption keys can have a cryptoperiod after which those keys shouldn't continue to be used for encryption. This may be due to security policies, due to an individual who knows a key component leaving the business, due to suspicion of an encryption key compromise etc. Often, a business will use an encryption key (let's call this keyA) for encryption for X ...


1

Short answer : you don't. Private keys are , by definition, meant to remain private. If you need to store a secret for each user, the odds are symmetric encryption is a better fit. You should edit your quetstion with more details about what you're trying to accomplish. If there's a flaw in your design as I guess, we can provide you advice to make it better. ...


0

To disagree with previous comments. It is OK (but highly unusual) to store private/public-key-pairs in a database, depending on your infrastructure. We could talk about special Identy-Based-PKIs for example. So, what you need to provide, is more information about your infrastructure, to get a proper answer. However, as you gave the two examples: "encrypt by ...



Top 50 recent answers are included