Tag Info

New answers tagged

1

ISAKMP can be viewed as the conception framework and IKE as the concrete realization of ISAKMP. The actual implementation of IKE then uses both Oakley and SKEME to achieve its goals (all implementation but cisco one, as it doesn't use nor Oakley nor SKEME, then the confusion with ISAKMP in the cisco world, correct me if I'm wrong). in the development world, ...


0

FYI, with minor changes to tpm-luks, I got it working with our application to secure the root partition's LUK key in TPM NVRAM. The scripts work like a charm. It's easy if it's not a root partition but maybe some other partition or file. I tied the key into NVRAM based on PCRs 0 through 9 and also 12 and 13. Be aware your BIOS should comply with NIST ...


0

You are certainly on the right track but it is possible that you're making it just a bit more complicated than you need to. You have correctly identified that a symmetric encryption system creates the significant issue of the decryption key being present on the system. If you choose to generate public/private keys for each piece of data, you may be making ...


1

In most cases, you would install the driver/engine software in your servers and would do PKCS#11 over TLS. Be aware that some vendors' offering may not be a true HSM; specifically it may be the software and management around an HSM delivered as a virtual appliance. These are not meant to provide the same level of resilience to attack as a true HSM. The ...


0

You want to investigate a Hardware Security Module. This offloads the keys (and the crypto processing) to a hardened device from which the keys cannot be extracted. The best known ones are from Thales and Safenet, and they offer versions that are local PCI boards, locally attached (via USB) and network-attached. If you only have one or two keys, you can ...


5

Just use TLS, it's what it was meant for: securely send data between two parties across an untrusted channel. Should you want additional protection, there are two ways to solve this problem that spring to my mind: Use a password to encrypt the symmetric key Use a token such as an OTT through SMS or generated using a smartcard and external cardreader ...


0

For android phones, there is a credential storage that allows you to store keys. It runs as a system daemon and uses AES to encrypt the keys. The keys are tied to the UID of the app that created it so other rogue apps are unable to access these keys. For iOS, there is a similar keychain which serves a similar purpose. It is also encrypted and sandboxed so ...



Top 50 recent answers are included