Questions tagged [key]

Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.

Filter by
Sorted by
Tagged with
1
vote
0answers
52 views

Is `gpg --refresh-keys` secure and where is this documented?

From the gpg manual: --refresh-keys Request updates from a keyserver for keys that already exist on the local keyring. This is useful for updating a key with the latest signatures, user IDs, etc. ...
0
votes
0answers
30 views

Authenticate Windows/Linux process against hardware security module

I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
1
vote
1answer
64 views

use custom 'key' for hardware security keys

Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
1
vote
1answer
61 views

TLS- Key exchange for session keys. Why?

I have a question about the Key Exchange Algorithm used in TLS process. I have read that the Key Exchange algorithm is used by client and server to exchange session keys. Do the client and server ...
0
votes
0answers
42 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
1
vote
0answers
62 views

Lost GPG private key and revocation certificate

I have created a GPG key and uploaded it to pgp.mit.edu. Then I accidentally wiped the drive that contained both the key and the revocation certificate. So what to do now? I found a possible answer ...
0
votes
1answer
68 views

What's a secure way to generate a keypair from a secret password?

I like to generate a public-private key pair that is seeded from a string. So having the string and the generation algorithm is enough to recreate the keys. I want to do this because I can then ...
0
votes
3answers
70 views

Associate API key with user

I am creating a public API that will require API key authentication. When a user wants to register a new API key, they send a request to one of our endpoints with a list of permissions they want. We ...
0
votes
1answer
120 views

Wrap key operation in Azure Key Vault - symmetric keys

Could anyone explain why the bolded part of the wrap key description? Wraps a symmetric key using a specified key. The WRAP operation supports encryption of a symmetric key using a key encryption key ...
3
votes
1answer
104 views

OpenVPN Key Size 1024 vs 2048 and Eavesdrop vs Access?

OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size. I'm trying to determine if it's worth ...
0
votes
0answers
67 views

Decrypting a file knowing only the password

I have encrypted a file using a program with a password and would like to decrypt it on another device just with the password. Is there any software that takes the password, runs it through all key ...
1
vote
2answers
272 views

When/why should the “mark this key as exportable” option be selected when importing a certificate?

When a certificate is being imported on Windows, at some point the following option is available: [] mark this key as exportable I understand that this is used in case the certificate needs to be ...
5
votes
1answer
412 views

Validating an Ed25519 public key

Is it possibly to test if an Ed25519 public key is valid without having access to the private key, a signed message or anything except the public key? "Valid" as in "Not just 32 random bytes". I'm ...
0
votes
1answer
73 views

how do i find the number of possible keys / password to decrypt a plain text

i like to know if there is any way to decrypt a plain-text that is encrypted 55 rounds using Caesar ciphers with different key for each round. and using brute force attack without knowing the length ...
2
votes
2answers
110 views

How to protect web server private keys on Ubuntu with Nginx without exposing any plain text credentials?

I'm developing a set of internal websites and services for a customer who has high levels of bureaucracy and strict formal rules about many things, one of them being "not storing passwords in plain ...
0
votes
0answers
38 views

Can we keep Pusher API keys public?

I was looking at my company site and I saw Pusher API keys are exposed. Should it be kept public?
0
votes
1answer
46 views

Is using SecureString in combination with Xor considered secure enough for standalone Windows app?

The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string. License.Import(string name, string email, ...
3
votes
0answers
53 views

Best practices for storing long-term access credentials locally in a desktop application?

I'm wondering how applications like Skype and Dropbox store access credentials securely on a user's computer. I imagine the flow for doing this would look something like this: Prompt the user for a ...
0
votes
0answers
31 views

How could I verify that a contract was actually sent to me from the client as soon as the contract is received?

If I want to store electronic contracts for clients over a long period of time. I need to make sure that those files are not readable by anyone other than the client until the client retrieves them at ...
0
votes
1answer
56 views

How to implement challenge-response with keyed hash algorithm when 2 people share same key?

Suppose that 2 people have a keyed hash algorithm (that is, a MAC) with a key that they both know. How could they implement challenge-response using their keyed hash algorithm? This confuses me...
2
votes
1answer
108 views

Should we use API keys for authorization on a public API (instead of JWT)?

We are building a public-facing API. The consumers of this API will be business partners of ours - we will probably have a personal relationship with each one, and I suspect there will only ever be 10-...
-3
votes
1answer
1k views

Write a Python or C program to guess the key [closed]

Key generation program in C: #include <stdio.h> #include <stdlib.h> #include <time.h> #define KEYSIZE 16 void main() { int i; char key[KEYSIZE]; printf("%lld\n", (long long) ...
0
votes
2answers
258 views

Accidentally Shared my Private Key - How to Remedy?

I accidentally shared my SSH private and public keys with others. I changed keys within 2 minutes of sharing the private key. I've since added a password to access my private key as well as deleted ...
0
votes
2answers
75 views

Using the same password to encrypt and to authenticate other actions

Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN. I would also like to use this same PIN as a secondary protection for some ...
0
votes
2answers
91 views

Recreating the Half Coins of Jin-Qua [closed]

In the Asian Saga series by James Clavell, the Struan family gave away the half-coins of Jin-qua: in exchange for a desperately needed loan, the pirate Dirk Struan received 4 halves of 4 coins. The ...
2
votes
2answers
187 views

Can I use the same truststore and keystore on the client and the server?

TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides? More info if helpful: I'm trying to test ...
0
votes
1answer
41 views

PIN transfer between payment schemes

I am wondering, if it should be possible to transfer PIN in case of migrating between different payment schemes like Mastercard or VISA. For example, when I have a card issued by Mastercard, and it ...
0
votes
1answer
124 views

Protect sensitive data in memory

Is there a way to protect sensitive data which is in RAM? Our setup is a microcontroller with no hardware support for security. When there is a need to encrypt data, then the secret key exists in RAM. ...
0
votes
0answers
55 views

Hashed password vs key, full-disk encryption

In the case of FDE, I understand that the user defined password is ran through a hashing algorithm such as SHA-512 (often with a random SALT and a high iteration count to act as a countermeasure for ...
1
vote
1answer
870 views

Thales HSM: relationship between the various key types?

I am going through the Thales HSM manuals, and frankly the key acronyms are driving me crazy. I would like to understand the differences between the following keys, and how they relate to one another: ...
2
votes
0answers
135 views

Is it safe to generate a temporary API key from a random generator seeded by a secure random generator?

I have a need to generate a key consisting of a given number of random characters that will be used to access resources via a public API. It should not be possible to predict the key. This is done in ...
2
votes
2answers
185 views

Hawk vs. API key authentication

For a HTTP(S) API, which is better (/ which is better under which circumstances)? Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...
0
votes
0answers
45 views

Is any key signing party directory - or a mean to facilitate such meetings, exists?

I need to develop my web of trust. I don't live in or near a metropolitan area and as such it is a bit difficult to find possible local people to sign. I assume I must not be alone in that context. ...
-1
votes
1answer
323 views

How i can generate a DES3 key coded in base64 in openssl

How can I generate a DES3 key encoded in base64 using openssl tool?
0
votes
0answers
64 views

How TLS symmetric encryption works?

After the secret symmetric key is exchanged, how does it look like? What length (in a production use) is it and what can influence it? How the key is used to encrypt / decrypt a piece of data? I ...
0
votes
0answers
64 views

Could using the azure storage account access_key_name to in databricks notebook be considered best practise?

Currently, we are using key_name mentioned in the below code to access the blob storage in azure from databricks notebooks. We aren't directly using the 512 bit access key value from the azure storage ...
0
votes
1answer
320 views

What are the steps of hashing and steps of verifying password using salt and key? [duplicate]

What are the steps of hashing password during registration and login to an application using salt and key? Are the following steps considered correct if applied to an application?: 1- During ...
-4
votes
2answers
139 views

Can I publish my domain's ssl certificate's private key?

I want to buy a new domain (example.com) and a Wildcard certificate for that domain (*.example.com) from namecheap. Then I will set up an NS server to define a rule to resolve part of my subdomain to ...
0
votes
0answers
65 views

Securely distributing passwords and salts that will be derived by client programs

I am creating a client-server architecture running on top of the KCP protocol in Go. The package for KCP that I'm using is KCP-Go (https://github.com/xtaci/kcp-go). The package supports packet-level ...
4
votes
2answers
898 views

Difference in ECDSA private key format

I have two private ssh keys, - one was originally created with ssh-keygen the other one with a python script. They are supposed to be the same, however one works for authentication and the other one ...
2
votes
1answer
2k views

RSA key exchange is obsolete. Enable an ECDHE-based cipher suite

If what this says is what I think, does that mean the connection could be compromised and or vulnerable to MitM &/or other attacks? Cert shows to be good, but there is this "RSA key exchange is ...
0
votes
1answer
119 views

How can I distribute highly confidential keys for a symmetric cipher?

Say I want to exchange a key with someone for a symmetric cipher (say AES) without meeting them in person. What would be the most secure way to do this over the Internet? My first instinct would be ...
3
votes
0answers
629 views

How does Veracrypt work?

I’m a layman in security and was trying to understand how hashes and encryption algorithms are used in Veracrypt/Truecrypt. Reading the documentation, this is what I understood (please, feel free to ...
-4
votes
1answer
123 views

Binary Numbers converted to Hexadecimal private key [closed]

Couldn't you use brute force to guess someone’s binary number because it's 1 or 0 - 256 times then just keep switching 1's and 0's around- which then can be converted hexadecimal to guess their ...
1
vote
0answers
38 views

Does TDE not protect against disk theft?

I read the following on Microsoft's site. Can someone please clarify - "With TDE, is the data stored in my data, log, and backup files protected from a disk theft?" Yes, but only if the files ...
5
votes
4answers
1k views

Generate API keys with JWT and regenerate the same key when needed

I recently found my self in need of developing a public API for my application. I developed my application with node.js and MongoDB. After some research, I decided to use jwt for generating API keys ...
2
votes
1answer
704 views

How to securely share sensitive info (such as API keys) with freelancers?

My business partner and I are building a webapplication. We have partnered with some third party services which make use of API (public and secret) keys. The freelance developer we worked with ...
0
votes
1answer
110 views

Update letsencrypt certificates without changing the private key

I want to renew the letsencrypt certificate on my webserver but want to keep the private key same. I've installed the certificate using certbot 0.35.1 How can I update the certificate (preferably ...
1
vote
1answer
114 views

Android key protection

I was reading this documentation and saw this part; When an application performs cryptographic operations using an Android Keystore key, behind the scenes plaintext, ciphertext, and messages to be ...
1
vote
2answers
2k views

Understanding AES Keys and Passphrases

I am trying to get my head around how AES works and in particular I have queries around the key generation and 'passphrases'. My understanding is that AES has a 128 bit block size but the key length ...