Skip to main content

Questions tagged [key]

Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.

Filter by
Sorted by
Tagged with
0 votes
1 answer
31 views

Exporting HSM Keys [closed]

At the moment our Environment is On-Prim but very soon we will be moving to AWS cloud, but one obstacle we are facing and it is related to Luna Safenet Network 7 HSM. Is it possible to export Private ...
OmiPenguin's user avatar
0 votes
1 answer
68 views

Why is the boot key used to access the encrypted SAM database hashes?

A quick something I’ve been wondering: why is the boot key used to access the encrypted SAM database hashes, (and not another key,) and also what encryption mechanism is actually used to encrypt the ...
security_paranoid's user avatar
0 votes
0 answers
73 views

Rotate or replace EMV keys?

I would like to better understand the mechanism of rotation of EMV keys used for payment cards. Assuming that it intends to provide a rotation of the keys used for the production cards: just recycle ...
MaXbeMan's user avatar
2 votes
0 answers
314 views

PGP expired encryption subkey : renew or replace?

I am in the process of learning PGP (GnuPG more precisely). I am trying to figure out which is the best strategy for my encryption ([E]) subkey in terms of expiration/revocation/renewal. Could you ...
ChennyStar's user avatar
0 votes
0 answers
164 views

HSM Thales PayShield vulnerabilities

My management requested to investigate about security of HSM Thales Payshield. Have you ever heard of any security bugs on the HSM Thales Payshield? I mean, except for the known bugs reported in their ...
MaXbeMan's user avatar
0 votes
0 answers
79 views

Security implication of loading untrusted private keys

The FIPS draft for Dilithium signature scheme (official name ML-DSA) had just been released not long ago. In the specification for skDecode (which is the subroutine that loads the private signing key) ...
DannyNiu's user avatar
  • 374
1 vote
1 answer
120 views

Key Hash With Securely-Optimal Setting : For Encryption vs For Password

Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ? So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
Agus Setiawan's user avatar
1 vote
1 answer
545 views

CVV2 calculation with TR-31 Key

I need to use the CVK Key (in key block format) to calculate the CVV2. In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
MaXbeMan's user avatar
0 votes
1 answer
286 views

PCI compliance - use of ANSI X9.17 for export keys

we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
MaXbeMan's user avatar
0 votes
1 answer
211 views

Permanent Keys/Secrets in TLS 1.3

In TLS 1.3 (RFC8446), there are many secrets and keys. As far as I've understood, every certificate (usually only the server) has a long term key associated with it which is used with HKDF to generate ...
bacle173's user avatar
3 votes
1 answer
1k views

What is the point of the “AES Key Wrap” algorithm?

What is the point of the “AES Key Wrap” algorithm prescribed for use with CMS-like contexts in IETF RFC 3394? Just look at the algorithm (tacked on to the end of this post), informally, it smells a ...
JamesTheAwesomeDude's user avatar
3 votes
1 answer
490 views

Can someone with access to only my Yubikey gain access to my server that has SSH access via an ED25519-sk keypair?

My understanding is that an ED25519-sk SSH key generated by OpenSSH generates a private key stub that lives on your host machine. This stub is just a reference to the actual private key that lives on ...
angryserver's user avatar
2 votes
0 answers
181 views

How do you know what KDF was used to protect an SSH-Key?

Assuming I have found several OpenSSH private keys on my client's system, how can I detect (at scale) which of them are: completely unprotected (i.e. no passphrase) using an old hashing algorithm for ...
John Nemo's user avatar
1 vote
1 answer
252 views

Detecting signal amplification attacks against PKE keyless fobs

During the early hours of the morning there was an attempt to enter and presumably steal various vehicles on my street, detected well after the fact via householders reviewing CCTV motion detection ...
CuriousTechie's user avatar
0 votes
1 answer
111 views

Is my PGP key which I uploaded to sync.net compromised?

I just accidentally uploaded my PGP key in unencrypted format to rsync.net. As far as I know, nobody but me has access to the account. Is my key compromised?
Someone's user avatar
  • 169
3 votes
1 answer
4k views

Is it safe to send an API key in an HTTPS request? [duplicate]

Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ? We need to send data to a 3rd party from ...
Pure.Krome's user avatar
0 votes
3 answers
92 views

Encryption key fuzzing for forensics analysts

I'm trying to make a simple encryption tool for Debian-like systems. I would simply hash a password, use it to lock/unlock a file, and it would never be stored on the drive. My dad threw out the idea ...
R-Rothrock's user avatar
2 votes
1 answer
656 views

Is encryption with MySQL Aes_encrypt() + stored procedure ok?

I would like to do encryption with MySQL AES_ENCRYPT() function used in a stored procedure on the database. Firstly, I changed the encryption block mode from aes-128-ecb to aes-256-cbc in the MySQL ...
Poubelle Dirty's user avatar
1 vote
1 answer
114 views

Changing openssl key/IV when encrypting diffrent rows of data in database?

I'm looking for a way to encrypt data in MySQL database securely. The data come from a web interface from a POST form and each POST request from the user insert a new line in the database. Right now, ...
JohnyJohny's user avatar
0 votes
1 answer
287 views

Secure chat application with multiple users on one device?

I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application. My thought was to store a private key in ...
JavaForAndroid's user avatar
2 votes
1 answer
2k views

ThinkShield secure wipe - SSD does it forbid data recovering?

I have to give my computer back to my boss. I want to delete all the data from my SSD. I found "ThinkShield secure wipe" which is implemented in the BIOS apparently. It gives me two options: ...
mat's user avatar
  • 23
1 vote
1 answer
263 views

Do sites like reddit and Quora expose their Google API client keys to the public?

On Quora, when I want to sign in using Google, I am redirected to this URL, which has a parameter client_id=917071888555.apps.googleusercontent.com. Similarly, reddit takes me here, which has ...
Cornelius Brand's user avatar
0 votes
4 answers
822 views

Benefits of non-standard SSH port when password authentication is turned off

Is there any benefit of using a non-standard SSH port when PasswordAuthentication is turned off in sshd? The only benefit of non-standard SSH ports I know of is a reduction of the amount of brute ...
303's user avatar
  • 101
0 votes
1 answer
443 views

deleted a subkey and can now no longer decrypt

My public key had expired so I tried to edit the expiry date with gpg --edit-key It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the ...
cardamom's user avatar
  • 379
1 vote
0 answers
536 views

How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?

Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
Letal1s's user avatar
  • 109
1 vote
1 answer
466 views

Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?

When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a ...
Letal1s's user avatar
  • 109
0 votes
1 answer
124 views

How can a client safely post/get a (symmetric) client key to/from a key distribution center?

If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
hurryman2212's user avatar
1 vote
3 answers
3k views

What format is this private key in, and how can I process it using bouncycastle?

I have the following private key. I'd like to be able to process it into an instance of ECPrivateKey using Bouncycastle (or the builtin Java security API if bouncycastle isn't necessary). -----BEGIN ...
rurouniwallace's user avatar
1 vote
0 answers
370 views

Storing AES key for later usage

I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
Rak Laptudirm's user avatar
0 votes
1 answer
678 views

Where should private key(s) reside in IPsec VPN tunnel

I setup an IKE VPN server for road warriors. I actually have this working (YAY!) but took some shortcuts that are leaving me with a working yet not-right/secure setup. My setup is as follows: My ...
TSG's user avatar
  • 159
-2 votes
2 answers
108 views

Is the term "only-unlocking key" more accurate than the term "private key"?

Paraphrasing this: Symmetric cryptography is like a door lock. Everyone that has a key can lock and unlock. Asymmetric cryptography is like a common lock or handcuff. Anyone can lock it but only the (...
humble-learner's user avatar
0 votes
0 answers
218 views

Storing an encryption key securely

I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options. Option 1) Storing the key on the same server (not recommended, ...
JavaForAndroid's user avatar
0 votes
1 answer
2k views

Does alias in a truststore matter?

I was trying to add a new certificate to our truststore. But I got the alias already exists error. I can't remove the old certificate yet, but I have to add the new certificate. Will it matter if I ...
ssl_noob's user avatar
1 vote
3 answers
7k views

Tricky apartment key fob copies frequency & code correctly but the copy doesn't work - not a rolling fob

I have this key fob for our apartment building, and I want to make a copy of it. I've taken it to 3 locksmiths who are able to create a copy, but the copies don't work. I've confirmed that it doesn't ...
user avatar
0 votes
0 answers
119 views

Acquiring true randomness for generating a key

Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to ...
Brakke Baviaan's user avatar
0 votes
1 answer
994 views

Encryption Algorithm With Separate One-Way (Hashing) And Two-Way (Decryption) Keys

In cryptography, generally we have two ways of handling sensitive information. We can use one-way encryption such as hashing. This is useful when we never need to retrieve it again. In this case, we ...
azoundria's user avatar
  • 753
0 votes
0 answers
143 views

Is it safe to use a Digital Signature created with a PKI certificate's private key as a password

I'm trying to create application-layer encryption for user data in my database, using password derivation function. But there is a problem, that there must be an admin user, who can access all user's ...
Владимир Лопаткин's user avatar
0 votes
1 answer
1k views

VeraCrypt: Is it possible to change the master key?

The password in VeraCrypt is used to en-/decrypt a header, that contains a master key, that is used to en-/decrypt the data. I know, that I can change the password, which will not change the master ...
stackprotector's user avatar
1 vote
1 answer
668 views

Security requirements for public API keys

I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients. The scripts will be run on the endpoints several ...
uvzz's user avatar
  • 11
1 vote
2 answers
407 views

How to manage Encryption Key for Server Side Encryption in AWS S3

I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows: All the existing data ...
abhishekti7's user avatar
5 votes
1 answer
922 views

Impact of having more X509v3 Key Usage fields than required?

I was wondering if having an "oversubscription" of "Key usage fields" inside a X509v3 certificate can negatively impact the performance and/or the security of a server. For example ...
metriXc's user avatar
  • 65
1 vote
0 answers
2k views

"Failed connecting to the YubiKey. Make sure the application has the required permissions." [closed]

I have a Yubikey version 5.2.7 and I can't generate any new certificates on yubikey manager app, which is weird since I have already generated two certs (on 9d slot) and they worked fine. Now the ...
Gibberish's user avatar
  • 111
2 votes
1 answer
2k views

Looking for a lost PKE keyless entry fob

I have been looking for my lost car key. I have RTL-SDR and I am able to listen to key fobs frequency which varies between 350-444MHZ. I was trying to understand how most of the keyless entry systems ...
mack44452's user avatar
0 votes
1 answer
284 views

Can you obtain the passphrase of an encrypted SSH key, given the unencrypted key?

Imagine you get hold of someone's private SSH key, which is encrypted. Now imagine you also get hold of the unencrypted key (e.g., because some SSH client stores it after decryption). Can you ...
bers's user avatar
  • 240
1 vote
2 answers
692 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
CHOO YJ's user avatar
  • 113
1 vote
1 answer
2k views

How safe is AES 256bitkey encoded in HEX, Base64?

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv}); The secret is generated through: function generateKey(passphrase) { const salt = CryptoJS....
Kim Mỹ's user avatar
  • 145
1 vote
2 answers
5k views

Does certutil -delkey actually delete the certificate and private key?

I am trying to delete a certificate and it's private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command ...
lee23's user avatar
  • 131
1 vote
1 answer
587 views

gnu gcc source archives signed with expired GPG key?

I'm in the course of rescuing a legacy app that got left behind and turned out to be needed on rare occasions, one of which occurred yesterday. I need to rebuild some libraries and the libraries have ...
Scott's user avatar
  • 165
9 votes
2 answers
3k views

Securing API keys for a Twitter account for a program to be run on other PC's

I've created a method to allow my project EditVideoBot to be 'decentralised', where rather than the program processing and uploading all video editing requests on my own central server, users can ...
pigeonburger's user avatar
1 vote
1 answer
854 views

Key pairs extension / version

I read in some docs, there are several version of GPG key extension available. For ex: gpg, ascii, p12 I know .gpg extension is in binary, and Ascii is in text. But I want to know their differences ...
tadata's user avatar
  • 13

1
2 3 4 5