Questions tagged [key]

Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.

Filter by
Sorted by
Tagged with
0
votes
2answers
65 views

Using the same password to encrypt and to authenticate other actions

Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN. I would also like to use this same PIN as a secondary protection for some ...
0
votes
2answers
78 views

Recreating the Half Coins of Jin-Qua [closed]

In the Asian Saga series by James Clavell, the Struan family gave away the half-coins of Jin-qua: in exchange for a desperately needed loan, the pirate Dirk Struan received 4 halves of 4 coins. The ...
2
votes
2answers
66 views

Can I use the same truststore and keystore on the client and the server?

TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides? More info if helpful: I'm trying to test ...
0
votes
1answer
34 views

PIN transfer between payment schemes

I am wondering, if it should be possible to transfer PIN in case of migrating between different payment schemes like Mastercard or VISA. For example, when I have a card issued by Mastercard, and it ...
0
votes
1answer
57 views

Protect sensitive data in memory

Is there a way to protect sensitive data which is in RAM? Our setup is a microcontroller with no hardware support for security. When there is a need to encrypt data, then the secret key exists in RAM. ...
0
votes
0answers
41 views

Hashed password vs key, full-disk encryption

In the case of FDE, I understand that the user defined password is ran through a hashing algorithm such as SHA-512 (often with a random SALT and a high iteration count to act as a countermeasure for ...
0
votes
1answer
171 views

Thales HSM: relationship between the various key types?

I am going through the Thales HSM manuals, and frankly the key acronyms are driving me crazy. I would like to understand the differences between the following keys, and how they relate to one another: ...
2
votes
0answers
61 views

Is it safe to generate a temporary API key from a random generator seeded by a secure random generator?

I have a need to generate a key consisting of a given number of random characters that will be used to access resources via a public API. It should not be possible to predict the key. This is done in ...
2
votes
2answers
119 views

Hawk vs. API key authentication

For a HTTP(S) API, which is better (/ which is better under which circumstances)? Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...
0
votes
0answers
41 views

Is any key signing party directory - or a mean to facilitate such meetings, exists?

I need to develop my web of trust. I don't live in or near a metropolitan area and as such it is a bit difficult to find possible local people to sign. I assume I must not be alone in that context. ...
-1
votes
1answer
185 views

How i can generate a DES3 key coded in base64 in openssl

How can I generate a DES3 key encoded in base64 using openssl tool?
0
votes
0answers
57 views

How TLS symmetric encryption works?

After the secret symmetric key is exchanged, how does it look like? What length (in a production use) is it and what can influence it? How the key is used to encrypt / decrypt a piece of data? I ...
0
votes
0answers
39 views

Could using the azure storage account access_key_name to in databricks notebook be considered best practise?

Currently, we are using key_name mentioned in the below code to access the blob storage in azure from databricks notebooks. We aren't directly using the 512 bit access key value from the azure storage ...
0
votes
1answer
105 views

What are the steps of hashing and steps of verifying password using salt and key? [duplicate]

What are the steps of hashing password during registration and login to an application using salt and key? Are the following steps considered correct if applied to an application?: 1- During ...
-4
votes
2answers
123 views

Can I publish my domain's ssl certificate's private key?

I want to buy a new domain (example.com) and a Wildcard certificate for that domain (*.example.com) from namecheap. Then I will set up an NS server to define a rule to resolve part of my subdomain to ...
0
votes
0answers
57 views

Securely distributing passwords and salts that will be derived by client programs

I am creating a client-server architecture running on top of the KCP protocol in Go. The package for KCP that I'm using is KCP-Go (https://github.com/xtaci/kcp-go). The package supports packet-level ...
3
votes
2answers
262 views

Difference in ECDSA private key format

I have two private ssh keys, - one was originally created with ssh-keygen the other one with a python script. They are supposed to be the same, however one works for authentication and the other one ...
1
vote
1answer
686 views

RSA key exchange is obsolete. Enable an ECDHE-based cipher suite

If what this says is what I think, does that mean the connection could be compromised and or vulnerable to MitM &/or other attacks? Cert shows to be good, but there is this "RSA key exchange is ...
0
votes
1answer
117 views

How can I distribute highly confidential keys for a symmetric cipher?

Say I want to exchange a key with someone for a symmetric cipher (say AES) without meeting them in person. What would be the most secure way to do this over the Internet? My first instinct would be ...
0
votes
0answers
42 views

Server application to hold PGP private keys and decrypt as requested

I don't know if what I'm talking about exists, or if the concept doesn't make any sense, or even if it's just a stupid question. I'm developing a small integration for our business which receives ...
2
votes
0answers
234 views

How does Veracrypt work?

I’m a layman in security and was trying to understand how hashes and encryption algorithms are used in Veracrypt/Truecrypt. Reading the documentation, this is what I understood (please, feel free to ...
-4
votes
1answer
101 views

Binary Numbers converted to Hexadecimal private key [closed]

Couldn't you use brute force to guess someone’s binary number because it's 1 or 0 - 256 times then just keep switching 1's and 0's around- which then can be converted hexadecimal to guess their ...
1
vote
0answers
38 views

Does TDE not protect against disk theft?

I read the following on Microsoft's site. Can someone please clarify - "With TDE, is the data stored in my data, log, and backup files protected from a disk theft?" Yes, but only if the files ...
5
votes
4answers
641 views

Generate API keys with JWT and regenerate the same key when needed

I recently found my self in need of developing a public API for my application. I developed my application with node.js and MongoDB. After some research, I decided to use jwt for generating API keys ...
0
votes
0answers
87 views

How do you generate a RSA private key that is BER encoded with OpenSSL?

According to the Linux Kernel's Asymmetric Cipher API found at the following URL: https://www.kernel.org/doc/html/latest/crypto/api-akcipher.html#asymmetric-cipher-api, you must pass a BER encoded ...
2
votes
1answer
189 views

How to securely share sensitive info (such as API keys) with freelancers?

My business partner and I are building a webapplication. We have partnered with some third party services which make use of API (public and secret) keys. The freelance developer we worked with ...
0
votes
1answer
68 views

Update letsencrypt certificates without changing the private key

I want to renew the letsencrypt certificate on my webserver but want to keep the private key same. I've installed the certificate using certbot 0.35.1 How can I update the certificate (preferably ...
1
vote
1answer
99 views

Android key protection

I was reading this documentation and saw this part; When an application performs cryptographic operations using an Android Keystore key, behind the scenes plaintext, ciphertext, and messages to be ...
0
votes
2answers
576 views

Understanding AES Keys and Passphrases

I am trying to get my head around how AES works and in particular I have queries around the key generation and 'passphrases'. My understanding is that AES has a 128 bit block size but the key length ...
1
vote
0answers
40 views

Single vs. multiple synchronous keys to encrypt list for multiple users to decrypt

I've found a few questions which address a single document that needs decryption by multiple users, but I would like to encrypt a list of words stored on mySQL datbases using PhP in such a way that ...
1
vote
1answer
96 views

Can we define a single immutant state of a device (modern computers at least) to derive a key from?

Please be open and bear with me, I read a lot about encryption, but practiced very little. I want to write a simple application that uses common encryption algorithms, but based on a derived key ...
0
votes
1answer
332 views

Understand the “Windows Key Store”

I work in a enterprise environment and I often hear the use of the "Windows Key Store" to store various keys including symmetric. I do understand there is a "Windows Certificate Store" which as the ...
0
votes
3answers
183 views

How is the strength of a key/Password determined

I was reading about the Principle of Key Sizes and came across this table: The deduction I made off this is that after a certain key size, increase in a single bit causes Time required for search to ...
1
vote
3answers
303 views

Which function to hash 128 bit API key with?

I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
1
vote
1answer
290 views

Do I need to use salt with api key hashing?

I will generate api keys. I plan to store their hashes instead of plain text. do i also need salt, similar to storing password? AFAIK salt prevents rainbow table attack and those are more ...
40
votes
3answers
7k views

Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?

A common saying among people in the field of cryptography and security is that when providing a back door to law enforcement, you also provide a back door for hackers. I was trying to examine the ...
1
vote
0answers
429 views

Is it possible decrypt Android 8 encryption, if the device encryption key is gone (but with a known PIN and KEK)?

main question is in the title. Some clarification though: When you factory reset your encrypted phone, the old device encryption key (DEK a) gets deleted and a new encryption key (DEK b) is being ...
0
votes
1answer
67 views

Effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption [closed]

I'm a high school student taking IB and for my EE on Maths, I'm comparing the effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption....
0
votes
0answers
54 views

Embeddable 3rd party web tools security against stealing the key

We are building a website and we are using plenty of third-party tools that basically give you an HTML script tag and ask you to place it into your index.html. A few examples of such tools are: ...
0
votes
0answers
356 views

TLS Pre-master key [duplicate]

If I have access to the pre-master key of a TLS handshake, is it possible to decrypt the rest of the handshake following this? If so, is it possible to get the pre-master key while it is still not ...
1
vote
3answers
187 views

Is it safe if SSH and HTTPS server share the same RSA/DSA keys?

I'm configuring an ssh server for an embedded device. This device already has an x.509 certificate and a pair of public key and private keys stored in it that is used for its HTTPS server. Is it safe ...
2
votes
1answer
529 views

Is it possible to LUKS require both password and key file?

My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in ...
2
votes
2answers
1k views

HMAC and key size

I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths. Do we have to use a key with a fixed size in HMAC? If so, what is the key size? ...
0
votes
0answers
188 views

EMV card secret key + PIN to generate HOTP key

The Open Authentication HOTP algorithm is considered very reliable when using a 160 bits long secret key. Suppose I have this idea to generate such a 160 bits long key without requiring any further ...
3
votes
1answer
701 views

KeePass Key File - Does it provide any meaningful security?

KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much. I can see a couple of scenario's: The database and key are on ...
1
vote
2answers
2k views

How to generate the most secure private key? [closed]

I need to generate the most secure private key. Usually I use a command: openssl genrsa -des3 -out mykey.key 2048 Is triple DES secure enough? Is 2048 large enough? Are there any other ways to ...
0
votes
3answers
274 views

How often do brute force attacks find the password or key in a much shorter amount of time than the theoretical max?

For a 128-bit key, it would theoretically take many years and a percentage of the entire worlds power output to check every possible key, or for 256-bit it would take 3 sexdecillion years. But the ...
0
votes
0answers
82 views

How to securely generate a License tied to 1 Computer for each user

This question is related to my first question: How secure is this schema for Online Licensing System? I'm trying to sell a subscription based software and I can't find a good way to generate a serial ...
0
votes
0answers
212 views

SSH-1 key length

What is the maximum size in bits of one SSH-1 key? 4096? I found some docs where this value is listed and others without limit
2
votes
1answer
75 views

Does this attack on RSA keys reveals a major flaw, or this is no big deal with good entropy?

William Kuszmaul published a study of an attack for RSA public keys on his blog https://algorithmsoup.wordpress.com/2019/01/15/breaking-an-unbreakable-code-part-1-the-hack/ The basic idea is, when ...