Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key]

Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.

0
votes
0answers
21 views

Establish a secure communication between third-party Javascript Client and REST API

There's a third-party company that is developing something like an script tag that could be included in any Web page in order to start interaction with a chat. They are trying to do something like ...
0
votes
0answers
21 views

TLS Pre-master key [duplicate]

If I have access to the pre-master key of a TLS handshake, is it possible to decrypt the rest of the handshake following this? If so, is it possible to get the pre-master key while it is still not ...
1
vote
3answers
136 views

Is it safe if SSH and HTTPS server share the same RSA/DSA keys?

I'm configuring an ssh server for an embedded device. This device already has an x.509 certificate and a pair of public key and private keys stored in it that is used for its HTTPS server. Is it safe ...
1
vote
1answer
38 views

Is it possible to LUKS require both password and key file?

My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in ...
2
votes
2answers
131 views

HMAC and key size

I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths. Do we have to use a key with a fixed size in HMAC? If so, what is the key size? ...
0
votes
0answers
78 views

EMV card secret key + PIN to generate HOTP key

The Open Authentication HOTP algorithm is considered very reliable when using a 160 bits long secret key. Suppose I have this idea to generate such a 160 bits long key without requiring any further ...
3
votes
1answer
133 views

KeePass Key File - Does it provide any meaningful security?

KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much. I can see a couple of scenario's: The database and key are on ...
0
votes
2answers
137 views

How to generate the most secure private key? [closed]

I need to generate the most secure private key. Usually I use a command: openssl genrsa -des3 -out mykey.key 2048 Is triple DES secure enough? Is 2048 large enough? Are there any other ways to ...
0
votes
3answers
234 views

How often do brute force attacks find the password or key in a much shorter amount of time than the theoretical max?

For a 128-bit key, it would theoretically take many years and a percentage of the entire worlds power output to check every possible key, or for 256-bit it would take 3 sexdecillion years. But the ...
0
votes
0answers
71 views

How to securely generate a License tied to 1 Computer for each user

This question is related to my first question: How secure is this schema for Online Licensing System? I'm trying to sell a subscription based software and I can't find a good way to generate a serial ...
0
votes
0answers
49 views

SSH-1 key length

What is the maximum size in bits of one SSH-1 key? 4096? I found some docs where this value is listed and others without limit
1
vote
1answer
64 views

Does this attack on RSA keys reveals a major flaw, or this is no big deal with good entropy?

William Kuszmaul published a study of an attack for RSA public keys on his blog https://algorithmsoup.wordpress.com/2019/01/15/breaking-an-unbreakable-code-part-1-the-hack/ The basic idea is, when ...
2
votes
2answers
59 views

Private key DES password

If I have a SSL private key that is encrypted with a DES password, and I have to share with another admin a NODES copy of the private key, can the other admin determine what my DES password is?
2
votes
1answer
137 views

If PGP is 2048 or 4098, then what is 128-bit encryption? [duplicate]

PGP is 2048 bit encryption? That a whole lot more than 128 bits. But, I thought 128 bits is more "serious" and "legit"
4
votes
4answers
342 views

Can I use a user's password hash as the AES key to make a one time token?

I want to make a one time token that users use to reset their password. The token should be invalidated once it is used, is it safe to use their currently hashed password as the aes key to encrypt the ...
4
votes
1answer
132 views

If my private key is password protected, then how is it used without asking me for it?

Relating to TLS and SSH. If my private key is password / passphrase protected, how is this then used automatically during TLS or SSH communication without asking me for the password?
1
vote
0answers
32 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
1
vote
0answers
138 views

Where To Store Public and Private Key files?

I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting. In my project, I'm generating two files: Public Key file and ...
1
vote
1answer
84 views

The NIST randomness tests for a generated key

Does different tests for key randomness provided by NIST are available online? where one can test that which test for key generated are passed and which are failed?
2
votes
0answers
98 views

GPG: how to encrypt using a keyfile? (symmetric)

In Ubuntu this produces a "filename.txt.gpg" file and works: $ gpg --symmetric --passphrase-file keyfile.key filename.txt In debian, I get a popup requesting I enter a password... How do I encrypt ...
0
votes
1answer
91 views

Secure Routing without relying on Cryptography? [closed]

Is anyone aware of a routing protocols for Ad Hoc Networks (such as OLSR, AODV, ZRP) which are secure without relying on pre-established key management? What I mean by secure is, preventing data ...
2
votes
1answer
123 views

API Key in microservices

Is sending an encrypted connection string as an API Key through headers a good idea? Someone once told me, storing API Keys in a DB is a bad thing to do but I can't seem to figure out how, when in ...
1
vote
2answers
179 views

AES-256 decryption after key destruction. Possible or not?

Can AES-256 be decrypted if after the encryption process you destroy the key that must be used to decrypt the data, is it possible?
0
votes
1answer
35 views

Automatically import/deploy/distribute private key to users for use with S/MIME

it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt ...
4
votes
1answer
616 views

How to securely store API keys

I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
-1
votes
2answers
669 views

PGP public key is visible

I have found a page with lots of PGP public keys. There is an email address on url. This page is: -----BEGIN PGP PUBLIC KEY BLOCK----- ...
2
votes
2answers
787 views

Why is an HSM required to protect CA certificates (rather than a regular USB token)?

Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on. The same vendors also offer distinct products called HSMs (...
-5
votes
1answer
121 views

What are the most used encryption/decryption keys?

I started Working On a encryption project, but I am facing a problem with the leak of encryption keys. Is there a list of the most popular encryption keys used, like the password lists of most used ...
1
vote
1answer
281 views

Multiple CSRs from the same private key

Consider that I generate a new undisclosed private key using openssl: openssl genrsa -out personal.key 2048 I then generate the multiple CSR requests (called csr1.csr and csr2.csr): openssl req -...
4
votes
1answer
39 views

Understanding Shake on IT key exchange

Shot paper I am reading a paper about key exchange and trying to understand the protocol described in Figure 4 on page 6 in the above paper. I understand the majority of the notation but am having a ...
2
votes
2answers
160 views

TLS protocol, session key for secure connection

In Wikipedia, as part of handshaking between a client and a server, the server send a public encryption key as part of the digital certificate. Then the client uses Diffie–Hellman key exchange to ...
1
vote
1answer
50 views

Is there a standard checksum for verifying multipart key fragments?

We will have a symmetric key arriving in three component parts. Once all parts arrive, the key custodians will get together for a ceremony where each enters their part of the key into a secured ...
2
votes
1answer
78 views

Encryption Engine vs Key Server

What is the difference (if any) between a Key Server and an Encryption Engine? Is a Key Server also the same as a Key Manager? I've seen the terms Encryption Engine, Key Server and Key Manager used ...
2
votes
3answers
567 views

Securely changing Veracrypt password

How can I change a Veracrypt (master) password efficiently and securely? Based on the answers here, it is not safe to use system --> change password due to various reasons. I cannot simply image ...
4
votes
2answers
455 views

Using weak Veracrypt password safe?

Is it safe to create a Veracrypt partition (on a USB) such that it takes up the whole device (ie. not a "file", but using the USB as the storage container) it contains only a standard volume (no ...
1
vote
1answer
283 views

Cracking RSA keys, only given N and e

Is it possible to crack RSA keys when only given N and e? If so, is there a limit to how long N or e can be? How do you go about doing that? In the specific scenario I'm researching, N is about 150 ...
2
votes
1answer
765 views

SSL/TLS Client certificate's key with or without pass phrase?

I have a small PKI for our web server that will require client certificates. When generating the private key for CSR (edit: CSR for a client certificate ), I can do it with or without a pass phrase. ...
0
votes
1answer
68 views

Key Generation on FIPS device or using SW with FIPS generator

I would like to understand the difference between these two options how to generate AES key. AES key is generated directly in FIPS 140-2 Level 3 device with validated AES algorithm AES key is ...
3
votes
4answers
1k views

Private Key Storage in a Java Desktop Application

I am talking about system private keys for API, Google Analytics and etc... (not user´s private key) Where is the best place to store it? (Java class, properties, hidden file, preferences) (Cross-...
3
votes
1answer
326 views

Why are SSH host keys stored un-encrypted?

Do we have any standard way to encrypt SSH host keys (like /etc/ssh/ssh_host_rsa_key)? If not, why is it stored in plaintext? Isn't it sensitive information?
2
votes
0answers
204 views

How to implement a Crysis ransomware master key?

I see there have been master keys released to decrypt computers affected by the Crysis ransomware. If a computer is infected with Crysis, how would one actually test/run the key on the computer? ...
1
vote
2answers
103 views

How to exchange private keys between server and clients?

I am developing an encryption application but I do not have good ideas about how exchange the private key as securely around the internet. I have some simple ideas like combine some data with client's ...
2
votes
1answer
3k views

How to find a wep key inside a pcap file with only 2 IV?

I have a pcap file that contains 3 packets. I need to find a WEP key inside these packets. These packets contains only two IV. It's not a live attack so I can't try brute force.
1
vote
1answer
3k views

Static Key Ciphers and key persistence

A vulnerability report states the following: The server is configured to support ciphers known as static key ciphers. These ciphers don't support "Forward Secrecy". In the new specification for ...
2
votes
1answer
661 views

Will changing the TLS Diffie-Hellman key exchange bit length from 1024 to 2048 cause client/browser compatibility issues?

Recently discovered the need to upgrade our DH key exchange length (used for TLS) from 1024 bits to 2048 bits (due to Logjam exploit and other factors). The question is: How will making that change ...
1
vote
1answer
713 views

How to decrypt a text with substitution cipher? [closed]

I recently got a file which I had encrypted with substitution cipher a long time ago. I went to crack down the key and almost got it. But I encrypted it not just with alphabets but also with numbers ...
0
votes
2answers
465 views

I need to generate a CSR on my HSM with a critical key usage of Non Repudation?

As above, we were planning to do the following: Access our HSM (Luna SA) Generate CSR Send CSR to 3rd Party CA Add critical key usage of Non Repudiation on 3rd Parties portal Send the now signed CSR (...
0
votes
1answer
346 views

WordPress 4.7.2 Authentication Cookie Brute-force

I recently came across a WordPress (v 4.7.2) site with an exposed wp-config.php file, within which plain text server authorisation key secrets were accessible. Having read Mike Czumak's article on ...
1
vote
1answer
380 views

Storing data encryption key (client side)

I have moderate knowledge of programming , and currently I am writing a client-server messaging application for windows. My project is written from scratch using sockets , and all it does is data ...
0
votes
1answer
124 views

Encrypt content such that it can decrypted only by a specific application

Is there a key management approach for the following scenario: Customer Alice uses an application S1 to generate a file. The contents are expected to be encrypted such that it can only be decrypted ...