Questions tagged [key]

Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

Lost keys after formatting Mac HD [migrated]

I lost my private keys after formatting my Mac and reinstalling my OS. I only have the public keys and the passphrase. What can I do?
0
votes
0answers
35 views

GitHub Exposure from Private Key without context

You've discovered an SSH private key and have learned it is used for GitHub authentication. Is it possible to obtain any private repository information? I think to clone a GitHub repository you would ...
0
votes
1answer
81 views

Does certutil -delkey actually delete the certificate and private key?

I am trying to delete a certificate and it's private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command ...
1
vote
1answer
113 views

gnu gcc source archives signed with expired GPG key?

I'm in the course of rescuing a legacy app that got left behind and turned out to be needed on rare occasions, one of which occurred yesterday. I need to rebuild some libraries and the libraries have ...
9
votes
3answers
3k views

Securing API keys for a Twitter account for a program to be run on other PC's

I've created a method to allow my project EditVideoBot to be 'decentralised', where rather than the program processing and uploading all video editing requests on my own central server, users can ...
1
vote
1answer
56 views

Key pairs extension / version

I read in some docs, there are several version of GPG key extension available. For ex: gpg, ascii, p12 I know .gpg extension is in binary, and Ascii is in text. But I want to know their differences ...
1
vote
0answers
44 views

Necessary fingerprint length etc. when Alice wants to send multiple pseudonymous messages in public to Bob and keep option of proving authorship later [closed]

Alice wants to send Bob messages. She has the following requirements. She plans to send him messages that are sequentially numbered, pseudonymous, and sent to him publicly over a period of time. Each ...
0
votes
1answer
103 views

The risk of RSA encryption. Would individually encrypted characters be risky?

Is it possible to decrypt a RSA message if the characters of the message are individually encrypted? The info you have is the message, the public key and the n which is too big to be factorizable.
0
votes
0answers
141 views

Get HLS decryption key from browser

How can I get decryption key for AES-128 encrypted HLS stream. In the m3u8 file, the URI for key leads to a file which is of 48 bytes which is encrypted. The stream is played by browser so it must ...
2
votes
1answer
175 views

OpenSSL encrypt DER format private key

When converting a password-protected PEM/PKCS1-encoded private key to DER format one is not able to encrypt the key, OpenSSL automagically asks for the password and writes the plain-text key in the ...
1
vote
0answers
60 views

How to use TPM for key management [closed]

I have read about TPM that these are the secured ways of storing cryptographic keys. I want to know how can I use it. I have an application running on a PC which has TPM. This application has hard ...
0
votes
1answer
55 views

Difference between these two extracted public keys?

I generated an RSA Private Key using openssl genrsa -out mykey.pem 2048 To extract the public key I have found 2 commands, one using openssl : openssl rsa -in mykey.pem -pubout > mykey.pub And the ...
5
votes
3answers
765 views

Hierarchical Key Rotation. Should I rotate the lowest level keys?

I have a hierarchical key system designed for my project. In this system a block of data is encrypted using a Data Encryption Key (DEK). This DEK is encrypted using a Key Encryption Key (KEK) which is ...
0
votes
0answers
18 views

How to connect Windows CNG with Nginx in order to protect server private keys?

As I read on this question, private keys are protected by CNG mechanisms in Windows. So using NGINX, I would like to know how to establish the communication between NGINX and this cryptographic API in ...
1
vote
1answer
72 views

Can a host access a VPS disk's encrypted directory directly while running?

I have an Ubuntu VPS running at a remote host. The disk is not encrypted but I have a specific directory that is encrypted for which I must provide a password via an SSH session (not stored anywhere ...
1
vote
1answer
50 views

How to create same ssh key pair on different systesm at different times

Was going through the SSH key pair generation and did tried with the few systems i have. refer to the below command and the thumbprint value post key pair generation. $ ssh-keygen.exe -t rsa ...
1
vote
0answers
61 views

Is it ok to store my Android app keystore password in a text file on my disk?

I am reading on how to sign and publish my flutter app on android. When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
1
vote
0answers
44 views

Securing API keys for accessing Google APIs via Front End (UI)

This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below. We currently have hybrid ...
2
votes
0answers
345 views

Is `gpg --refresh-keys` secure and where is this documented?

From the gpg manual: --refresh-keys Request updates from a keyserver for keys that already exist on the local keyring. This is useful for updating a key with the latest signatures, user IDs, etc. ...
0
votes
0answers
39 views

Authenticate Windows/Linux process against hardware security module

I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
1
vote
1answer
96 views

use custom 'key' for hardware security keys

Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
1
vote
1answer
91 views

TLS- Key exchange for session keys. Why?

I have a question about the Key Exchange Algorithm used in TLS process. I have read that the Key Exchange algorithm is used by client and server to exchange session keys. Do the client and server ...
0
votes
0answers
164 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
1
vote
0answers
96 views

Lost GPG private key and revocation certificate

I have created a GPG key and uploaded it to pgp.mit.edu. Then I accidentally wiped the drive that contained both the key and the revocation certificate. So what to do now? I found a possible answer ...
0
votes
1answer
85 views

What's a secure way to generate a keypair from a secret password?

I like to generate a public-private key pair that is seeded from a string. So having the string and the generation algorithm is enough to recreate the keys. I want to do this because I can then ...
0
votes
3answers
205 views

Associate API key with user

I am creating a public API that will require API key authentication. When a user wants to register a new API key, they send a request to one of our endpoints with a list of permissions they want. We ...
0
votes
1answer
460 views

Wrap key operation in Azure Key Vault - symmetric keys

Could anyone explain why the bolded part of the wrap key description? Wraps a symmetric key using a specified key. The WRAP operation supports encryption of a symmetric key using a key encryption key ...
3
votes
1answer
370 views

OpenVPN Key Size 1024 vs 2048 and Eavesdrop vs Access?

OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size. I'm trying to determine if it's worth ...
0
votes
0answers
78 views

Decrypting a file knowing only the password

I have encrypted a file using a program with a password and would like to decrypt it on another device just with the password. Is there any software that takes the password, runs it through all key ...
1
vote
2answers
2k views

When/why should the “mark this key as exportable” option be selected when importing a certificate?

When a certificate is being imported on Windows, at some point the following option is available: [] mark this key as exportable I understand that this is used in case the certificate needs to be ...
6
votes
1answer
771 views

Validating an Ed25519 public key

Is it possibly to test if an Ed25519 public key is valid without having access to the private key, a signed message or anything except the public key? "Valid" as in "Not just 32 random bytes". I'm ...
-1
votes
3answers
301 views

how do i find the number of possible keys / password to decrypt a plain text

I would like to know if there is any way to recover the plain-text of a message that's been encrypted with 55 rounds of the Caesar cipher, with a different (independently chosen) key for each round; I ...
2
votes
2answers
273 views

How to protect web server private keys on Ubuntu with Nginx without exposing any plain text credentials?

I'm developing a set of internal websites and services for a customer who has high levels of bureaucracy and strict formal rules about many things, one of them being "not storing passwords in plain ...
0
votes
0answers
49 views

Can we keep Pusher API keys public?

I was looking at my company site and I saw Pusher API keys are exposed. Should it be kept public?
0
votes
1answer
62 views

Is using SecureString in combination with Xor considered secure enough for standalone Windows app?

The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string. License.Import(string name, string email, ...
3
votes
0answers
58 views

Best practices for storing long-term access credentials locally in a desktop application?

I'm wondering how applications like Skype and Dropbox store access credentials securely on a user's computer. I imagine the flow for doing this would look something like this: Prompt the user for a ...
0
votes
0answers
31 views

How could I verify that a contract was actually sent to me from the client as soon as the contract is received?

If I want to store electronic contracts for clients over a long period of time. I need to make sure that those files are not readable by anyone other than the client until the client retrieves them at ...
0
votes
1answer
133 views

How to implement challenge-response with keyed hash algorithm when 2 people share same key?

Suppose that 2 people have a keyed hash algorithm (that is, a MAC) with a key that they both know. How could they implement challenge-response using their keyed hash algorithm? This confuses me...
2
votes
1answer
261 views

Should we use API keys for authorization on a public API (instead of JWT)?

We are building a public-facing API. The consumers of this API will be business partners of ours - we will probably have a personal relationship with each one, and I suspect there will only ever be 10-...
-3
votes
1answer
2k views

Write a Python or C program to guess the key [closed]

Key generation program in C: #include <stdio.h> #include <stdlib.h> #include <time.h> #define KEYSIZE 16 void main() { int i; char key[KEYSIZE]; printf("%lld\n", (long long) ...
0
votes
2answers
434 views

Accidentally Shared my Private Key - How to Remedy?

I accidentally shared my SSH private and public keys with others. I changed keys within 2 minutes of sharing the private key. I've since added a password to access my private key as well as deleted ...
0
votes
2answers
79 views

Using the same password to encrypt and to authenticate other actions

Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN. I would also like to use this same PIN as a secondary protection for some ...
0
votes
2answers
98 views

Recreating the Half Coins of Jin-Qua [closed]

In the Asian Saga series by James Clavell, the Struan family gave away the half-coins of Jin-qua: in exchange for a desperately needed loan, the pirate Dirk Struan received 4 halves of 4 coins. The ...
2
votes
2answers
377 views

Can I use the same truststore and keystore on the client and the server?

TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides? More info if helpful: I'm trying to test ...
0
votes
1answer
44 views

PIN transfer between payment schemes

I am wondering, if it should be possible to transfer PIN in case of migrating between different payment schemes like Mastercard or VISA. For example, when I have a card issued by Mastercard, and it ...
0
votes
1answer
211 views

Protect sensitive data in memory

Is there a way to protect sensitive data which is in RAM? Our setup is a microcontroller with no hardware support for security. When there is a need to encrypt data, then the secret key exists in RAM. ...
1
vote
1answer
2k views

Thales HSM: relationship between the various key types?

I am going through the Thales HSM manuals, and frankly the key acronyms are driving me crazy. I would like to understand the differences between the following keys, and how they relate to one another: ...
2
votes
0answers
218 views

Is it safe to generate a temporary API key from a random generator seeded by a secure random generator?

I have a need to generate a key consisting of a given number of random characters that will be used to access resources via a public API. It should not be possible to predict the key. This is done in ...
2
votes
2answers
288 views

Hawk vs. API key authentication

For a HTTP(S) API, which is better (/ which is better under which circumstances)? Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...
-1
votes
1answer
613 views

How i can generate a DES3 key coded in base64 in openssl

How can I generate a DES3 key encoded in base64 using openssl tool?