Questions tagged [key]
Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.
213
questions
0
votes
0
answers
32
views
Security implication of loading untrusted private keys
The FIPS draft for Dilithium signature scheme (official name ML-DSA) had just been released not long ago. In the specification for skDecode (which is the subroutine that loads the private signing key) ...
- 360
0
votes
0
answers
10
views
Read EC Public Key, works in python, error in java [migrated]
I have this issue moving some code from python to java.
The following public key:
MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgAC2X07fCab+nIPAWBb5eRlhdOfR0Bkrhx7TgM3cGbR31g=
can be succesfully read from this ...
- 101
0
votes
0
answers
15
views
Parsing and loading EC Private key, curve secp256r1 [migrated]
I'm doing a spin-off request from this: EC Key request
As my problem is a bit different but similar.
I have the following private key (in this format, not a file):
MHcCAQEEID0VR/I814rQUqWIYPEhno+3kexN/...
- 101
1
vote
1
answer
55
views
Key Hash With Securely-Optimal Setting : For Encryption vs For Password
Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ?
So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
1
vote
1
answer
115
views
CVV2 calculation with TR-31 Key
I need to use the CVK Key (in key block format) to calculate the CVV2.
In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
- 11
0
votes
1
answer
67
views
PCI compliance - use of ANSI X9.17 for export keys
we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
- 11
0
votes
0
answers
77
views
Management of CVK key in Key Block format
I use a Thales PayShield 10K with a LMK KeyBlock 3DES. I have to send a CVK Key to a Scheme for the valorization of CVV2 value. Now, in my envorinment i generated a CVK Key with "Key Usage"= ...
- 11
0
votes
1
answer
67
views
Permanent Keys/Secrets in TLS 1.3
In TLS 1.3 (RFC8446), there are many secrets and keys. As far as I've understood, every certificate (usually only the server) has a long term key associated with it which is used with HKDF to generate ...
- 1
3
votes
1
answer
145
views
What is the point of the “AES Key Wrap” algorithm?
What is the point of the “AES Key Wrap” algorithm prescribed for use with CMS-like contexts in IETF RFC 3394?
Just look at the algorithm (tacked on to the end of this post), informally, it smells a ...
2
votes
1
answer
181
views
Can someone with access to only my Yubikey gain access to my server that has SSH access via an ED25519-sk keypair?
My understanding is that an ED25519-sk SSH key generated by OpenSSH generates a private key stub that lives on your host machine. This stub is just a reference to the actual private key that lives on ...
- 91
2
votes
0
answers
67
views
How do you know what KDF was used to protect an SSH-Key?
Assuming I have found several OpenSSH private keys on my client's system, how can I detect (at scale) which of them are:
completely unprotected (i.e. no passphrase)
using an old hashing algorithm for ...
- 88
1
vote
1
answer
60
views
Detecting signal amplification attacks against PKE keyless fobs
During the early hours of the morning there was an attempt to enter and presumably steal various vehicles on my street, detected well after the fact via householders reviewing CCTV motion detection ...
0
votes
1
answer
51
views
Is my PGP key which I uploaded to sync.net compromised?
I just accidentally uploaded my PGP key in unencrypted format to rsync.net. As far as I know, nobody but me has access to the account. Is my key compromised?
- 139
2
votes
1
answer
2k
views
Is it safe to send an API key in an HTTPS request? [duplicate]
Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ?
We need to send data to a 3rd party from ...
- 123
0
votes
3
answers
45
views
Encryption key fuzzing for forensics analysts
I'm trying to make a simple encryption tool for Debian-like systems. I would simply hash a password, use it to lock/unlock a file, and it would never be stored on the drive. My dad threw out the idea ...
- 209
2
votes
1
answer
326
views
Is encryption with MySQL Aes_encrypt() + stored procedure ok?
I would like to do encryption with MySQL AES_ENCRYPT() function used in a stored procedure on the database.
Firstly, I changed the encryption block mode from aes-128-ecb to aes-256-cbc in the MySQL ...
1
vote
1
answer
49
views
Changing openssl key/IV when encrypting diffrent rows of data in database?
I'm looking for a way to encrypt data in MySQL database securely. The data come from a web interface from a POST form and each POST request from the user insert a new line in the database.
Right now, ...
- 11
0
votes
1
answer
166
views
Secure chat application with multiple users on one device?
I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application.
My thought was to store a private key in ...
- 121
1
vote
1
answer
1k
views
ThinkShield secure wipe - SSD does it forbid data recovering?
I have to give my computer back to my boss.
I want to delete all the data from my SSD. I found "ThinkShield secure wipe" which is implemented in the BIOS apparently.
It gives me two options:
...
- 13
1
vote
1
answer
182
views
Do sites like reddit and Quora expose their Google API client keys to the public?
On Quora, when I want to sign in using Google, I am redirected to this URL, which has a parameter client_id=917071888555.apps.googleusercontent.com.
Similarly, reddit takes me here, which has ...
- 113
0
votes
4
answers
454
views
Benefits of non-standard SSH port when password authentication is turned off
Is there any benefit of using a non-standard SSH port when PasswordAuthentication is turned off in sshd?
The only benefit of non-standard SSH ports I know of is a reduction of the amount of brute ...
- 101
0
votes
1
answer
286
views
deleted a subkey and can now no longer decrypt
My public key had expired so I tried to edit the expiry date with
gpg --edit-key
It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the ...
- 379
1
vote
0
answers
329
views
How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?
Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
- 109
1
vote
1
answer
270
views
Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?
When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a ...
- 109
0
votes
1
answer
71
views
How can a client safely post/get a (symmetric) client key to/from a key distribution center?
If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
0
votes
3
answers
1k
views
What format is this private key in, and how can I process it using bouncycastle?
I have the following private key. I'd like to be able to process it into an instance of ECPrivateKey using Bouncycastle (or the builtin Java security API if bouncycastle isn't necessary).
-----BEGIN ...
- 101
1
vote
0
answers
285
views
Storing AES key for later usage
I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
0
votes
1
answer
400
views
Where should private key(s) reside in IPsec VPN tunnel
I setup an IKE VPN server for road warriors. I actually have this working (YAY!) but took some shortcuts that are leaving me with a working yet not-right/secure setup. My setup is as follows:
My ...
- 159
-2
votes
2
answers
68
views
Is the term "only-unlocking key" more accurate than the term "private key"?
Paraphrasing this:
Symmetric cryptography is like a door lock. Everyone that has a key can lock and unlock.
Asymmetric cryptography is like a common lock or handcuff. Anyone can lock it but only the (...
0
votes
0
answers
93
views
Storing an encryption key securely
I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options.
Option 1) Storing the key on the same server (not recommended, ...
- 121
0
votes
1
answer
1k
views
Does alias in a truststore matter?
I was trying to add a new certificate to our truststore. But I got the alias already exists error.
I can't remove the old certificate yet, but I have to add the new certificate.
Will it matter if I ...
- 1
1
vote
3
answers
3k
views
Tricky apartment key fob copies frequency & code correctly but the copy doesn't work - not a rolling fob
I have this key fob for our apartment building, and I want to make a copy of it.
I've taken it to 3 locksmiths who are able to create a copy, but the copies don't work.
I've confirmed that it doesn't ...
user245365
0
votes
0
answers
81
views
Acquiring true randomness for generating a key
Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to ...
- 101
0
votes
1
answer
703
views
Encryption Algorithm With Separate One-Way (Hashing) And Two-Way (Decryption) Keys
In cryptography, generally we have two ways of handling sensitive information.
We can use one-way encryption such as hashing. This is useful when we never need to retrieve it again. In this case, we ...
- 753
0
votes
0
answers
101
views
Is it safe to use a Digital Signature created with a PKI certificate's private key as a password
I'm trying to create application-layer encryption for user data in my database, using password derivation function. But there is a problem, that there must be an admin user, who can access all user's ...
0
votes
1
answer
1k
views
VeraCrypt: Is it possible to change the master key?
The password in VeraCrypt is used to en-/decrypt a header, that contains a master key, that is used to en-/decrypt the data.
I know, that I can change the password, which will not change the master ...
- 1,653
1
vote
1
answer
444
views
Security requirements for public API keys
I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients.
The scripts will be run on the endpoints several ...
- 11
1
vote
2
answers
322
views
How to manage Encryption Key for Server Side Encryption in AWS S3
I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows:
All the existing data ...
- 11
5
votes
1
answer
740
views
Impact of having more X509v3 Key Usage fields than required?
I was wondering if having an "oversubscription" of "Key usage fields" inside a X509v3 certificate can negatively impact the performance and/or the security of a server.
For example ...
- 65
1
vote
0
answers
2k
views
"Failed connecting to the YubiKey. Make sure the application has the required permissions." [closed]
I have a Yubikey version 5.2.7 and I can't generate any new certificates on yubikey manager app, which is weird since I have already generated two certs (on 9d slot) and they worked fine.
Now the ...
- 111
1
vote
1
answer
1k
views
Looking for a lost PKE keyless entry fob
I have been looking for my lost car key. I have RTL-SDR and I am able to listen to key fobs frequency which varies between 350-444MHZ. I was trying to understand how most of the keyless entry systems ...
- 11
0
votes
1
answer
235
views
Can you obtain the passphrase of an encrypted SSH key, given the unencrypted key?
Imagine you get hold of someone's private SSH key, which is encrypted. Now imagine you also get hold of the unencrypted key (e.g., because some SSH client stores it after decryption).
Can you ...
- 230
1
vote
2
answers
418
views
Required certificate key usage for signing document
What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc...
I am going to create a self-signed certificate that is needed to sign those documents. I ...
- 113
1
vote
1
answer
1k
views
How safe is AES 256bitkey encoded in HEX, Base64?
I am using CryptoJS AES 256 encryption:
CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv});
The secret is generated through:
function generateKey(passphrase) {
const salt = CryptoJS....
- 145
1
vote
2
answers
3k
views
Does certutil -delkey actually delete the certificate and private key?
I am trying to delete a certificate and it's private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command ...
- 131
1
vote
1
answer
472
views
gnu gcc source archives signed with expired GPG key?
I'm in the course of rescuing a legacy app that got left behind and turned out to be needed on rare occasions, one of which occurred yesterday. I need to rebuild some libraries and the libraries have ...
- 163
9
votes
2
answers
3k
views
Securing API keys for a Twitter account for a program to be run on other PC's
I've created a method to allow my project EditVideoBot to be 'decentralised', where rather than the program processing and uploading all video editing requests on my own central server, users can ...
- 671
1
vote
1
answer
567
views
Key pairs extension / version
I read in some docs, there are several version of GPG key extension available.
For ex: gpg, ascii, p12
I know .gpg extension is in binary, and Ascii is in text.
But I want to know their differences ...
- 13
1
vote
0
answers
90
views
Necessary fingerprint length etc. when Alice wants to send multiple pseudonymous messages in public to Bob and keep option of proving authorship later [closed]
Alice wants to send Bob messages. She has the following requirements.
She plans to send him messages that are sequentially numbered, pseudonymous, and sent to him publicly over a period of time.
Each ...
user252311
0
votes
1
answer
280
views
The risk of RSA encryption. Would individually encrypted characters be risky?
Is it possible to decrypt a RSA message if the characters of the message are individually encrypted?
The info you have is the message, the public key and the n which is too big to be factorizable.
- 3