Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key-generation]

Key generation is the process of generating keys for cryptography. A key is used to encrypt and decrypt whatever data is being encrypted/decrypted.

0
votes
1answer
49 views

Is it a bad idea to share a private key generated from a self-signed root CA?

Pardon if this is a noob question. I'm writing an authorization function to determine if a REST API request should be allowed to proceed or not. It is using a standard JWT passed in the Authorization: ...
3
votes
1answer
963 views

Can TPM “Storage Keys” be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
2
votes
1answer
130 views

Why is validating the integrity of the plaintext necessary in addition to validating the integrity of the cipher text?

Reading the iOS Security Guide's description of the iMessage encryption protocol I'm trying to figure out why they included a mechanism for verifying the integrity of the plaintext as well as ...
0
votes
0answers
39 views

Which encryption algorithm for cloud backup?

I want to backup my data to the cloud. Before that, I want to encrypt it using GPG (gpg (GnuPG) 2.2.11 and libgcrypt 1.8.4). The backup is just for me, so I don't care about interoperability I only ...
6
votes
1answer
252 views

Preparing to change over to new GPG-key - what to do with my old ones?

I've just created a new off-line GPG-key with a sign/certify master-key and two sub-keys - one for signing and one for encrypting. 5 yr expiration for the master, 2 yr for the subs. My master-key got ...
16
votes
2answers
335 views

What research suggests that user's mouse movements are (not) sufficiently unpredictable for secret key generation?

I have not been able to find any credible source which tried to prove or disprove the randomness of mouse movements. A Google Scholar search for "mouse movement entropy" gives surprisingly few ...
0
votes
0answers
165 views

Generate symmetric key programmatically using openssl EVP

Am learning OpenSSL EVP API and trying to understand the ways to generate a symmetric key using OpenSSL EVP in C++ program. I have two questions in this regard: 1) To understand what the command ...
4
votes
2answers
3k views

Do you need more than 128-bit entropy?

UUID uses 128-bit numbers. Currently it is not feasible to randomly produce two UUIDs that are the same. Does that mean 128 bits of entropy is suitable for all cryptographic operations? I would ...
0
votes
2answers
175 views

How to generate the most secure private key? [closed]

I need to generate the most secure private key. Usually I use a command: openssl genrsa -des3 -out mykey.key 2048 Is triple DES secure enough? Is 2048 large enough? Are there any other ways to ...
13
votes
3answers
2k views

How many iterations of Rabin-Miller should be used to generate cryptographic safe primes?

I am generating a 2048-bit safe prime for a Diffie-Hellman-type key, p such that p and (p-1)/2 are both prime. How few iterations of Rabin-Miller can I use on both p and (p-1)/2 and still be ...
0
votes
2answers
88 views

RSA generating private and public keys

I'm trying to implement RSA encryption in PHP. I'm stuck at generating the public and private keys. I have P = 61, Q = 53, MOD = P * Q = 3233, N = (Q - 1) * (P - 1) = 3120. How do I chose the value ...
1
vote
1answer
55 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
1
vote
0answers
135 views

How do I reduce the vulnerability of the OpenStack SSH key generation process? [closed]

I found two places that describe OpenStack SSH keys, but nothing seems to say whether or not they're generated on VMs. Generating these on the VMs could lead to problems, since VM images are often ...
0
votes
1answer
161 views

Key Encryption / Obfuscation

I got a GUI Program, which loads the Logic from a webserver if the entered License Key is valid. The actual connection string I hexed and xor'd with a secret key. (which is unfortunately static) The ...
0
votes
1answer
803 views

How to actually calculate Pairwise Transient Key?

I have following information: PTK-Pairwise Transient Key: A value derived from PMK, Authenicator nonce(Anonce), Supplicant nonce(Snonce), Authenticator Address, Supplicant Address. This is used to ...
2
votes
2answers
71 views

Security Appliance Key Generation

For devices like decrypting HTTPS proxies, there is often a built-in mechanism for generating a key-pair and CSR. An admin can then have their in-house authority sign the CSR with a subordinate CA ...
1
vote
3answers
2k views

Difference between key generation and key agreement

Please excuse my ignorance as I am new to information security. Could someone please explain in simple terms what the difference is between key generation and key agreement. In which situation would ...
0
votes
2answers
299 views

Rotating encryption keys - how does it work?

I haven't found a duplicate which explains with sufficient clarity how does the process of rotating encryption keys work in simple layman terms. I know how private/public key cryptography works, I ...
3
votes
1answer
140 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
2
votes
1answer
90 views

How does algorithms ensure public/private keys uniqueness? - RSA

I'm new to security and crpyto, I know that Public/Private keys are generated in a different way depending on the used algorithm, But let's take RSA as an instance (Using prime numbers), Does the ...
1
vote
0answers
37 views

Connection between PIN/password and encryption keys in Android

I am trying to piece together some information about the security system in Android. Particularly about how user's password/PIN is connected with encryption keys in file-based encryption mode. I'm ...
1
vote
2answers
652 views

Details of a good WPA2 pre-shared key (password)?

From the following answer, I understand a strong pre-shared key must be 15 characters at minimum and randomly generated: https://security.stackexchange.com/a/56646/37051 However, from other reading, ...
0
votes
2answers
562 views

Generating RSA keypair (safety/performance) in REST service

There is a REST API service. An endpoint is responsible for creation of user accounts. Each user is supposed to have an RSA keypair generated and stored on a server. To protect the private keys from ...
0
votes
1answer
232 views

Server-side encryption mechanism (Nextcloud)

I've been looking around how server-side encryption works. Thanks to the nextcloud doc I understand the implementation. Basically, when you first log in a key pair is created, and the private key ...
0
votes
0answers
111 views

Compatibility advantages of RSA-4096 over RSA-3072

I am targeting a security level of 128 bits for GnuPG, so I am using SHA-256 and AES-128. Now I need to choose between RSA-3072 and RSA-4096. According to multiple sources RSA-3072 security level is ...
1
vote
1answer
969 views

Is the JDK standard EC KeyPairGenerator suitable for use with both ECDSA and ECDH algorithms?

I've seen various references on the web for generating Elliptic Curve KeyPairs in Java, and the two most commonly referenced examples (unsurprisingly) use the JDK default provider and BouncyCastle. ...
2
votes
2answers
415 views

Should the client or the server generate the client's public-private key pair?

Say I have a mobile messaging app. There is a central server that manages stuff (like a directory of users, onboarding, etc.) and there are all the clients. My app is professional, so it uses ...
-2
votes
1answer
77 views

Does a private key file created with a passphrase need to be decrypted before use

Let's say that I have created a private key file with some passphrase in ssh-keygen. Now someone sends me a message encrypted with my public key. To decrypt the message I need a private key. Do I ...
1
vote
2answers
867 views

Which keystore type is good for java / Tomcat based applications

Our application is based on Java and Tomcat server. Which type of keystore is better ? does JKS or PCKS12 ? I understand JDK keytool by default creates JSK type then for which uses-cases one should ...
132
votes
7answers
71k views

Best Practice: ”separate ssh-key per host and user“ vs. ”one ssh-key for all hosts“

Is it better to create a separate SSH key for each host and user or just using the id_rsa key for all host to authenticate? Could one id_rsa be a malpractice for the privacy/anonymity policies? ...
0
votes
1answer
34 views

Remote host identification is different on different networks

When I ssh to a server - let's call it x.x.x.x - over one network, Network A, I get a message that the remote host identification has changed. If I use one of two other networks - call them Network B ...
0
votes
1answer
118 views

Using the user's GUID-id as a salt for Rfc2898DeriveBytes

I use the Rfc2898DeriveBytes for creating an AES key for protecting the user's data. For the salt value I would like to use the user's id, which is a guid. My understanding is, that the only drawback ...
2
votes
1answer
92 views

Secure Key Storage

We have a security solution that is deployed on premise to companies with big technical infrastructures. We do real time vulnerability/configuration assessment of all critical assets in the network. ...
4
votes
3answers
483 views

Could using a generated key from an online service be considered a risk?

With some colleagues we're having a debate regarding the randomkeygen.com website. I do think that there is a security risk using the generated keys of this (or any of this kind) website. Why ? ...
2
votes
2answers
112 views

Error tolerant password from quiztest

I want to use gpg with a symmetric password for encrypting a message. How to do this is explained here in the forum itself, but also in the internet. I'm aware that a symmetric key has the general ...
235
votes
7answers
41k views

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
3
votes
1answer
196 views

Are many rounds of SHA needed for a random veracrypt key

Assume that I've used white noise from the classic "zener breakdown" circuit to produce 512 bits of random data. If I use these as the key to a Veracrypt volume, is there any benefit to running 200,...
154
votes
4answers
162k views

SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when?

As someone who knows little about cryptography, I wonder about the choice I make when creating ssh-keys. ssh-keygen -t type, where type is either of dsa,rsa and ecdsa. Googling can give some ...
5
votes
1answer
3k views

ssh-keygen: What is the passphrase for?

When using ssh-keygen: What is the passphrase for? Why is it optional? What are the security implications of specifying (or not specifying) one? Below is an excerpt taken from a shell session (...
7
votes
4answers
8k views

Calculate time taken to break AES key

A 256 bit AES key is required to be broken using the brute force method on a 2GHz computer. How long would it take to break the key in the best case and in the worst case situations? Assume that 1000 ...
5
votes
2answers
855 views

Securing data on Android app using a 6 digit PIN

Lets say that on an Android app the user has to enter a 6-digit PIN on startup. Let's also say that we have some sensitive data in this application that we'd like to encrypt. The way I would to this ...
0
votes
1answer
72 views

Key Generation on FIPS device or using SW with FIPS generator

I would like to understand the difference between these two options how to generate AES key. AES key is generated directly in FIPS 140-2 Level 3 device with validated AES algorithm AES key is ...
1
vote
0answers
2k views

Using PBKDF2 for hash and AES key generation implementation

I am writing a Java application that is required to locally authenticate a user with a password and then use the password to generate an AES-256 key for local file encryption/decryption. I understand ...
5
votes
1answer
2k views

How AWS access key id and secret access key are generated internally

According to AWS's documentation, for accessing AWS resources programmatically or via CLI, you can generate an access key in AWS console like: Access Key ID: AKIAIOSFODNN7EXAMPLE Secret ...
5
votes
2answers
338 views

Generating temporary passwords/tokens using RNG

In my web application I generate temporary tokens/passwords for accessing files using this method: ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_" ALPHABET_LENGTH = 64 ...
1
vote
2answers
193 views

Is it safe to hide secrets this way?

I have n secrets to hide, my goal is to remember only a seed and derive them from the seed. Is this a safe aproach? Calculate n keys: k(1) = seed XOR secret(1) ... k(n) = seed XOR secret(n) Store ...
3
votes
0answers
88 views

EAP-EKE with RADIUS, is the derived key useful?

If someone run a successful EAP-EKE for authentication with a RADIUS Server, the client will end up being authenticated (will have access to the network) and will have in place a session key that at ...
5
votes
0answers
5k views

Running openssl s_client with an aes encrypted key fails

I'm trying to verify a 2-way SSL connection using the openssl s_client command openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key The openssl s_client fails ...
0
votes
1answer
206 views

SSL/TLS - Does the client select symmetric key for data encryption?

After reading the excellent answers here and documents about how SSL works. I have a doubt about what the function of the ClientKeyExchange step is. In the above linked answer and document it says ...
0
votes
1answer
478 views

Generating debian SSH keys with Python (paramiko library)

I'm creating a python script that generates SSH keys for my raspberry pi SD card installation before I boot the SD for the first time, so I can get the fingerprints without having to boot it for the ...