Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
854
questions
2
votes
1
answer
86
views
API key embedded in clients: how to defend against over-usage?
I am new to client-side development and I have a naive question. Right now, I'm using Google APIs (the map ones). If I want my client-side application / webapp to display a map, I would include ...
- 157
2
votes
2
answers
134
views
Full disk-encryption key vs password
I need to set up full disk encryption on my linux laptop.
Questions:
Does an encryption key on a USB pendrive protect against rubber-hose cryptanalysis?
Is it true that the key on a pendrive is ...
- 121
0
votes
0
answers
40
views
Stateless Key Management
I'm looking into the differences between stateful and stateless key management. I understand that stateful key management means that I have a database that tracks my keys, and can become very large. ...
0
votes
1
answer
162
views
What does it mean to store secret keys as an "environment variable" as opposed to hardcoded in the source code?
I see why it is obviously bad to store a secret key and client ID in the source code for a web application. However, how do you go about the alternative? Surely, that information has to be stored ...
- 113
0
votes
1
answer
91
views
How to avoid performance issues with envelope encryption when using separate DEK's for each piece of data?
Posted this first on stackoverflow but was suggested to repost it here.
I am planning on using envelope encryption for data stored in a database in a multi-tenant solution. Envelope encryption suggest ...
0
votes
1
answer
227
views
Consequences of stolen TLS private key
My understanding is that, when you connect to an HTTPS website, the communication is encrypted via asymmetric encryption, therefore private and public keys play a role there. My assumption there is ...
- 103
0
votes
0
answers
60
views
What does an exported BitLocker key package contain?
I've learned that a key protector encrypts the VMK (volume master key), then the VMK encrypts the FVEK (full volume encryption key), and finally the FVEK encrypts the actual data blocks.
I've also ...
- 181
1
vote
0
answers
46
views
Encryption and storing/managing private key in hosted cluster
I am working on an application running in/on a hosted Kubernetes cluster. All services are built using a Java based stack.
For a new feature it is required to temporarily store notifications (email ...
- 67
0
votes
2
answers
343
views
Backup GPG private key in KeePassXC
In order to keep all my secret in the same place, I would like to store my GPG private key in KeePassXC, under the "Notes" field.
Provided that the db file has very good password, is this ...
- 517
2
votes
1
answer
200
views
Is there a secure way to embed a private key in compiled code that is released in compiled form to the general public?
It occurred to me that if I could compile a private key in source code, I could prove that log information came exclusively from the application for a given version.
I could do this by releasing the ...
- 123
0
votes
1
answer
106
views
PCI compliance - use of ANSI X9.17 for export keys
we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
- 11
1
vote
1
answer
100
views
How to recover data that was encrypted with a revoked or expired key? [closed]
Do you know any processes for recovering data which has been encrypted with a revoked or expired encryption key after the encryption key becomes invalid?
- 11
-1
votes
2
answers
231
views
Strategy for storing private keys used in an embedded device
I am developing an embedded device using a bootloader. This means that the device will store in its flash an encryption key for decrypting update packages and an ECC public key for verifying update ...
- 429
0
votes
1
answer
79
views
Passing sensitive user data I must not ever see between devices using an identity provider
I have a Progressive Web Application (PWA) with a lot of users, each user creates a public-private keypair and wants to use that across devices simply by logging in using some form of auth, for ...
0
votes
0
answers
64
views
How could one use multi-factor authentication to derive a static secret key?
Scenario:
The setup is that each user has a randomly generated key A used for encrypting data stored on the server and a password-derived key B used to store A on the server without the server getting ...
- 115
0
votes
0
answers
49
views
What is the proper way to manage a company's SSL certificates?
Is there a way/software to manage and sign multiple SSL certificates? We have many intranet web applications that show the certificate error risk in the web browser. I have been googling a lot but SSL ...
- 101
2
votes
1
answer
216
views
Security of Trusty OS (TEE) Non-Secure World API
Recently I learned about TEE in Android, Trusty OS and its internals. I read through the articles on source.android.com and there is one thing I did not find there.
Trusty OS has its own API which ...
- 133
3
votes
2
answers
336
views
My web application needs to have my users' private keys to sign documents on their behalf. How do I handle that?
Our web application issues governmental documents for our users. Every one of those documents needs to be signed with a private key. However, because our users find it cumbersome to point their ...
- 31
0
votes
0
answers
60
views
Securing the keystore key?
My program, is installed on specific computers that use a shared, common login. The program decrypts variously sized (1KB-1GB) data assets which were encrypted elsewhere, and transferred over. Each ...
- 121
0
votes
0
answers
85
views
In a web application, what would you consider the best way to store secret keys obtained via an SDK?
Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user.
Currently when ...
- 1
0
votes
1
answer
55
views
Is public key-transport key required for encryption key distribution over HTTPS?
According to NIST Key Management recommendation "8.1.5.2.2.2 Automated Key Distribution/Key Transport/Key Wrapping", it is required to use a key wrapping key or a public key-transport key to ...
0
votes
0
answers
59
views
Data Encryption Key protection during transmission in Envelope-Based Encryption
When using cloud HSM (eg: AWS CloudHSM, Google Cloud HSM etc) for client-side encryption, they always refer to Envelope encryption. In this encryption approach, the data encryption key (DEK) is ...
0
votes
2
answers
84
views
What could be the correct and secure ways to store and manage public keys?
I am developing an open source project(PKDSA) that uses ED25519 and ED448. My purpose of this project was to help others to enable user-secretless based passwordless authentication.
There're a lot of ...
- 3
1
vote
1
answer
173
views
How do I best share a shared account's private key?
I made a website which among other things allows users to sign up to events. The HTML form is filled out and submitted, which automatically updates a google spreadsheet with all applications. This of ...
- 13
2
votes
1
answer
467
views
Key management: Can I delete private key in asymmetric encryption?
If using asymmetric encryption, such as ES256, is there a reason why a private key could not be discarded after signing some data?
For example with a JWT, or a file hash use for audit at a later date, ...
- 123
1
vote
1
answer
96
views
Is handling keys with vps without kms secure?
I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the ...
- 141
0
votes
2
answers
212
views
Asymmetric encryption and data sharing
I have a web application created with Flask in python that uses asymmetric encryption using RSA, the private key is generated from the user's password and is only stored in a cookie on the user's ...
user287213
2
votes
1
answer
187
views
How to use (py)NaCl/libsodium for key wrap, key encapsulation
We want to wrap / encapsulate
a symmetric key with an asymmetric keypair,
a symmetric key with a symmetric key,
a private key with a symmetric key.
In each case, we'd like to allow several keys to ...
- 21
3
votes
1
answer
233
views
Is sharing private key with CDN dangerous?
When you use a Content Delivery Network (CDN) and want to enable HTTPS, you need to import your certificate there. So you should provide your Private Key to the CDN. Is this secure? I mean CDN can log ...
- 169
1
vote
2
answers
210
views
How do you share private keys for signing e.g. JWTs inside Docker-Containers?
I've written an application in NodeJS which essentially only performs a login:
You send your username/password, and you retrieve an JWT (JSON Web Token).
Those tokens are being signed by a private key....
- 15
0
votes
0
answers
31
views
Is it possible for an app to sign data it generates so that the data can be guaranteed to come from the app? [duplicate]
Is it possible for an app binary to sign content generated by the app such that a verifier can confirm the data was indeed generated by a specific version of the app?
For example:
A mobile app from a ...
- 21
1
vote
0
answers
115
views
The 3-level hierarchy of keys in TPM 2.0
I have a task to create the 3-level RSA key hierarchy (with wolfTPM library), where keys of the 2nd and the 3rd levels are imported keys.
Here are the steps that I follow:
Generate a primary key on ...
- 111
0
votes
1
answer
228
views
After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?
I have a private S3 bucket. I want a user from an external organisation to have access.
I have added a user in IAM. How does this external user get notified and how do I share credentials?
The secret ...
- 651
0
votes
1
answer
167
views
How to setup a Per-File Encryption architecture
I would like to set up a per-file encryption architecture where every file is encrypted with its own key, and each key is encrypted using a master key.
Is there any good articles to read regarding ...
- 1
0
votes
0
answers
141
views
How long does Signal keep the keys for out-of-order messages?
I was reading the Signal protocol on how it handles out-of-order messages. What if those messages never arrived, does Signal keep the keys forever or are the keys deleted as soon as a new session is ...
- 175
3
votes
0
answers
219
views
Securely store application secrets in production without 3rd party KMS
Integrated Security
I have a ASP.NET web application with connection strings and other secrets to protect in production. Ideally I would like to use IntegratedSecurity to keep SQL credentials out of ...
- 31
0
votes
1
answer
135
views
Is there a viable zero-knowledge approach for using oAuth to generate and manage private keys?
I've been doing a deep dive into how products like Web3Auth work under the hood and wonder if this is a viable approach to building applications where a user can have the convenience of using oAuth to ...
1
vote
0
answers
25
views
Does the the key used to encrypt in a ransomware attack reside on the target computer for at least some time? [duplicate]
My understanding is that a ransomware uses the target computer's resources to encrypt files. So does that mean that the key used for encryption resides on the target computer for at least some time? I ...
- 11
3
votes
1
answer
139
views
Why are key IDs typically the *last* digits of the key hash?
With PGP for example, the "properties" of the following key are:
pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02]
6713B62DC36CE36403C724B1FFD641CF2BD6571B
uid [...
- 33
0
votes
1
answer
189
views
How do centralized crypto exchanges store seed phrases and users' private keys?
Say I'm trying to develop a CEX, hence I will hold custody of users' keys. How would I go about doing that and ensuring safety and security?
From what I know, I can generate the users' keys from a ...
1
vote
1
answer
162
views
Export ECDSA certificate from Windows Store
I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
- 61
0
votes
1
answer
80
views
How can a client safely post/get a (symmetric) client key to/from a key distribution center?
If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
0
votes
1
answer
534
views
How to preserve key in TPM 2.0
I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
1
vote
2
answers
183
views
Best and safest way to store secret key used for PKA on server?
I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example:
Create a 0500 access directory on my server
...
- 131
1
vote
1
answer
473
views
Why should encryption key be rotated after it has been used to encrypt a specific amount of data?
I'm going through OWASP Cryptographic Storage Cheat Sheet and it says:
Encryption keys should be changed (or rotated) based on a number of different criteria: (...) After the key has been used to ...
- 165
1
vote
0
answers
304
views
Storing AES key for later usage
I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
0
votes
1
answer
619
views
Can an encrypted RSA key be committed to git?
I have a pair of RSA keys where the private key is encrypted with a passphrase. Would it be a security risk if the public and private keys are committed to version control without any further ...
1
vote
1
answer
218
views
Uses for TR-31 Key Version Number?
The standard for TR-31 (and Thales) Key blocks (ref) have a field for "Key Version Number", which is only defined in the spec as
Two-digit ASCII character version number,
optionally used to ...
- 1,447
2
votes
0
answers
251
views
Is it possible to regenerate the stub private key from just the physical key in OpenSSH?
Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key.
If I lose ...
- 121
0
votes
0
answers
138
views
Validate the conformance of an OpenSSL created certificate with FIPs standards
Trying to test the conformance of the certificates inside our application, with the below requirement:
The application shall [selection: invoke platform-provided
functionality, implement ...
- 109