Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
768
questions
1
vote
0answers
29 views
Reusing content-encryption key in cms enveloped data
OpenSSL keeps the structure CMS_ContentInfo opaque and in the case of enveloped data generates and manages the content-encryption key completely by itself. It is not possible to provide a content-...
-1
votes
1answer
52 views
How to secure the key in an offline package
I have a package to be shared to Bob which contains:
an encrypted data.zip
Application, which will have logic to decrypt the data
Bob will run Application and it will decrypt the data.zip.
Now for ...
0
votes
2answers
63 views
pgp public key failed to propogate
I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key ...
0
votes
0answers
36 views
Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?
I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
1
vote
1answer
96 views
Is this a good way to manage encryption keys?
I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything
from a leave of absence form to potentially confidential agreements.
Being ...
1
vote
1answer
64 views
use custom 'key' for hardware security keys
Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
0
votes
1answer
82 views
Which would be the best “keyfile” for KeepassXC and/or Veracrypt?
I am a Mac user. I opened a keyfile generated by Veracrypt and one generated by KeepassXC. The texts in both of them were quite short. Which keyfile is best (i.e., most random and harder to break ...
0
votes
0answers
36 views
Handling API keys for client-side app with cloud key vault
I would like to hear about the security implications of my desktop app's current API usage workflow:
Client-side WPF desktop app connects to Azure Key Vault, a cloud vault, by authenticating via a ...
1
vote
1answer
99 views
Web developer needs customer's private key
As a non security expert, I'm looking for advice from those who are.
I work with company X who have hired company Y to develop their website. Company Y needs to integrate server-side online payment ...
0
votes
1answer
68 views
What's a secure way to generate a keypair from a secret password?
I like to generate a public-private key pair that is seeded from a string. So having the string and the generation algorithm is enough to recreate the keys. I want to do this because I can then ...
1
vote
1answer
54 views
Subkey rotation and revocation
If I decided today get new subkeys because I simply want to rotate them or because they are about to expire, do I have to sign all keys of other people I signed with my old signing key again? And if I ...
2
votes
0answers
69 views
What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?
My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home.
Since the laptop uses BitLocker ...
0
votes
0answers
75 views
Why do I need --batch to import a secret key from a pipe?
Once I used this guide to transfer my secret key to my smartphone, so today I did the same thing for transfering the secret key from my workstation to my laptop.
Yes, I could have used a USB key, or I ...
1
vote
1answer
120 views
An intranet web app for decrypting values : a bad idea, and if so, why?
We have to protect a database connection string for a .NET desktop application that has an application-level database user. One option is to encrypt a section of the app.config using asp_regiis. But ...
0
votes
0answers
28 views
GPG Questions About Exporting Subkeys to File
GPG novice here so please bear with me.
From what I understand, when you generate a keypair with GPG it will automatically create a subkey pair (sub, ssb).
If I wanted to give these to another party ...
1
vote
2answers
77 views
How to devise cryptographic system with sharing ability
I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
0
votes
0answers
113 views
Should Group Key Update Interval be Off or On?
My router has this option and I was wondering if it should be turned off or on for better security? If it is better security to leave it on what is the best interval for maximum security?
3
votes
3answers
125 views
Drawback of Multi Level Encryption
I am backing up my files to a RAID mirrored HDD, that has full disk encryption (FDE) in place with LUKS. Until now I did this with rsync, but I recently switched to a new backup program that does file ...
1
vote
1answer
32 views
Storing private keys for updates to remote device
I'm reading up on how to perform signed updates for remote hardware devices. I need to check if the new software has been generated by a "trusted" source, ie me.
Based on my understanding of ...
1
vote
1answer
51 views
Can I copy a PGP revocation to another server?
I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
3
votes
2answers
92 views
Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?
I implemented this kind of authentication for my REST API, is this secure and is my logic sound?
I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
9
votes
8answers
6k views
Can a large corporation make a believable promise
Say there is a secret encryption key that a third party has to handle. The third party is supposed to destroy the secret key when they are done, and tell everyone else it was destroyed and therefore ...
3
votes
4answers
180 views
Methods for backing up key on paper
What are the methods to backup a key to paper?
The idea is to have reasonable protection and the ability to restore the key in case of the digital backup is lost.
Are there things that convert a ...
0
votes
0answers
50 views
Password Vault Storing Passwords
I've been working on just a fun side project in C++ to practice encryption algorithms and I sort of ran into a bit of a roadblock of sorts. To summarize the project I have a text file of encrypted ...
0
votes
0answers
59 views
SSL/TLS communication in connected embedded (IoT) device
while establishing the SSL/TLS based communication in an embedded device, is it necessary that device needs to acquire the keys/certificates from a CA? I read that there is also provision for device ...
3
votes
2answers
116 views
What is the difference between the many identifiers in GnuPG?
GnuPG seems to have number of different ways to refer to a (sub)key(pair):
Key IDs
Fingerprints
Keygrips
Additionally, gpg --list-sigs seems to show hexadecimal identifiers for signatures and such ...
1
vote
0answers
61 views
Is this reasonable privacy for storing sensitive information?
Outline
I am writing a web app that will need to store some transaction data (amount, date, merchant...).
Objective
I want to keep this data reasonably private from unwelcome eyes.
Threat Model
...
0
votes
0answers
62 views
How to facilitate secure chats between users
My company runs a chat room service where the users can securely send messages to one another. All users are authenticated by the service in advance, and will install software from the service onto ...
0
votes
1answer
43 views
Is HMAC really a benefit for AES-CBC?
I think I quite well understand the theoretical benefit of adding the HMAC (authenticity/integrity on top of confidentiality), but I am looking at this from a key management point-of-view.
Premise: ...
1
vote
1answer
34 views
Single key pairs for SFTP
I have a single machine (client) and several servers and I need to take from them several files through sftp. My idea is to generate a pair of public and private keys in the client, and copy the ...
1
vote
1answer
66 views
Does a revocation certificate leak information about the private key?
Kleopatra/ GPG can create revocation certificates, which look a lot like public/private keys. Obviously, these keys should not be shared or used unless one intends to revoke their keys. But assume ...
2
votes
0answers
66 views
Security of Microsoft key container
How is the security of cryptographic keys stored by Microsoft Windows in the key containers used by CryptoAPI/CNG guaranteed?
The keys are stored in the user's directory or a directory for the machine-...
1
vote
0answers
68 views
How does WhatsApp retain private key? [duplicate]
Does anyone know how does WhatsApp retain private key? Based on what I know it looks like private keys are stored on the device. What happens when someone changes their device? How does the private ...
0
votes
1answer
79 views
Cloud provider or self-hosted for key-storage?
I was reading this question: Where do you store your personal private GPG key?
I have my set up as noted in this comment: Where do you store your personal private GPG key?
But instead of using a ...
3
votes
3answers
425 views
Is it more secure to encrypt separate customers' data with separate keys?
If I am storing multiple customers' data in cloud-based file storage such as an AWS S3 bucket, and I use an encryption service such as AWS KMS to achieve encryption at rest, does it add any extra ...
1
vote
1answer
70 views
Implementing key vault and key rotation for a non-cloud application
I have a desktop application written in Python. The application is connects with an external SAP HANA service and pulls data. There are couple of configuration files where several connection string ...
7
votes
1answer
1k views
OpenSSH declares ssh-rsa deprecated. What do I do next?
With the 8.2 release of OpenSSH, they have declared that ssh-rsa for SHA-1 will soon be removed from the defaults:
Future deprecation notice
It is now possible[1] to perform chosen-prefix ...
0
votes
0answers
39 views
Establish a symmetric key: KDF based on shared secret and random salt or key wrapping?
I am designing a basic KMS based on a simple HSM, I only have access to: AES256, SHA256, PBKDF2, HMAC (and combinations like AES256-HMAC-SHA256).
The admin and the users of the system have a personal ...
0
votes
2answers
75 views
Using the same password to encrypt and to authenticate other actions
Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN.
I would also like to use this same PIN as a secondary protection for some ...
3
votes
0answers
172 views
Why does GPG --recipient only pick one (arbitrary) key for identical names, instead of all of them?
I have a recipient with four hardware keys (HKs) that they use interchangeably. These HKs contain different GPG keys that have all been generated inside and have never left the HKs, thus resulting in ...
0
votes
0answers
42 views
Multi-user document encryption: access to user private keys
I am attempting to implement these solutions for multi-user document encryption:
https://security.stackexchange.com/a/71915
https://owncloud.com/wp-content/uploads/2014/10/...
1
vote
2answers
137 views
Is there really any safe way to store an encryption key?
I'm aware of multiple ways to store an encryption key, some very bad, such as in your codebase or elsewhere on the same server, and others much better such as where the encryption/decryption is done ...
1
vote
1answer
53 views
Webhook sending Purchase Details to handling Purchases from a Third Pary Service Secure?
I'm developing a mobile application for a client that sells digital courses on a service called Teachable that hosts their website and handles the purchase process for them. My client wants to keep ...
0
votes
0answers
112 views
How do I find the private key in Android app OpenKeyChain?
I can generate a key easily enough within the app by clicking on "Create My Key" but notice it says "key" not keys. This is confusing in that I don't know whether I am trying to share my public key, ...
0
votes
1answer
77 views
Is it fine to store the key used to encrypt data, in encrypted form alongside the encrypted data?
There is a need to encrypt data and upload somewhere on a periodic basis. We have a master key that is used to generate data keys. On each instance of upload, a new data key is generated and the data ...
1
vote
0answers
87 views
Does a shared (but encrypted) private key for a group of users reduce the effectiveness of the encryption?
That is, is it generally considered more secure to save a single application-wide private key on the web server compared to storing (protected/encrypted) private keys in the database?
More ...
1
vote
1answer
82 views
Would there be a secure way to store an encryption key on server side for front-end decryption?
I am currently working on a web application with sensitive data to store (personal medical data). The app is on the very first stages of conception and I am to quickly produce a beta version that ...
1
vote
0answers
21 views
How to authorize a subkey using a primary master key pair?
I'm using webcrypto, not PGP/GPG.
I would like to use a key pair to create a "subkey" that is authorized by my primary key in a way anyone can publicly verify so I don't need to expose the primary ...
2
votes
1answer
178 views
Possible public/private identity recovery after compromise without a centeral authority?
I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust.
This seems to be a ...
3
votes
2answers
107 views
OpenPGP keys on smartcard: what is the real-world security gain of keeping master key offline?
When keeping OpenPGP keys for daily use on a smartcard (a Yubikey, say), what are, from a security point of view, the advantages of keeping the master key offline as compared to simply keeping the ...
