Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
749
questions
0
votes
0answers
43 views
Password Vault Storing Passwords
I've been working on just a fun side project in C++ to practice encryption algorithms and I sort of ran into a bit of a roadblock of sorts. To summarize the project I have a text file of encrypted ...
0
votes
0answers
51 views
SSL/TLS communication in connected embedded (IoT) device
while establishing the SSL/TLS based communication in an embedded device, is it necessary that device needs to acquire the keys/certificates from a CA? I read that there is also provision for device ...
2
votes
0answers
16 views
What is the difference between the many identifiers in GnuPG?
GnuPG seems to have number of different ways to refer to a (sub)key(pair):
Key IDs
Fingerprints
Keygrips
Additionally, gpg --list-sigs seems to show hexadecimal identifiers for signatures and such ...
1
vote
0answers
53 views
Is this reasonable privacy for storing sensitive information?
Outline
I am writing a web app that will need to store some transaction data (amount, date, merchant...).
Objective
I want to keep this data reasonably private from unwelcome eyes.
Threat Model
...
0
votes
0answers
61 views
How to facilitate secure chats between users
My company runs a chat room service where the users can securely send messages to one another. All users are authenticated by the service in advance, and will install software from the service onto ...
0
votes
1answer
39 views
Is HMAC really a benefit for AES-CBC?
I think I quite well understand the theoretical benefit of adding the HMAC (authenticity/integrity on top of confidentiality), but I am looking at this from a key management point-of-view.
Premise: ...
1
vote
1answer
31 views
Single key pairs for SFTP
I have a single machine (client) and several servers and I need to take from them several files through sftp. My idea is to generate a pair of public and private keys in the client, and copy the ...
1
vote
1answer
54 views
Does a revocation certificate leak information about the private key?
Kleopatra/ GPG can create revocation certificates, which look a lot like public/private keys. Obviously, these keys should not be shared or used unless one intends to revoke their keys. But assume ...
2
votes
0answers
54 views
Security of Microsoft key container
How is the security of cryptographic keys stored by Microsoft Windows in the key containers used by CryptoAPI/CNG guaranteed?
The keys are stored in the user's directory or a directory for the machine-...
1
vote
0answers
37 views
How does WhatsApp retain private key? [duplicate]
Does anyone know how does WhatsApp retain private key? Based on what I know it looks like private keys are stored on the device. What happens when someone changes their device? How does the private ...
0
votes
1answer
58 views
Cloud provider or self-hosted for key-storage?
I was reading this question: Where do you store your personal private GPG key?
I have my set up as noted in this comment: Where do you store your personal private GPG key?
But instead of using a ...
3
votes
3answers
274 views
Is it more secure to encrypt separate customers' data with separate keys?
If I am storing multiple customers' data in cloud-based file storage such as an AWS S3 bucket, and I use an encryption service such as AWS KMS to achieve encryption at rest, does it add any extra ...
1
vote
1answer
59 views
Implementing key vault and key rotation for a non-cloud application
I have a desktop application written in Python. The application is connects with an external SAP HANA service and pulls data. There are couple of configuration files where several connection string ...
4
votes
1answer
578 views
OpenSSH declares ssh-rsa deprecated. What do I do next?
With the 8.2 release of OpenSSH, they have declared that ssh-rsa for SHA-1 will soon be removed from the defaults:
Future deprecation notice
It is now possible[1] to perform chosen-prefix ...
asked Feb 19 at 16:58
Michael - Where's Clay Shirky
2,1921 gold badge16 silver badges33 bronze badges
0
votes
0answers
31 views
Establish a symmetric key: KDF based on shared secret and random salt or key wrapping?
I am designing a basic KMS based on a simple HSM, I only have access to: AES256, SHA256, PBKDF2, HMAC (and combinations like AES256-HMAC-SHA256).
The admin and the users of the system have a personal ...
0
votes
2answers
72 views
Using the same password to encrypt and to authenticate other actions
Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN.
I would also like to use this same PIN as a secondary protection for some ...
2
votes
0answers
92 views
Why does GPG --recipient only pick one (arbitrary) key for identical names, instead of all of them?
I have a recipient with four hardware keys (HKs) that they use interchangeably. These HKs contain different GPG keys that have all been generated inside and have never left the HKs, thus resulting in ...
0
votes
0answers
42 views
Multi-user document encryption: access to user private keys
I am attempting to implement these solutions for multi-user document encryption:
https://security.stackexchange.com/a/71915
https://owncloud.com/wp-content/uploads/2014/10/...
1
vote
2answers
133 views
Is there really any safe way to store an encryption key?
I'm aware of multiple ways to store an encryption key, some very bad, such as in your codebase or elsewhere on the same server, and others much better such as where the encryption/decryption is done ...
1
vote
1answer
43 views
Webhook sending Purchase Details to handling Purchases from a Third Pary Service Secure?
I'm developing a mobile application for a client that sells digital courses on a service called Teachable that hosts their website and handles the purchase process for them. My client wants to keep ...
0
votes
0answers
77 views
How do I find the private key in Android app OpenKeyChain?
I can generate a key easily enough within the app by clicking on "Create My Key" but notice it says "key" not keys. This is confusing in that I don't know whether I am trying to share my public key, ...
0
votes
1answer
73 views
Is it fine to store the key used to encrypt data, in encrypted form alongside the encrypted data?
There is a need to encrypt data and upload somewhere on a periodic basis. We have a master key that is used to generate data keys. On each instance of upload, a new data key is generated and the data ...
1
vote
0answers
57 views
Does a shared (but encrypted) private key for a group of users reduce the effectiveness of the encryption?
That is, is it generally considered more secure to save a single application-wide private key on the web server compared to storing (protected/encrypted) private keys in the database?
More ...
1
vote
1answer
70 views
Would there be a secure way to store an encryption key on server side for front-end decryption?
I am currently working on a web application with sensitive data to store (personal medical data). The app is on the very first stages of conception and I am to quickly produce a beta version that ...
1
vote
0answers
20 views
How to authorize a subkey using a primary master key pair?
I'm using webcrypto, not PGP/GPG.
I would like to use a key pair to create a "subkey" that is authorized by my primary key in a way anyone can publicly verify so I don't need to expose the primary ...
2
votes
1answer
165 views
Possible public/private identity recovery after compromise without a centeral authority?
I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust.
This seems to be a ...
3
votes
2answers
98 views
OpenPGP keys on smartcard: what is the real-world security gain of keeping master key offline?
When keeping OpenPGP keys for daily use on a smartcard (a Yubikey, say), what are, from a security point of view, the advantages of keeping the master key offline as compared to simply keeping the ...
1
vote
0answers
41 views
Why GPG signature is not considered as made by a trusted key?
When I verify a file signature I get the the following warning:
$ gpg --verify file.sig
gpg: Signature made So 01 Dez 2019 10:08:27 CET
gpg: using RSA key <Pierre's key ID>
gpg: ...
0
votes
2answers
99 views
Is there any solution to this system?
INTRODUCTION
First of all, I'm a beginner in RSA mechanisms and similar but I'm really interested in knowing if this is possible.
In this scenario, I organized a party where certain people receive a ...
-1
votes
1answer
54 views
Key storage and Password Management Tool [duplicate]
Passwords are not stored in plain text. So we hash them. But for hashing we need a key if we use a keyed hash function. In unix system passwords were stored in etc\password file but now the location ...
0
votes
1answer
110 views
derived key from email + password?
When deriving a private key from a password, will the resulting secret key be any weaker if the user email is included in the function input? Meaning, user email concatenated with the user password.
...
0
votes
1answer
203 views
What are the steps of hashing and steps of verifying password using salt and key? [duplicate]
What are the steps of hashing password during registration and login to an application using salt and key?
Are the following steps considered correct if applied to an application?:
1- During ...
2
votes
2answers
154 views
When gpg encrypt is called from the command line, how is a key chosen to do the encryption?
I am using GnuPG. When gpg encrypt is called from the command line, how is a key chosen to do the encryption? It appears to me that -r, or --recipient, supplies a user id and that is the simple answer....
1
vote
1answer
156 views
Why is Debian not showing the GPG signatures on keys that Arch Linux is?
I downloaded a Qubes OS ISO and I'm trying to verify its legitimacy using this guide. GPG was behaving weirdly, so I created a separate user with a separate keyring to reproduce the issue.
When I try ...
1
vote
2answers
126 views
Is it possible to forge key files and mount a veracrypt container?
If I have a Veracrypt container, and I use a key file with a password, if the key file is too simplistic, is it possible to recreate that key file and open the container?
Suppose if I use a .jpg of a ...
7
votes
3answers
2k views
Why are KDFs slow? Is using a KDF more secure than using the original secret?
According to the Wikipedia page for key derivation functions, a KDF's purpose is to derive a secret key for cryptography:
In cryptography, a key derivation function (KDF) derives one or more secret ...
1
vote
0answers
231 views
Why does Microsoft recommend storing the ASP.NET Core DataProtection Key Ring in EFCore?
After many years that accepted best practice was to never store keys in a database, but Microsoft now recommends storing the data protection key ring (encrypted with certificate) in the database using ...
2
votes
0answers
60 views
How to store a key for a Java app server?
Assume I have a Java app running on a Linux server. The app needs a secret key to do a task, such as decrypting or encrypting a file, after it starts up. This is a question about best practice for ...
2
votes
0answers
36 views
Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?
We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
0
votes
1answer
119 views
How can I distribute highly confidential keys for a symmetric cipher?
Say I want to exchange a key with someone for a symmetric cipher (say AES) without meeting them in person. What would be the most secure way to do this over the Internet? My first instinct would be ...
0
votes
1answer
83 views
Key management for builds for embedded systems
Our medical device has embedded processors and a USB port used for firmware updates and logfile transfers. The usual USB viruses are not a concern (no mechanism to load or execute them, wouldn't run ...
1
vote
0answers
45 views
Root CA key generation compliant with WebTrust and HSM independent
I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust.
One additional requirement I have that the generate private key should be then imported to ...
1
vote
0answers
23 views
Recomendation for automated rotation of a JSON keyring? [closed]
I have a Sailsjs app that is configured to encrypt model attributes with sensitive information. This seems to use bcrypt, under the hood and leverages a JSON keyring in the configuration (...
0
votes
3answers
303 views
Prevent finding key in C++ application binary
I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
1
vote
1answer
115 views
Is encryption/decryption done in the cloud when using CMK keys?
I am trying to understand how AWS KMS works, and there is one thing I am still not completely sure of: when using CMKs, so no Data Keys, no envelop encryption, does the encryption take place in the ...
0
votes
1answer
67 views
Updating Sender-Keys and Key-Management
This question is related to an earlier question I had:
Encryption on Mobile Devices - Multiparty Encryption - Key Management
My situation: I have many mobile devices that want to send sensitive ...
3
votes
2answers
126 views
What is the best strategy for handling a compromised private key within the domain of firmware?
I have a firmware project that uses asymmetric cryptography for assuring integrity and authority of updates. The private key is stored within the company, and the public key is on the firmware to ...
0
votes
0answers
44 views
Server application to hold PGP private keys and decrypt as requested
I don't know if what I'm talking about exists, or if the concept doesn't make any sense, or even if it's just a stupid question. I'm developing a small integration for our business which receives ...
0
votes
1answer
63 views
Are all web servers for a domain wildcard certificate supposed to have the same private key?
If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
2
votes
0answers
297 views
Open source KMIP Server in a production-level environment [closed]
I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
