Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
825
questions
0
votes
0
answers
13
views
Passwordless gnome-keyring - Does it present a security issue?
I've been looking around, but I can't seem to find an unified answer for my question.
eg.
Some say it's safe: What’s the security risk when setting the Gnome keyring password to blank on an FED system ...
- 1
1
vote
0
answers
23
views
Does the the key used to encrypt in a ransomware attack reside on the target computer for at least some time? [duplicate]
My understanding is that a ransomware uses the target computer's resources to encrypt files. So does that mean that the key used for encryption resides on the target computer for at least some time? I ...
- 11
0
votes
0
answers
40
views
How to viably use HSM on public cloud providers (AWS or GCP)
I don't have any experience with HSMs.
My goal is to secure critical seed phrases used to generate crypto wallets
I found a good approach is to use HSMs to store encryption keys and encrypt the seed ...
3
votes
1
answer
89
views
Why are key IDs typically the *last* digits of the key hash?
With PGP for example, the "properties" of the following key are:
pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02]
6713B62DC36CE36403C724B1FFD641CF2BD6571B
uid [...
- 33
0
votes
1
answer
92
views
How do centralized crypto exchanges store seed phrases and users' private keys?
Say I'm trying to develop a CEX, hence I will hold custody of users' keys. How would I go about doing that and ensuring safety and security?
From what I know, I can generate the users' keys from a ...
1
vote
1
answer
34
views
Export ECDSA certificate from Windows Store
I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
- 61
1
vote
0
answers
17
views
SIM hardware protection of master and long lived keys
4G and 5G authentication procedures includes master keys or long term keys which are shared between subscribers and Home Networks, for 4G they are called Ki.
A case was reported here in which NSA ...
Pietro
0
votes
1
answer
36
views
How can a client safely post/get a (symmetric) client key to/from a key distribution center?
If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
0
votes
0
answers
26
views
Import BDK encrypted under the Transport Key KEK on HSM
I received a two-component KEK TDES key and a BDK cryptogram, which is encrypted for this KEK.
Do you have any suggestions on how to load such a key into the HSM device? Eg. Luna HSM
0
votes
1
answer
61
views
How to preserve key in TPM 2.0
I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
0
votes
0
answers
73
views
Alternative to AWS CloudHSM?
I am not using AWS, google cloud or similar. I have a vps on another webhosting service.
I am going to encrypt my data but don’t know where the best place to save the encryption keys would be?
I can ...
- 121
1
vote
1
answer
40
views
Best and safest way to store secret key used for PKA on server?
I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example:
Create a 0500 access directory on my server
...
- 115
1
vote
1
answer
163
views
Why should encryption key be rotated after it has been used to encrypt a specific amount of data?
I'm going through OWASP Cryptographic Storage Cheat Sheet and it says:
Encryption keys should be changed (or rotated) based on a number of different criteria: (...) After the key has been used to ...
- 155
1
vote
0
answers
98
views
Storing AES key for later usage
I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
0
votes
1
answer
118
views
Can an encrypted RSA key be committed to git?
I have a pair of RSA keys where the private key is encrypted with a passphrase. Would it be a security risk if the public and private keys are committed to version control without any further ...
1
vote
0
answers
44
views
Uses for TR-31 Key Version Number?
The standard for TR-31 (and Thales) Key blocks (ref) have a field for "Key Version Number", which is only defined in the spec as
Two-digit ASCII character version number,
optionally used to ...
- 1,446
0
votes
0
answers
27
views
Is it possible to configure Github to allow writes to a particular repo/organisation, only from a particular SSH key?
It's not uncommon for an organization to allow developers to use their personal Github to do their work.
A potential problem I see with this, is that the organization doesn't have control over that ...
- 707
1
vote
0
answers
64
views
Is it possible to regenerate the stub private key from just the physical key in OpenSSH?
Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key.
If I lose ...
- 111
0
votes
0
answers
47
views
Validate the conformance of an OpenSSL created certificate with FIPs standards
Trying to test the conformance of the certificates inside our application, with the below requirement:
The application shall [selection: invoke platform-provided
functionality, implement ...
- 109
0
votes
1
answer
72
views
How to manage a users private key in a secure document storage solution?
I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
- 101
1
vote
1
answer
313
views
Key management for End-to-end encryption for Chat application
I want to implement end-to-end encryption on my chat application (available on android, iOS and web). For that I've following mechanism in mind.
Generate Key pairs (Private key and Public key) on ...
- 111
1
vote
1
answer
152
views
Does Re-Encryption make our data more secure?
We are focusing on mobile phone and hard drive encryptions. This idea can be extended to any data encryption also.
iPhone and recent Androids are all encrypted. We know that changing the password will ...
- 111
0
votes
0
answers
61
views
Strange keystore from payment processor
I am working on an older software for a company at the moment and in my work have been upgrading a number of libraries. The app connects to a web service hosted by the third party payment processor, ...
- 1,092
4
votes
1
answer
111
views
Is it possible to use HKDF in the TPM?
Is it possible to use HKDF in the TPM? My goal is to load in a master symmetric key and derive keys from that using HKDF. I see there are other KDF functions available, but no mention of HKDF.
- 43
0
votes
0
answers
153
views
Almost unattended generation of "a pretty good keypair"
I need to generate quite a lot of gpg-keys for different tasks on my Debian Bullseye (Stable) machine. Also I want the highest level of security while being able to automate as much as possible.
...
- 121
6
votes
1
answer
454
views
How are the PGP keys that Thunderbird 78+ uses encrypted?
With Thunderbird 78, a new PGP subsystem has been introduced which handles PGP keys internally. In previous versions, the add-on Enigmail has handled PGP-related stuff, by letting do GnuPG the work ...
- 547
3
votes
0
answers
145
views
Move signing subkey to authentication slot on YubiKey (OpenPGP card)?
My PGP primary key is only used for certification—I use a separate subkey for signing. Like this:
sec rsa4096/0x891781D0EDC66456 ...
- 376
1
vote
2
answers
152
views
How to manage Encryption Key for Server Side Encryption in AWS S3
I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows:
All the existing data ...
- 11
0
votes
0
answers
93
views
Why does KMIP require to request two keys for AES-XTS?
According to KMIP user’s guide, when a client application desires to retrieve a 512 bits AES-XTS key, it should request 2 separate KMIP keys of 256 bits each. This is to support the structure of an ...
- 21
1
vote
0
answers
237
views
AWS KMS CMK compromise
Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
- 652
0
votes
1
answer
132
views
Is there an encryption mechanism for binary data with expiration for rotating keys?
We have a web server with an application - there is a large data array attached to the application via a mount point. We have to fulfill the requirement of securing in-transit data and at-rest data. ...
- 101
1
vote
1
answer
119
views
Is there any standard or protocol of key exchange between multiple nodes?
A little context: I'm working in designing a system to sign and verify data sent between modules of a bigger system. Currently the system has two parts, a central application and a SDK inside modules ...
- 11
0
votes
1
answer
125
views
E2E-Encrypted storage: What to do when the lifetime of a key is over?
When using AES-GCM-256 with random nonces, a limit of 2^32 encryptions is specified in order to have a low nonce collision probability. A new key has to be generated to take its place afterwards, I am ...
- 697
20
votes
3
answers
6k
views
Not understanding why I should use public/private key encryption over password?
My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue.
Now ...
0
votes
1
answer
113
views
I want my customers to download the encrypted video file to a secured usb and play it directly in TV by providing unique key which i shared to them
How do I make sure that this content is not hacked by anyone ?
Do I encrypt every file and store the key before my customers download their unique copy?
0
votes
0
answers
19
views
Is there hardware (like u2f-keys) for passwordless client-side encryption & decryption [duplicate]
I know that u2f keys are designed as authentication factors, but I think it would not be far fetched to also add a protocol that the user can use to encrypt or decrypt data on the client-side. This ...
- 697
2
votes
2
answers
928
views
How to get PGP key passphrase out of Thunderbird?
I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it ...
0
votes
1
answer
111
views
How to securely encrypt shared data for a dynamic amount of users?
Example:
Bob uploads a file to my custom file server locked with a password, which then the file server generates a link for him to share
Bob wants to be able to share this data to anyone that has ...
0
votes
1
answer
115
views
Storing client keys in cloud app
I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, ...
1
vote
1
answer
505
views
How to get Future Keys (Session Key) from IPEK for decryption data?
I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal.
So far, when I receive KSN and encrypted data, I understand that I ...
0
votes
1
answer
410
views
Where is the PDF encryption key stored
Assuming you have the user protected PDF file. Using the password, the cryptographic key is generated and the file encrypted. Where is the key stored, is it on the RAM every time the file is opened?
2
votes
1
answer
329
views
How does a Certificate get associated to the private key pair? [duplicate]
I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
- 131
3
votes
1
answer
504
views
How can I store and manage my GPG key pair securely?
I've taken measures and thoughts on how to securely store and manage my key pair. In the process of it a few questions arose, which I'm not capable of answering yet. My key pair will be used to ...
- 33
1
vote
0
answers
167
views
Windows X.509 certificate private keys lost
Have the same certificates installed on several machines, but this happens on only one of them.
The certificates are self-signed certificates.
The certificates are used for WCF message security.
...
- 135
0
votes
2
answers
428
views
Storing a key in a symmetric encryption for password manager using cryptography module
I am making a password manager and generator. The user creates the login information, and then I hash their password. After that, I generate the password and encrypt the password with a key stored ...
2
votes
1
answer
273
views
ssh-keygen: How to guarantee the uniqueness of serial numbers?
(FYI: I'm using Ubuntu 18.04 Desktop although I don't think my question is platform-dependent.)
I read the article Scalable and secure access with SSH and it says:
... if you want to use revocation ...
- 121
1
vote
0
answers
86
views
Browser session storage
Is it some secure way to store private keys in session storage? or is there any place to store that info securely?
- 111
1
vote
1
answer
239
views
Key pairs extension / version
I read in some docs, there are several version of GPG key extension available.
For ex: gpg, ascii, p12
I know .gpg extension is in binary, and Ascii is in text.
But I want to know their differences ...
- 13
2
votes
0
answers
166
views
Long-term symmetric key storage
I have some sensitive data that I need to encrypt and retain long-term (i.e., 5+ years at least). I'd ideally like to secure it using multiple hardware devices via a Shamir share. Something like:
...
- 123
8
votes
2
answers
2k
views
TPM or OpenSSL for key generation?
I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
- 103