Questions tagged [key-management]

Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

Filter by
Sorted by
Tagged with
2 votes
1 answer
86 views

API key embedded in clients: how to defend against over-usage?

I am new to client-side development and I have a naive question. Right now, I'm using Google APIs (the map ones). If I want my client-side application / webapp to display a map, I would include ...
Rififi's user avatar
  • 157
2 votes
2 answers
134 views

Full disk-encryption key vs password

I need to set up full disk encryption on my linux laptop. Questions: Does an encryption key on a USB pendrive protect against rubber-hose cryptanalysis? Is it true that the key on a pendrive is ...
lester's user avatar
  • 121
0 votes
0 answers
40 views

Stateless Key Management

I'm looking into the differences between stateful and stateless key management. I understand that stateful key management means that I have a database that tracks my keys, and can become very large. ...
Shane Quintard's user avatar
0 votes
1 answer
162 views

What does it mean to store secret keys as an "environment variable" as opposed to hardcoded in the source code?

I see why it is obviously bad to store a secret key and client ID in the source code for a web application. However, how do you go about the alternative? Surely, that information has to be stored ...
BigMistake's user avatar
0 votes
1 answer
91 views

How to avoid performance issues with envelope encryption when using separate DEK's for each piece of data?

Posted this first on stackoverflow but was suggested to repost it here. I am planning on using envelope encryption for data stored in a database in a multi-tenant solution. Envelope encryption suggest ...
user579089's user avatar
0 votes
1 answer
227 views

Consequences of stolen TLS private key

My understanding is that, when you connect to an HTTPS website, the communication is encrypted via asymmetric encryption, therefore private and public keys play a role there. My assumption there is ...
Tripola's user avatar
  • 103
0 votes
0 answers
60 views

What does an exported BitLocker key package contain?

I've learned that a key protector encrypts the VMK (volume master key), then the VMK encrypts the FVEK (full volume encryption key), and finally the FVEK encrypts the actual data blocks. I've also ...
Chris Chen's user avatar
1 vote
0 answers
46 views

Encryption and storing/managing private key in hosted cluster

I am working on an application running in/on a hosted Kubernetes cluster. All services are built using a Java based stack. For a new feature it is required to temporarily store notifications (email ...
Ratlos's user avatar
  • 67
0 votes
2 answers
343 views

Backup GPG private key in KeePassXC

In order to keep all my secret in the same place, I would like to store my GPG private key in KeePassXC, under the "Notes" field. Provided that the db file has very good password, is this ...
robertspierre's user avatar
2 votes
1 answer
200 views

Is there a secure way to embed a private key in compiled code that is released in compiled form to the general public?

It occurred to me that if I could compile a private key in source code, I could prove that log information came exclusively from the application for a given version. I could do this by releasing the ...
Larry Freeman's user avatar
0 votes
1 answer
106 views

PCI compliance - use of ANSI X9.17 for export keys

we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
MaXbeMan's user avatar
1 vote
1 answer
100 views

How to recover data that was encrypted with a revoked or expired key? [closed]

Do you know any processes for recovering data which has been encrypted with a revoked or expired encryption key after the encryption key becomes invalid?
Asclepius's user avatar
-1 votes
2 answers
231 views

Strategy for storing private keys used in an embedded device

I am developing an embedded device using a bootloader. This means that the device will store in its flash an encryption key for decrypting update packages and an ECC public key for verifying update ...
user2563661's user avatar
0 votes
1 answer
79 views

Passing sensitive user data I must not ever see between devices using an identity provider

I have a Progressive Web Application (PWA) with a lot of users, each user creates a public-private keypair and wants to use that across devices simply by logging in using some form of auth, for ...
Phosphorescent's user avatar
0 votes
0 answers
64 views

How could one use multi-factor authentication to derive a static secret key?

Scenario: The setup is that each user has a randomly generated key A used for encrypting data stored on the server and a password-derived key B used to store A on the server without the server getting ...
n-l-i's user avatar
  • 115
0 votes
0 answers
49 views

What is the proper way to manage a company's SSL certificates?

Is there a way/software to manage and sign multiple SSL certificates? We have many intranet web applications that show the certificate error risk in the web browser. I have been googling a lot but SSL ...
SGP's user avatar
  • 101
2 votes
1 answer
216 views

Security of Trusty OS (TEE) Non-Secure World API

Recently I learned about TEE in Android, Trusty OS and its internals. I read through the articles on source.android.com and there is one thing I did not find there. Trusty OS has its own API which ...
Topper Harley's user avatar
3 votes
2 answers
336 views

My web application needs to have my users' private keys to sign documents on their behalf. How do I handle that?

Our web application issues governmental documents for our users. Every one of those documents needs to be signed with a private key. However, because our users find it cumbersome to point their ...
H. Sérvio's user avatar
0 votes
0 answers
60 views

Securing the keystore key?

My program, is installed on specific computers that use a shared, common login. The program decrypts variously sized (1KB-1GB) data assets which were encrypted elsewhere, and transferred over. Each ...
Reahreic's user avatar
  • 121
0 votes
0 answers
85 views

In a web application, what would you consider the best way to store secret keys obtained via an SDK?

Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user. Currently when ...
Ray's user avatar
  • 1
0 votes
1 answer
55 views

Is public key-transport key required for encryption key distribution over HTTPS?

According to NIST Key Management recommendation "8.1.5.2.2.2 Automated Key Distribution/Key Transport/Key Wrapping", it is required to use a key wrapping key or a public key-transport key to ...
user1024888's user avatar
0 votes
0 answers
59 views

Data Encryption Key protection during transmission in Envelope-Based Encryption

When using cloud HSM (eg: AWS CloudHSM, Google Cloud HSM etc) for client-side encryption, they always refer to Envelope encryption. In this encryption approach, the data encryption key (DEK) is ...
user1024888's user avatar
0 votes
2 answers
84 views

What could be the correct and secure ways to store and manage public keys?

I am developing an open source project(PKDSA) that uses ED25519 and ED448. My purpose of this project was to help others to enable user-secretless based passwordless authentication. There're a lot of ...
Hern's user avatar
  • 3
1 vote
1 answer
173 views

How do I best share a shared account's private key?

I made a website which among other things allows users to sign up to events. The HTML form is filled out and submitted, which automatically updates a google spreadsheet with all applications. This of ...
RattatAndyGo's user avatar
2 votes
1 answer
467 views

Key management: Can I delete private key in asymmetric encryption?

If using asymmetric encryption, such as ES256, is there a reason why a private key could not be discarded after signing some data? For example with a JWT, or a file hash use for audit at a later date, ...
vbuser2004's user avatar
1 vote
1 answer
96 views

Is handling keys with vps without kms secure?

I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the ...
Hejhejhej123's user avatar
0 votes
2 answers
212 views

Asymmetric encryption and data sharing

I have a web application created with Flask in python that uses asymmetric encryption using RSA, the private key is generated from the user's password and is only stored in a cookie on the user's ...
user avatar
2 votes
1 answer
187 views

How to use (py)NaCl/libsodium for key wrap, key encapsulation

We want to wrap / encapsulate a symmetric key with an asymmetric keypair, a symmetric key with a symmetric key, a private key with a symmetric key. In each case, we'd like to allow several keys to ...
BGWPVqRM3xIg's user avatar
3 votes
1 answer
233 views

Is sharing private key with CDN dangerous?

When you use a Content Delivery Network (CDN) and want to enable HTTPS, you need to import your certificate there. So you should provide your Private Key to the CDN. Is this secure? I mean CDN can log ...
GameO7er's user avatar
  • 169
1 vote
2 answers
210 views

How do you share private keys for signing e.g. JWTs inside Docker-Containers?

I've written an application in NodeJS which essentially only performs a login: You send your username/password, and you retrieve an JWT (JSON Web Token). Those tokens are being signed by a private key....
Gandalf1783's user avatar
0 votes
0 answers
31 views

Is it possible for an app to sign data it generates so that the data can be guaranteed to come from the app? [duplicate]

Is it possible for an app binary to sign content generated by the app such that a verifier can confirm the data was indeed generated by a specific version of the app? For example: A mobile app from a ...
aphoniko's user avatar
1 vote
0 answers
115 views

The 3-level hierarchy of keys in TPM 2.0

I have a task to create the 3-level RSA key hierarchy (with wolfTPM library), where keys of the 2nd and the 3rd levels are imported keys. Here are the steps that I follow: Generate a primary key on ...
Victoria Seniuk's user avatar
0 votes
1 answer
228 views

After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?

I have a private S3 bucket. I want a user from an external organisation to have access. I have added a user in IAM. How does this external user get notified and how do I share credentials? The secret ...
Architect 's user avatar
0 votes
1 answer
167 views

How to setup a Per-File Encryption architecture

I would like to set up a per-file encryption architecture where every file is encrypted with its own key, and each key is encrypted using a master key. Is there any good articles to read regarding ...
Lina's user avatar
  • 1
0 votes
0 answers
141 views

How long does Signal keep the keys for out-of-order messages?

I was reading the Signal protocol on how it handles out-of-order messages. What if those messages never arrived, does Signal keep the keys forever or are the keys deleted as soon as a new session is ...
user2600798's user avatar
3 votes
0 answers
219 views

Securely store application secrets in production without 3rd party KMS

Integrated Security I have a ASP.NET web application with connection strings and other secrets to protect in production. Ideally I would like to use IntegratedSecurity to keep SQL credentials out of ...
JCasper's user avatar
  • 31
0 votes
1 answer
135 views

Is there a viable zero-knowledge approach for using oAuth to generate and manage private keys?

I've been doing a deep dive into how products like Web3Auth work under the hood and wonder if this is a viable approach to building applications where a user can have the convenience of using oAuth to ...
user3458571's user avatar
1 vote
0 answers
25 views

Does the the key used to encrypt in a ransomware attack reside on the target computer for at least some time? [duplicate]

My understanding is that a ransomware uses the target computer's resources to encrypt files. So does that mean that the key used for encryption resides on the target computer for at least some time? I ...
Abhisek Dash's user avatar
3 votes
1 answer
139 views

Why are key IDs typically the *last* digits of the key hash?

With PGP for example, the "properties" of the following key are: pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02] 6713B62DC36CE36403C724B1FFD641CF2BD6571B uid [...
Turysaz's user avatar
  • 33
0 votes
1 answer
189 views

How do centralized crypto exchanges store seed phrases and users' private keys?

Say I'm trying to develop a CEX, hence I will hold custody of users' keys. How would I go about doing that and ensuring safety and security? From what I know, I can generate the users' keys from a ...
whitebat 199's user avatar
1 vote
1 answer
162 views

Export ECDSA certificate from Windows Store

I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
Amal Jesudas's user avatar
0 votes
1 answer
80 views

How can a client safely post/get a (symmetric) client key to/from a key distribution center?

If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
hurryman2212's user avatar
0 votes
1 answer
534 views

How to preserve key in TPM 2.0

I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
Kostas Moisidis's user avatar
1 vote
2 answers
183 views

Best and safest way to store secret key used for PKA on server?

I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example: Create a 0500 access directory on my server ...
DevelJoe's user avatar
  • 131
1 vote
1 answer
473 views

Why should encryption key be rotated after it has been used to encrypt a specific amount of data?

I'm going through OWASP Cryptographic Storage Cheat Sheet and it says: Encryption keys should be changed (or rotated) based on a number of different criteria: (...) After the key has been used to ...
kozooh's user avatar
  • 165
1 vote
0 answers
304 views

Storing AES key for later usage

I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
Rak Laptudirm's user avatar
0 votes
1 answer
619 views

Can an encrypted RSA key be committed to git?

I have a pair of RSA keys where the private key is encrypted with a passphrase. Would it be a security risk if the public and private keys are committed to version control without any further ...
Runtime Terror's user avatar
1 vote
1 answer
218 views

Uses for TR-31 Key Version Number?

The standard for TR-31 (and Thales) Key blocks (ref) have a field for "Key Version Number", which is only defined in the spec as Two-digit ASCII character version number, optionally used to ...
Bobson's user avatar
  • 1,447
2 votes
0 answers
251 views

Is it possible to regenerate the stub private key from just the physical key in OpenSSH?

Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key. If I lose ...
nimish's user avatar
  • 121
0 votes
0 answers
138 views

Validate the conformance of an OpenSSL created certificate with FIPs standards

Trying to test the conformance of the certificates inside our application, with the below requirement: The application shall [selection: invoke platform-provided functionality, implement ...
DummyBeginner's user avatar

1
2 3 4 5
18