Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
1
vote
1answer
36 views
Security implications of exposing payment gateway secret API key
Introduction
In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow:
POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL.
...
0
votes
0answers
41 views
One GPG key with multiple user identities for my career?
I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs.
My understanding is that there are two ways this could be done:
Have one main/master GPG ...
4
votes
1answer
122 views
If my private key is password protected, then how is it used without asking me for it?
Relating to TLS and SSH. If my private key is password / passphrase protected, how is this then used automatically during TLS or SSH communication without asking me for the password?
1
vote
0answers
28 views
Sharing individually encrypted elements between users of a system
I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file.
For simplicity, lets say the unique keys are the file names.
I'd ...
3
votes
1answer
69 views
Why are passphrases protecting GPG / SSH private keys needed? [duplicate]
SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed ...
1
vote
2answers
52 views
Possible to get sshd (openssh) to log the public key of failed key based login attempts?
As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key.
What I'm looking for is ...
0
votes
1answer
123 views
Why do SSL certs use saved private keys?
If an encrypted connection can be compromised when a server's private key is stollen, why don't servers simply generate a new private key for each unique session. It seems like it would eliminate a ...
0
votes
2answers
101 views
Rotating encryption keys - how does it work?
I haven't found a duplicate which explains with sufficient clarity how does the process of rotating encryption keys work in simple layman terms.
I know how private/public key cryptography works, I ...
2
votes
1answer
65 views
Are there any known collisions of a “long” (64 bit) OpenPGP key ID?
We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
2
votes
1answer
38 views
Are there risks to having many uids on my gpg key?
I'm fairly new to the world of pgp/gpg, I came to it first through Keybase and then the gpg client and now I think I'm in a place where I'm quite happy with my key setup. I've just started a new job ...
0
votes
1answer
68 views
Crypto-shredding & backups of keys
I was wondering, how is crypto-shredding implemented in an environment, where data backups/mirroring is mandatory for the "key database" - as it must not be possible to lose the machine/db with all ...
2
votes
1answer
77 views
How to Manage Public Key with Asymmetric Cryptography
I'm working on an iOS chat project using Firebase RealTime Database.
I want to use asymmetric cryptography for the management of messages between two users ..
Browsing the net I found an excellent ...
1
vote
0answers
61 views
Where To Store Public and Private Key files?
I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting.
In my project, I'm generating two files: Public Key file and ...
0
votes
0answers
50 views
TPM - store signing key and reuse it later
I am trying to use the TPM on a windows 10 platform for certificate based authentication. After struggling a little bit with the TSS.MSR code I successfully managed to create a signing key and use ...
1
vote
1answer
43 views
Ensuring key integrity
I have encrypted AES key stored in the database with the encrypted data. AES key is encrypted with a key derived from the passphrase. I want to ensure the integrity of the stored AES key. Is the ...
0
votes
1answer
31 views
Protecting Keys with External Factor
I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
2
votes
2answers
106 views
Proper security for IoT device
I'm developing a product with simple Cortex-M MCU (with no OS on board, firmware on bare metal) and internet connectivity via external module.
How do I make it secure? More specifically, how do I ...
4
votes
1answer
86 views
What fundamental problems are solved by using a Key Encrypting Key (KEK)?
I've read several questions regarding KEKs but have not quite found one that comprehensively addresses why we would choose to use a KEK. This excellent answer by Mike Ounsworth explains how KEKs allow ...
1
vote
0answers
25 views
Generating new E and S subkeys for a key that has been moved to card
I accidentally messed up months ago by keytocard'ing a seret key before making an offline locked-away backup of it. I failed at reading comprehension and did not know that this would delete the key ...
0
votes
1answer
37 views
How does Authenticator gets the PMK which is used to calculate PTK?
I am trying to setup a Supplicant- authenticator and AAA server to perform EAPOL mechanism.
I am able to successfully completed the EAP authentication procedure but 4-way handshake was not initiated ...
1
vote
1answer
51 views
What advantages do Secret Managers offer in terms of authentication [API usage]?
The problem I am seeing with secret managers (programs which serve as a store of secrets for other programs/APIs) is that at some level, a key or credentials must still be provided programmatically, ...
0
votes
1answer
65 views
Best way to manage private keys for users of an application?
We're building an application which will leverage blockchain for financial transaction within itself.
We won't be forcing users to manage their own keys. Our clients (we're building a B2B platform) ...
0
votes
1answer
44 views
How can AWS API Gateway be used to rapidly rotate credentials in this fashion?
Reading through this article, I hit a little wall of understanding. The author states:
This is because my laptop doesn’t have the secret weapon. Once you get
this up and running on an EC2 ...
0
votes
1answer
34 views
iCloud Security Concern: browser session authentication storage after 2-factor?
Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?
My concern is, if ...
0
votes
2answers
94 views
Is it secure to send a RSA-wrapped symmetric key along with the payload it was used to encrypt?
Given key K, salt Salt which is 32 randomly generated bytes is used to derive keys EKey and AKey using HKDF-SHA256.
A Ciphertext is produced using AES-256-CBC with key EKey and a random 16-byte iv ...
1
vote
1answer
260 views
How can i sniff Telegram packets before they get encrypted?
So how can I sniff packets that are being sent from my computer to their server and from their servers to me using a sniffing app like Wireshark?
right now when i use Wireshark, they are all ...
0
votes
1answer
33 views
Automatically import/deploy/distribute private key to users for use with S/MIME
it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt ...
1
vote
1answer
84 views
Storing RSA private/public key pairs in a file, on linux
Would it be wise to:
Generate a lot of priv./pub. key pairs, and store them in a file on the server machine(Linux). (Let's say in a companies server room)
Then encrypt the file with AES, and store ...
2
votes
1answer
39 views
OpenVPN client can still connect to the server after client's tls-auth key has changed
I'm currently getting familiar with OpenVPN by building and testing some client–server infrastructure using VMware workstation.
This is what I've recently noticed: if you manually change some values ...
2
votes
2answers
64 views
Security Appliance Key Generation
For devices like decrypting HTTPS proxies, there is often a built-in mechanism for generating a key-pair and CSR. An admin can then have their in-house authority sign the CSR with a subordinate CA ...
1
vote
0answers
35 views
What is this key management scheme called
We are building a system, where the messages between services is encrypted with Data Encryption Key (DEK).
The DEK is attached to the message, but encrypted with another key, Key Encryption Key (KEK)....
2
votes
1answer
68 views
How to properly manage encryption key
To encrypt the database in the organization, I think it is better to use symmetric key encryption.
According to what I've researched from NIST paper.
Cryptoperiod: The originator-usage period ...
1
vote
0answers
23 views
What measures are used to protect private keys on credit card processing devices?
For example, a device that accepts credit card payment to update a store card. These are usually embedded devices with a hard drive for permanent storage. Would it not be possible for a hacker to ...
0
votes
1answer
324 views
Checking if an RSA private key is passphrase protected
I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase.
Note that the problem is not that I forgot the passphrase, but ...
1
vote
1answer
171 views
Multiple PGP key practices for code signing, GitHub, and email
I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is:
Have I overlooked something important that ...
2
votes
2answers
187 views
Should the client or the server generate the client's public-private key pair?
Say I have a mobile messaging app. There is a central server that manages stuff (like a directory of users, onboarding, etc.) and there are all the clients.
My app is professional, so it uses ...
-2
votes
1answer
73 views
Does a private key file created with a passphrase need to be decrypted before use
Let's say that I have created a private key file with some passphrase in ssh-keygen. Now someone sends me a message encrypted with my public key. To decrypt the message I need a private key.
Do I ...
1
vote
1answer
298 views
Hash a secret API key with a random salt instead of sending sending it alone in REST API
Say, I have an internal https API endpoint used only by me being the admin.
In each each request I send a secret API key for authentication. And I'm fine with this solution.
curl -x PUT .......
-...
2
votes
1answer
70 views
Why do people check the passport on key signing events?
I find the common procedure of key signing parties a little awkward:
Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
2
votes
2answers
497 views
Why is an HSM required to protect CA certificates (rather than a regular USB token)?
Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on.
The same vendors also offer distinct products called HSMs (...
3
votes
4answers
969 views
Securing hashes of short enumerated values
The system manages and stores sensitive data of short strings.
Because the sensitive data is of an enumerated type with limited set of well known values, the attacker could easily iterate all the ...
1
vote
1answer
32 views
Safely connect to remote site from cloud based code
I am connecting my computer located at my home to a remote server.
To communicate with the server, I use a config file that contains my private and public keys and a passphrase. My code reads the ...
1
vote
1answer
236 views
how to save RSA keys in a software?
I am working on a non-professional piece of software that is required to generate and store RSA keys (public and private). The generated keys will be used to encrypt communication across the Internet. ...
0
votes
0answers
85 views
What is the best way to access/interact with the code signing server from build server (Jenkins) to sign the binaries in automated way
we have a dedicated build (Jenkins based )server and code signing server,
As part of the post build process,build script access the signing server and perform the code signing.
Is there any way to ...
3
votes
3answers
159 views
Using a windows partition as a decoy
I'm interested in setting up a laptop that dual boots Windows 7 and openSUSE. The plan is to encrypt the openSUSE partition and require a USB thumb drive with the encryption key for it to boot. Where ...
2
votes
3answers
115 views
How to manage PGP private keys?
I am trying to find out a way to protect files that will be stored on a drive accessible to the public. Using permissions is not an option in this case, so I am planning to encrypt the files using PGP ...
3
votes
1answer
105 views
Secure high-portability way to store passwords?
I'm developing a cross-platform Java desktop application which uses a password to derive a cryptographic key. I'd like to add a "Remember me" feature that stores this cryptographic key on the hard ...
2
votes
1answer
221 views
How to store secret key used for hashing?
I am trying to figure out a secure way to store secret keys used in the hashing of social security numbers.
The idea is for de-identification of research subjects yet still permitting follow-ups ...
2
votes
2answers
57 views
What format is an decrypted RSA private key in, specifically in OS X Keychain?
I was trying to extract an un-exportable key from OS X Keychain. I used this tool to extract the key. The tool gives me a hexdump of the private key. An RSA 2048 bit key came out to be 2441 bits, ...
1
vote
1answer
199 views
Windows PFX certificate import: protect private key using virtualization-based security?
On Windows 10 v1803 (i.e. April 2018 update) when importing a PFX, an option like
[ ] Protect private key using virtualization-based security (non-exportable)
appears on the import wizard. What is ...
