Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
836
questions
1
vote
1
answer
66
views
How do I best share a shared account's private key?
I made a website which among other things allows users to sign up to events. The HTML form is filled out and submitted, which automatically updates a google spreadsheet with all applications. This of ...
- 11
2
votes
1
answer
342
views
Key management: Can I delete private key in asymmetric encryption?
If using asymmetric encryption, such as ES256, is there a reason why a private key could not be discarded after signing some data?
For example with a JWT, or a file hash use for audit at a later date, ...
- 123
1
vote
1
answer
62
views
Is handling keys with vps without kms secure?
I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the ...
- 131
0
votes
2
answers
52
views
Asymmetric encryption and data sharing
I have a web application created with Flask in python that uses asymmetric encryption using RSA, the private key is generated from the user's password and is only stored in a cookie on the user's ...
user287213
2
votes
1
answer
61
views
How to use (py)NaCl/libsodium for key wrap, key encapsulation
We want to wrap / encapsulate
a symmetric key with an asymmetric keypair,
a symmetric key with a symmetric key,
a private key with a symmetric key.
In each case, we'd like to allow several keys to ...
- 21
2
votes
1
answer
103
views
Is sharing private key with CDN dangerous?
When you use a Content Delivery Network (CDN) and want to enable HTTPS, you need to import your certificate there. So you should provide your Private Key to the CDN. Is this secure? I mean CDN can log ...
- 159
1
vote
2
answers
73
views
How do you share private keys for signing e.g. JWTs inside Docker-Containers?
I've written an application in NodeJS which essentially only performs a login:
You send your username/password, and you retrieve an JWT (JSON Web Token).
Those tokens are being signed by a private key....
- 13
0
votes
0
answers
31
views
Is it possible for an app to sign data it generates so that the data can be guaranteed to come from the app? [duplicate]
Is it possible for an app binary to sign content generated by the app such that a verifier can confirm the data was indeed generated by a specific version of the app?
For example:
A mobile app from a ...
- 21
0
votes
0
answers
42
views
The 3-level hierarchy of keys in TPM 2.0
I have a task to create the 3-level RSA key hierarchy (with wolfTPM library), where keys of the 2nd and the 3rd levels are imported keys.
Here are the steps that I follow:
Generate a primary key on ...
- 101
0
votes
1
answer
45
views
After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?
I have a private S3 bucket. I want a user from an external organisation to have access.
I have added a user in IAM. How does this external user get notified and how do I share credentials?
The secret ...
- 631
0
votes
1
answer
58
views
How to setup a Per-File Encryption architecture
I would like to set up a per-file encryption architecture where every file is encrypted with its own key, and each key is encrypted using a master key.
Is there any good articles to read regarding ...
- 1
0
votes
0
answers
46
views
How long does Signal keep the keys for out-of-order messages?
I was reading the Signal protocol on how it handles out-of-order messages. What if those messages never arrived, does Signal keep the keys forever or are the keys deleted as soon as a new session is ...
- 175
2
votes
0
answers
52
views
Securely store application secrets in production without 3rd party KMS
Integrated Security
I have a ASP.NET web application with connection strings and other secrets to protect in production. Ideally I would like to use IntegratedSecurity to keep SQL credentials out of ...
- 21
0
votes
1
answer
54
views
Is there a viable zero-knowledge approach for using oAuth to generate and manage private keys?
I've been doing a deep dive into how products like Web3Auth work under the hood and wonder if this is a viable approach to building applications where a user can have the convenience of using oAuth to ...
0
votes
0
answers
44
views
Passwordless gnome-keyring - Does it present a security issue?
I've been looking around, but I can't seem to find an unified answer for my question.
eg.
Some say it's safe: What’s the security risk when setting the Gnome keyring password to blank on an FED system ...
- 1
1
vote
0
answers
25
views
Does the the key used to encrypt in a ransomware attack reside on the target computer for at least some time? [duplicate]
My understanding is that a ransomware uses the target computer's resources to encrypt files. So does that mean that the key used for encryption resides on the target computer for at least some time? I ...
- 11
0
votes
0
answers
62
views
How to viably use HSM on public cloud providers (AWS or GCP)
I don't have any experience with HSMs.
My goal is to secure critical seed phrases used to generate crypto wallets
I found a good approach is to use HSMs to store encryption keys and encrypt the seed ...
3
votes
1
answer
99
views
Why are key IDs typically the *last* digits of the key hash?
With PGP for example, the "properties" of the following key are:
pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02]
6713B62DC36CE36403C724B1FFD641CF2BD6571B
uid [...
- 33
0
votes
1
answer
128
views
How do centralized crypto exchanges store seed phrases and users' private keys?
Say I'm trying to develop a CEX, hence I will hold custody of users' keys. How would I go about doing that and ensuring safety and security?
From what I know, I can generate the users' keys from a ...
1
vote
1
answer
86
views
Export ECDSA certificate from Windows Store
I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
- 61
1
vote
0
answers
26
views
SIM hardware protection of master and long lived keys
4G and 5G authentication procedures includes master keys or long term keys which are shared between subscribers and Home Networks, for 4G they are called Ki.
A case was reported here in which NSA ...
Pietro
0
votes
1
answer
47
views
How can a client safely post/get a (symmetric) client key to/from a key distribution center?
If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
0
votes
0
answers
46
views
Import BDK encrypted under the Transport Key KEK on HSM
I received a two-component KEK TDES key and a BDK cryptogram, which is encrypted for this KEK.
Do you have any suggestions on how to load such a key into the HSM device? Eg. Luna HSM
0
votes
1
answer
137
views
How to preserve key in TPM 2.0
I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
1
vote
2
answers
60
views
Best and safest way to store secret key used for PKA on server?
I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example:
Create a 0500 access directory on my server
...
- 115
1
vote
1
answer
228
views
Why should encryption key be rotated after it has been used to encrypt a specific amount of data?
I'm going through OWASP Cryptographic Storage Cheat Sheet and it says:
Encryption keys should be changed (or rotated) based on a number of different criteria: (...) After the key has been used to ...
- 165
1
vote
0
answers
224
views
Storing AES key for later usage
I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
0
votes
1
answer
245
views
Can an encrypted RSA key be committed to git?
I have a pair of RSA keys where the private key is encrypted with a passphrase. Would it be a security risk if the public and private keys are committed to version control without any further ...
1
vote
0
answers
83
views
Uses for TR-31 Key Version Number?
The standard for TR-31 (and Thales) Key blocks (ref) have a field for "Key Version Number", which is only defined in the spec as
Two-digit ASCII character version number,
optionally used to ...
- 1,458
0
votes
0
answers
40
views
Is it possible to configure Github to allow writes to a particular repo/organisation, only from a particular SSH key?
It's not uncommon for an organization to allow developers to use their personal Github to do their work.
A potential problem I see with this, is that the organization doesn't have control over that ...
- 707
2
votes
0
answers
126
views
Is it possible to regenerate the stub private key from just the physical key in OpenSSH?
Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key.
If I lose ...
- 121
0
votes
0
answers
53
views
Validate the conformance of an OpenSSL created certificate with FIPs standards
Trying to test the conformance of the certificates inside our application, with the below requirement:
The application shall [selection: invoke platform-provided
functionality, implement ...
- 109
0
votes
1
answer
123
views
How to manage a users private key in a secure document storage solution?
I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
- 101
1
vote
1
answer
681
views
Key management for End-to-end encryption for Chat application
I want to implement end-to-end encryption on my chat application (available on android, iOS and web). For that I've following mechanism in mind.
Generate Key pairs (Private key and Public key) on ...
- 111
1
vote
1
answer
171
views
Does Re-Encryption make our data more secure?
We are focusing on mobile phone and hard drive encryptions. This idea can be extended to any data encryption also.
iPhone and recent Androids are all encrypted. We know that changing the password will ...
- 111
0
votes
0
answers
61
views
Strange keystore from payment processor
I am working on an older software for a company at the moment and in my work have been upgrading a number of libraries. The app connects to a web service hosted by the third party payment processor, ...
- 1,092
4
votes
1
answer
151
views
Is it possible to use HKDF in the TPM?
Is it possible to use HKDF in the TPM? My goal is to load in a master symmetric key and derive keys from that using HKDF. I see there are other KDF functions available, but no mention of HKDF.
- 43
6
votes
1
answer
666
views
How are the PGP keys that Thunderbird 78+ uses encrypted?
With Thunderbird 78, a new PGP subsystem has been introduced which handles PGP keys internally. In previous versions, the add-on Enigmail has handled PGP-related stuff, by letting do GnuPG the work ...
- 557
3
votes
0
answers
218
views
Move signing subkey to authentication slot on YubiKey (OpenPGP card)?
My PGP primary key is only used for certification—I use a separate subkey for signing. Like this:
sec rsa4096/0x891781D0EDC66456 ...
- 376
1
vote
2
answers
235
views
How to manage Encryption Key for Server Side Encryption in AWS S3
I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows:
All the existing data ...
- 11
1
vote
0
answers
302
views
AWS KMS CMK compromise
Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
- 662
0
votes
1
answer
164
views
Is there an encryption mechanism for binary data with expiration for rotating keys?
We have a web server with an application - there is a large data array attached to the application via a mount point. We have to fulfill the requirement of securing in-transit data and at-rest data. ...
- 101
1
vote
1
answer
129
views
Is there any standard or protocol of key exchange between multiple nodes?
A little context: I'm working in designing a system to sign and verify data sent between modules of a bigger system. Currently the system has two parts, a central application and a SDK inside modules ...
- 11
0
votes
1
answer
145
views
E2E-Encrypted storage: What to do when the lifetime of a key is over?
When using AES-GCM-256 with random nonces, a limit of 2^32 encryptions is specified in order to have a low nonce collision probability. A new key has to be generated to take its place afterwards, I am ...
- 707
20
votes
3
answers
7k
views
Not understanding why I should use public/private key encryption over password?
My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue.
Now ...
0
votes
1
answer
118
views
I want my customers to download the encrypted video file to a secured usb and play it directly in TV by providing unique key which i shared to them
How do I make sure that this content is not hacked by anyone ?
Do I encrypt every file and store the key before my customers download their unique copy?
0
votes
0
answers
19
views
Is there hardware (like u2f-keys) for passwordless client-side encryption & decryption [duplicate]
I know that u2f keys are designed as authentication factors, but I think it would not be far fetched to also add a protocol that the user can use to encrypt or decrypt data on the client-side. This ...
- 707
2
votes
2
answers
1k
views
How to get PGP key passphrase out of Thunderbird?
I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it ...
0
votes
1
answer
123
views
How to securely encrypt shared data for a dynamic amount of users?
Example:
Bob uploads a file to my custom file server locked with a password, which then the file server generates a link for him to share
Bob wants to be able to share this data to anyone that has ...
0
votes
1
answer
120
views
Storing client keys in cloud app
I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, ...
