Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
716
questions
2
votes
0answers
23 views
Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?
We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
0
votes
1answer
88 views
How can I distribute highly confidential keys for a symmetric cipher?
Say I want to exchange a key with someone for a symmetric cipher (say AES) without meeting them in person. What would be the most secure way to do this over the Internet? My first instinct would be ...
0
votes
1answer
52 views
Key management for builds for embedded systems
Our medical device has embedded processors and a USB port used for firmware updates and logfile transfers. The usual USB viruses are not a concern (no mechanism to load or execute them, wouldn't run ...
1
vote
0answers
25 views
Root CA key generation compliant with WebTrust and HSM independent
I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust.
One additional requirement I have that the generate private key should be then imported to ...
1
vote
0answers
23 views
Recomendation for automated rotation of a JSON keyring? [closed]
I have a Sailsjs app that is configured to encrypt model attributes with sensitive information. This seems to use bcrypt, under the hood and leverages a JSON keyring in the configuration (...
-1
votes
3answers
114 views
Prevent finding key in C++ application binary
I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
1
vote
1answer
41 views
Is encryption/decryption done in the cloud when using CMK keys?
I am trying to understand how AWS KMS works, and there is one thing I am still not completely sure of: when using CMKs, so no Data Keys, no envelop encryption, does the encryption take place in the ...
0
votes
1answer
54 views
Updating Sender-Keys and Key-Management
This question is related to an earlier question I had:
Encryption on Mobile Devices - Multiparty Encryption - Key Management
My situation: I have many mobile devices that want to send sensitive ...
3
votes
2answers
101 views
What is the best strategy for handling a compromised private key within the domain of firmware?
I have a firmware project that uses asymmetric cryptography for assuring integrity and authority of updates. The private key is stored within the company, and the public key is on the firmware to ...
0
votes
0answers
38 views
Server application to hold PGP private keys and decrypt as requested
I don't know if what I'm talking about exists, or if the concept doesn't make any sense, or even if it's just a stupid question. I'm developing a small integration for our business which receives ...
0
votes
1answer
53 views
Are all web servers for a domain wildcard certificate supposed to have the same private key?
If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
1
vote
0answers
33 views
Open source KMIP Server in a production-level environment [closed]
I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
0
votes
0answers
48 views
How do you generate a RSA private key that is BER encoded with OpenSSL?
According to the Linux Kernel's Asymmetric Cipher API found at the following URL: https://www.kernel.org/doc/html/latest/crypto/api-akcipher.html#asymmetric-cipher-api, you must pass a BER encoded ...
0
votes
0answers
41 views
Public blockchain, encrypted blocks with access list; Key revocation; Is it a fit for attribute based cryptography?
I've got the requirement to put the company data onto blockchain for traceability and auditability.
Some of that data is public, whilst some of this data is confidential to 1+ (could be many) user ...
2
votes
3answers
162 views
In PGP how can I be sure about the public key?
I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
2
votes
2answers
95 views
Is it a good idea to use asymmetric encryption for a chat application?
I am reading design documents of an internal Whats-app like chat application.
Developers are planning to use asymmetric encryption to encrypt all messages.
Every user will have a public/private key ...
1
vote
1answer
60 views
Does encapsulation of encryption within a library provide some kind of additional security?
Lets say there is an industrial device communicating with a central system. Secure communication is required from an end to end point of view. From time to time keys of the devices must be renewed by ...
0
votes
0answers
31 views
How Cloudera Key Trustee Servers are caching Master Keys from HSM
We are building Cloudera platform with Encryption at rest for HDFS. We plan to use HSMs for key management. To lower the load we can generate on HSMs we will be using KeyTrustee servers to cache ...
0
votes
1answer
115 views
Can AWS KMS be used for both KEK and DEK for PCI DSS?
Right now we're using our own built-in solution based on SSS, and we want to switch to KMS.
How far can we go? Can we use AWS' KMS for both the KEK and the DEK?
1
vote
1answer
78 views
Android key protection
I was reading this documentation and saw this part;
When an application performs cryptographic operations using an Android Keystore key, behind the scenes plaintext, ciphertext, and messages to be ...
0
votes
2answers
125 views
What is Cloud KMS? What's it's purpose/benefit of KMS? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)
What is Cloud KMS? What's it's purpose/benefit of KMS? Is there a concrete example of a problem I solve using it? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)
Whenever I've ...
0
votes
0answers
52 views
How does Google restrict API access by mobile App ID?
Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers.
How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
0
votes
2answers
155 views
Understanding AES Keys and Passphrases
I am trying to get my head around how AES works and in particular I have queries around the key generation and 'passphrases'.
My understanding is that AES has a 128 bit block size but the key length ...
0
votes
0answers
54 views
Where/How are SNMP v3 passwords stored on the agent?
Security wise, SNMP v3 improves over v2 by using users for polling agents or agents sending trap data to the management system. But what if the agent is compromised? Will the attacker be able to get ...
2
votes
0answers
74 views
Storing users' private keys to clone git repositories on their behalf
Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
0
votes
1answer
78 views
Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it
The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
1
vote
1answer
128 views
Is it secure to store a cryptographic key in a class member variable?
Consider an application that runs locally on a Windows PC. The application uses a local folder for reading/storing encrypted data (i.e. images). A user logs in (authenticated from a local encrypted DB)...
0
votes
1answer
70 views
Storing server-side secret key in environment variable - is a concern?
Is it a security concern to store server-side key in plaintext in environment variables? And specifically with PHP, would I be safe by not calling phpinfo() or other kind of dumper?
1
vote
0answers
67 views
HSM best practice for access
I've been building a product using AWS CloudHSM and things are working well in the POC.
Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
0
votes
0answers
34 views
Store secret for HS256 (JWT) in repository?
For JWT generation in my Java application I need to use the secret. Thus, I need to include this along with other source code into repository, which is a no-no.
So how can I store the secret in ...
0
votes
0answers
43 views
Android keystore and accessing keys
I'm reading this documentation on how to use Android keystore. There're couple of points I don't quite understand.
First of all, in the docs, it says;
Key material never enters the application ...
0
votes
1answer
69 views
Key penetration from guest OS directly to hard drive
Most of the key protections are used to encrypt key to protect it from malware or other tenants. What if the hypervisor "steals" my key?
If I am using a VM provided by a CSP, when I input a key to ...
-1
votes
1answer
66 views
How can I mitigate the possibility of SSL private key being copied without my knowledge?
OCSP stapling and Certificate Transparency logs seem to provide a pretty good defense against man-in-the-middle attacks if I discover that my private key has been stolen. I can revoke my old ...
1
vote
0answers
148 views
Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey
I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
0
votes
1answer
59 views
Is it a bad idea to share a private key generated from a self-signed root CA?
Pardon if this is a noob question. I'm writing an authorization function to determine if a REST API request should be allowed to proceed or not. It is using a standard JWT passed in the Authorization: ...
1
vote
0answers
40 views
Make key trusted in Enigmail?
I have tried to import a public key of someone into enigmail. The import failed silently (nothing absolutely happened, not even an error). I tried key from file and from clipboard.
Then I used gpg --...
0
votes
2answers
107 views
What factors should I consider when choosing the key for encryption and decryption?
We have an application that uses cookies to transmit employee personal data over from the front end to the server. We have planned to use TLS 1.2 for the encryption in transit. However once the java ...
0
votes
1answer
55 views
How can we be assure that people with read access to keys, can not also read the ciphertext and vice versa?
We have this segregation of duties requirement and don't understand it fully. Is it not always possible, that an employee who is generating keys can also get access to the encrypted messages?
0
votes
0answers
115 views
Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?
Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys
Mallory ensures that Bob uses her keyserver, which offers her own key, which
is sharing the 32-bit "short" Key ...
0
votes
0answers
185 views
CVV/CVC code algorithm [duplicate]
I'm looking for a definition of algorithm how to calculate CVV/CVC codes?
I know that there are the following inputs:
PAN Expiration
Date
Service Code
CVK A/B
But I'm not able to find the specific ...
7
votes
1answer
382 views
Preparing to change over to new GPG-key - what to do with my old ones?
I've just created a new off-line GPG-key with a sign/certify master-key and two sub-keys - one for signing and one for encrypting. 5 yr expiration for the master, 2 yr for the subs. My master-key got ...
0
votes
0answers
27 views
Know the setting used in creating key pair in GNUPG4Win version 3.15
I am using GNUpg4Win version 3.15. For the last few hours I am trying to figure out what default settings are used for Cipher and Hash during key generation.
Basically I want to use AES-128, 3DES ...
0
votes
0answers
243 views
How to securely store private keys in the DB?
I am implementing a web application that deals with signing blockchain transactions similar to what all cryptocurrency stock exchange applications are doing.
I am wondering how do they store private ...
-1
votes
1answer
63 views
How does key exchange work? Using symmetric algorithm such as AES
I was wondering how does the sender give the encrypted file and the key to the receiver securely? Particularly on situations where the sender doesnt meet with the receiver (through email or through ...
1
vote
1answer
76 views
Security implications of exposing payment gateway secret API key
Introduction
In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow:
POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL.
...
2
votes
1answer
224 views
One GPG key with multiple user identities for my career?
I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs.
My understanding is that there are two ways this could be done:
Have one main/master GPG ...
4
votes
1answer
186 views
If my private key is password protected, then how is it used without asking me for it?
Relating to TLS and SSH. If my private key is password / passphrase protected, how is this then used automatically during TLS or SSH communication without asking me for the password?
1
vote
0answers
35 views
Sharing individually encrypted elements between users of a system
I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file.
For simplicity, lets say the unique keys are the file names.
I'd ...
3
votes
1answer
108 views
Why are passphrases protecting GPG / SSH private keys needed? [duplicate]
SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed ...
1
vote
2answers
81 views
Possible to get sshd (openssh) to log the public key of failed key based login attempts?
As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key.
What I'm looking for is ...
