Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
824
questions
0
votes
0
answers
16
views
Key distribution protocol involves only 2 parties, given E[k1,E(k2,m)]=E[k2, E(k1, m)] [migrated]
Given an one-key cipher such that:
E[k1,E(k2,m)]=E[k2, E(k1, m)]
Is there any key distribution protocol that involves only two parties (Alice and Bob) without the key distribution center?
The protocol ...
- 1
1
vote
1
answer
25
views
Export ECDSA certificate from Windows Store
I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
- 61
0
votes
0
answers
32
views
How to securely transfer the privatekey and pass it to wireguard in a memory safe manner?
Suppose I have a game server with only the wireguard port open, the client request wireguard configuration from a HTTPS server. And use the obtained configuration in a modified wireguard. The ...
- 101
1
vote
0
answers
16
views
SIM hardware protection of master and long lived keys
4G and 5G authentication procedures includes master keys or long term keys which are shared between subscribers and Home Networks, for 4G they are called Ki.
A case was reported here in which NSA ...
Pietro
0
votes
0
answers
22
views
How can a client safely post/get a (symmetric) client key to/from a key distribution center?
If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
0
votes
0
answers
13
views
Import BDK encrypted under the Transport Key KEK on HSM
I received a two-component KEK TDES key and a BDK cryptogram, which is encrypted for this KEK.
Do you have any suggestions on how to load such a key into the HSM device? Eg. Luna HSM
0
votes
1
answer
52
views
How to preserve key in TPM 2.0
I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
0
votes
0
answers
45
views
Alternative to AWS CloudHSM?
I am not using AWS, google cloud or similar. I have a vps on another webhosting service.
I am going to encrypt my data but don’t know where the best place to save the encryption keys would be?
I can ...
- 131
1
vote
1
answer
34
views
Best and safest way to store secret key used for PKA on server?
I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example:
Create a 0500 access directory on my server
...
- 115
1
vote
1
answer
135
views
Why should encryption key be rotated after it has been used to encrypt a specific amount of data?
I'm going through OWASP Cryptographic Storage Cheat Sheet and it says:
Encryption keys should be changed (or rotated) based on a number of different criteria: (...) After the key has been used to ...
- 155
1
vote
0
answers
49
views
Storing AES key for later usage
I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
0
votes
1
answer
84
views
Can an encrypted RSA key be committed to git?
I have a pair of RSA keys where the private key is encrypted with a passphrase. Would it be a security risk if the public and private keys are committed to version control without any further ...
1
vote
0
answers
29
views
Uses for TR-31 Key Version Number?
The standard for TR-31 (and Thales) Key blocks (ref) have a field for "Key Version Number", which is only defined in the spec as
Two-digit ASCII character version number,
optionally used to ...
- 1,446
0
votes
0
answers
23
views
Is it possible to configure Github to allow writes to a particular repo/organisation, only from a particular SSH key?
It's not uncommon for an organization to allow developers to use their personal Github to do their work.
A potential problem I see with this, is that the organization doesn't have control over that ...
- 707
0
votes
0
answers
45
views
Is it possible to regenerate the stub private key from just the physical key in OpenSSH?
Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key.
If I lose ...
- 101
0
votes
0
answers
42
views
Validate the conformance of an OpenSSL created certificate with FIPs standards
Trying to test the conformance of the certificates inside our application, with the below requirement:
The application shall [selection: invoke platform-provided
functionality, implement ...
- 109
0
votes
1
answer
69
views
How to manage a users private key in a secure document storage solution?
I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
- 101
1
vote
1
answer
198
views
Key management for End-to-end encryption for Chat application
I want to implement end-to-end encryption on my chat application (available on android, iOS and web). For that I've following mechanism in mind.
Generate Key pairs (Private key and Public key) on ...
- 111
1
vote
1
answer
139
views
Does Re-Encryption make our data more secure?
We are focusing on mobile phone and hard drive encryptions. This idea can be extended to any data encryption also.
iPhone and recent Androids are all encrypted. We know that changing the password will ...
- 111
0
votes
0
answers
61
views
Strange keystore from payment processor
I am working on an older software for a company at the moment and in my work have been upgrading a number of libraries. The app connects to a web service hosted by the third party payment processor, ...
- 1,082
4
votes
1
answer
99
views
Is it possible to use HKDF in the TPM?
Is it possible to use HKDF in the TPM? My goal is to load in a master symmetric key and derive keys from that using HKDF. I see there are other KDF functions available, but no mention of HKDF.
- 43
0
votes
0
answers
137
views
Almost unattended generation of "a pretty good keypair"
I need to generate quite a lot of gpg-keys for different tasks on my Debian Bullseye (Stable) machine. Also I want the highest level of security while being able to automate as much as possible.
...
- 11
6
votes
1
answer
367
views
How are the PGP keys that Thunderbird 78+ uses encrypted?
With Thunderbird 78, a new PGP subsystem has been introduced which handles PGP keys internally. In previous versions, the add-on Enigmail has handled PGP-related stuff, by letting do GnuPG the work ...
- 547
3
votes
0
answers
129
views
Move signing subkey to authentication slot on YubiKey (OpenPGP card)?
My PGP primary key is only used for certification—I use a separate subkey for signing. Like this:
sec rsa4096/0x891781D0EDC66456 ...
- 376
1
vote
2
answers
131
views
How to manage Encryption Key for Server Side Encryption in AWS S3
I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows:
All the existing data ...
- 11
0
votes
0
answers
86
views
Why does KMIP require to request two keys for AES-XTS?
According to KMIP user’s guide, when a client application desires to retrieve a 512 bits AES-XTS key, it should request 2 separate KMIP keys of 256 bits each. This is to support the structure of an ...
- 21
1
vote
0
answers
209
views
AWS KMS CMK compromise
Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
- 662
0
votes
1
answer
118
views
Is there an encryption mechanism for binary data with expiration for rotating keys?
We have a web server with an application - there is a large data array attached to the application via a mount point. We have to fulfill the requirement of securing in-transit data and at-rest data. ...
- 101
0
votes
0
answers
116
views
Nitro Enclave / KMS Equivalent for Google and Azure
In AWS KMS I can set a key policy on a CMK so that it can only be used from within a Nitro Enclave that either has a particular signature or a particular image hash. Is there something similar to this ...
- 215
1
vote
1
answer
119
views
Is there any standard or protocol of key exchange between multiple nodes?
A little context: I'm working in designing a system to sign and verify data sent between modules of a bigger system. Currently the system has two parts, a central application and a SDK inside modules ...
- 11
0
votes
1
answer
122
views
E2E-Encrypted storage: What to do when the lifetime of a key is over?
When using AES-GCM-256 with random nonces, a limit of 2^32 encryptions is specified in order to have a low nonce collision probability. A new key has to be generated to take its place afterwards, I am ...
- 695
20
votes
3
answers
6k
views
Not understanding why I should use public/private key encryption over password?
My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue.
Now ...
0
votes
1
answer
109
views
I want my customers to download the encrypted video file to a secured usb and play it directly in TV by providing unique key which i shared to them
How do I make sure that this content is not hacked by anyone ?
Do I encrypt every file and store the key before my customers download their unique copy?
0
votes
0
answers
19
views
Is there hardware (like u2f-keys) for passwordless client-side encryption & decryption [duplicate]
I know that u2f keys are designed as authentication factors, but I think it would not be far fetched to also add a protocol that the user can use to encrypt or decrypt data on the client-side. This ...
- 695
2
votes
2
answers
767
views
How to get PGP key passphrase out of Thunderbird?
I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it ...
0
votes
1
answer
107
views
How to securely encrypt shared data for a dynamic amount of users?
Example:
Bob uploads a file to my custom file server locked with a password, which then the file server generates a link for him to share
Bob wants to be able to share this data to anyone that has ...
0
votes
1
answer
114
views
Storing client keys in cloud app
I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, ...
1
vote
1
answer
471
views
How to get Future Keys (Session Key) from IPEK for decryption data?
I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal.
So far, when I receive KSN and encrypted data, I understand that I ...
0
votes
1
answer
345
views
Where is the PDF encryption key stored
Assuming you have the user protected PDF file. Using the password, the cryptographic key is generated and the file encrypted. Where is the key stored, is it on the RAM every time the file is opened?
2
votes
1
answer
307
views
How does a Certificate get associated to the private key pair? [duplicate]
I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
- 121
3
votes
1
answer
411
views
How can I store and manage my GPG key pair securely?
I've taken measures and thoughts on how to securely store and manage my key pair. In the process of it a few questions arose, which I'm not capable of answering yet. My key pair will be used to ...
- 33
1
vote
0
answers
147
views
Windows X.509 certificate private keys lost
Have the same certificates installed on several machines, but this happens on only one of them.
The certificates are self-signed certificates.
The certificates are used for WCF message security.
...
- 135
0
votes
2
answers
364
views
Storing a key in a symmetric encryption for password manager using cryptography module
I am making a password manager and generator. The user creates the login information, and then I hash their password. After that, I generate the password and encrypt the password with a key stored ...
2
votes
1
answer
232
views
ssh-keygen: How to guarantee the uniqueness of serial numbers?
(FYI: I'm using Ubuntu 18.04 Desktop although I don't think my question is platform-dependent.)
I read the article Scalable and secure access with SSH and it says:
... if you want to use revocation ...
- 121
1
vote
0
answers
85
views
Browser session storage
Is it some secure way to store private keys in session storage? or is there any place to store that info securely?
- 111
1
vote
1
answer
204
views
Key pairs extension / version
I read in some docs, there are several version of GPG key extension available.
For ex: gpg, ascii, p12
I know .gpg extension is in binary, and Ascii is in text.
But I want to know their differences ...
- 13
2
votes
0
answers
163
views
Long-term symmetric key storage
I have some sensitive data that I need to encrypt and retain long-term (i.e., 5+ years at least). I'd ideally like to secure it using multiple hardware devices via a Shamir share. Something like:
...
- 123
8
votes
2
answers
2k
views
TPM or OpenSSL for key generation?
I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
- 103
2
votes
0
answers
198
views
How can I get `gpg` to sign with certain key again (end of file error)
Disclaimer: This is a cross-post after I initially was looking for help on the Gentoo forums since I suspected some major update of my Gentoo system to be the reason behind my problem.
However, since ...
- 121
1
vote
1
answer
100
views
Private keys with or without password for webservices?
What is the industry standard on this matter? How do you handle the keys for your websites, apis, micro-services, etc.
If I create private keys without password they will be 100% compromised if one ...
- 61