Questions tagged [key-management]

Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

Filter by
Sorted by
Tagged with
5
votes
3answers
601 views

Hierarchical Key Rotation. Should I rotate the lowest level keys?

I have a hierarchical key system designed for my project. In this system a block of data is encrypted using a Data Encryption Key (DEK). This DEK is encrypted using a Key Encryption Key (KEK) which is ...
0
votes
1answer
95 views

It's secure to store private keys in AWS Secret Manager?

I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
2
votes
1answer
80 views

How can Bitwarden claim it cannot access your passwords if the vault password is the same as the web account password?

Bitwarden claims that it is more secure than traditional cloud password managers (such as Google) as it only stores the encrypted version of the passwords database. But for some reason the password ...
0
votes
0answers
25 views

Seamless Key Management with Key Management Systems?

I'm keeping it vague on purpose so that it can help other cases as well. Goal The goal is to store information that is encrypted on client side and then delivered to the database. Server should never ...
0
votes
0answers
36 views

KMS Key Exposure

I've found some KMS key exposed in some code and am wondering what exactly the severity would be. What could an attacker achieve by having this key?
1
vote
0answers
57 views

Is it ok to store my Android app keystore password in a text file on my disk?

I am reading on how to sign and publish my flutter app on android. When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
0
votes
1answer
70 views

if computer is compromised, does hardware key still protect in ssh?

Let's say I sign into my local pc with a hardware key (eg yubicon). Let's say I further sign into a sensitive server (as root) via ssh using yubicon hardware key as well (ie only way to get into ...
0
votes
1answer
49 views

Information disclosure via ktpass tool

The Microsoft ktpass tool can be used to generate a .keytab file that contains a secret key. I'd like to understand the output of the tool. An example output can be found here. I'm interested in the ...
1
vote
0answers
30 views

Securing API keys for accessing Google APIs via Front End (UI)

This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below. We currently have hybrid ...
0
votes
1answer
74 views

Most secure way to store a cryptographic key for encrypting/decrypting stored application data

I would like to encrypt some of my application data stored on a MySQL DB using AES-128. I wonder thus what is the best way to store my key on the webserver. Should I encrypt the key itself or store it ...
0
votes
2answers
100 views

How safe is XOR with multiple preprinted stainless steel key tags purchased from different channel?

This is related to https://crypto.stackexchange.com/questions/48622/how-safe-is-xor-with-multiple-independent-but-non-random-keys but not exactly the same question. Let's say there are three different ...
0
votes
1answer
32 views

Azure Ad B2C Users access resources in other directory

I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
1
vote
0answers
32 views

Reusing content-encryption key in cms enveloped data

OpenSSL keeps the structure CMS_ContentInfo opaque and in the case of enveloped data generates and manages the content-encryption key completely by itself. It is not possible to provide a content-...
-1
votes
1answer
57 views

How to secure the key in an offline package

I have a package to be shared to Bob which contains: an encrypted data.zip Application, which will have logic to decrypt the data Bob will run Application and it will decrypt the data.zip. Now for ...
0
votes
2answers
78 views

pgp public key failed to propogate

I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key ...
2
votes
1answer
71 views

Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?

I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
1
vote
1answer
126 views

Is this a good way to manage encryption keys?

I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything from a leave of absence form to potentially confidential agreements. Being ...
1
vote
1answer
68 views

use custom 'key' for hardware security keys

Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
0
votes
1answer
126 views

Which would be the best “keyfile” for KeepassXC and/or Veracrypt?

I am a Mac user. I opened a keyfile generated by Veracrypt and one generated by KeepassXC. The texts in both of them were quite short. Which keyfile is best (i.e., most random and harder to break ...
0
votes
0answers
38 views

Handling API keys for client-side app with cloud key vault

I would like to hear about the security implications of my desktop app's current API usage workflow: Client-side WPF desktop app connects to Azure Key Vault, a cloud vault, by authenticating via a ...
1
vote
1answer
106 views

Web developer needs customer's private key

As a non security expert, I'm looking for advice from those who are. I work with company X who have hired company Y to develop their website. Company Y needs to integrate server-side online payment ...
0
votes
1answer
72 views

What's a secure way to generate a keypair from a secret password?

I like to generate a public-private key pair that is seeded from a string. So having the string and the generation algorithm is enough to recreate the keys. I want to do this because I can then ...
1
vote
1answer
61 views

Subkey rotation and revocation

If I decided today get new subkeys because I simply want to rotate them or because they are about to expire, do I have to sign all keys of other people I signed with my old signing key again? And if I ...
2
votes
0answers
90 views

What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?

My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home. Since the laptop uses BitLocker ...
0
votes
0answers
131 views

Why do I need --batch to import a secret key from a pipe?

Once I used this guide to transfer my secret key to my smartphone, so today I did the same thing for transfering the secret key from my workstation to my laptop. Yes, I could have used a USB key, or I ...
1
vote
1answer
121 views

An intranet web app for decrypting values : a bad idea, and if so, why?

We have to protect a database connection string for a .NET desktop application that has an application-level database user. One option is to encrypt a section of the app.config using asp_regiis. But ...
0
votes
0answers
31 views

GPG Questions About Exporting Subkeys to File

GPG novice here so please bear with me. From what I understand, when you generate a keypair with GPG it will automatically create a subkey pair (sub, ssb). If I wanted to give these to another party ...
1
vote
2answers
85 views

How to devise cryptographic system with sharing ability

I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
0
votes
0answers
155 views

Should Group Key Update Interval be Off or On?

My router has this option and I was wondering if it should be turned off or on for better security? If it is better security to leave it on what is the best interval for maximum security?
3
votes
3answers
135 views

Drawback of Multi Level Encryption

I am backing up my files to a RAID mirrored HDD, that has full disk encryption (FDE) in place with LUKS. Until now I did this with rsync, but I recently switched to a new backup program that does file ...
1
vote
1answer
35 views

Storing private keys for updates to remote device

I'm reading up on how to perform signed updates for remote hardware devices. I need to check if the new software has been generated by a "trusted" source, ie me. Based on my understanding of ...
1
vote
1answer
59 views

Can I copy a PGP revocation to another server?

I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
4
votes
2answers
140 views

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

I implemented this kind of authentication for my REST API, is this secure and is my logic sound? I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
9
votes
8answers
6k views

Can a large corporation make a believable promise

Say there is a secret encryption key that a third party has to handle. The third party is supposed to destroy the secret key when they are done, and tell everyone else it was destroyed and therefore ...
3
votes
4answers
186 views

Methods for backing up key on paper

What are the methods to backup a key to paper? The idea is to have reasonable protection and the ability to restore the key in case of the digital backup is lost. Are there things that convert a ...
0
votes
0answers
51 views

Password Vault Storing Passwords

I've been working on just a fun side project in C++ to practice encryption algorithms and I sort of ran into a bit of a roadblock of sorts. To summarize the project I have a text file of encrypted ...
0
votes
0answers
62 views

SSL/TLS communication in connected embedded (IoT) device

while establishing the SSL/TLS based communication in an embedded device, is it necessary that device needs to acquire the keys/certificates from a CA? I read that there is also provision for device ...
4
votes
2answers
204 views

What is the difference between the many identifiers in GnuPG?

GnuPG seems to have number of different ways to refer to a (sub)key(pair): Key IDs Fingerprints Keygrips Additionally, gpg --list-sigs seems to show hexadecimal identifiers for signatures and such ...
1
vote
0answers
61 views

Is this reasonable privacy for storing sensitive information?

Outline I am writing a web app that will need to store some transaction data (amount, date, merchant...). Objective I want to keep this data reasonably private from unwelcome eyes. Threat Model ...
0
votes
0answers
63 views

How to facilitate secure chats between users

My company runs a chat room service where the users can securely send messages to one another. All users are authenticated by the service in advance, and will install software from the service onto ...
0
votes
1answer
45 views

Is HMAC really a benefit for AES-CBC?

I think I quite well understand the theoretical benefit of adding the HMAC (authenticity/integrity on top of confidentiality), but I am looking at this from a key management point-of-view. Premise: ...
1
vote
1answer
34 views

Single key pairs for SFTP

I have a single machine (client) and several servers and I need to take from them several files through sftp. My idea is to generate a pair of public and private keys in the client, and copy the ...
1
vote
1answer
70 views

Does a revocation certificate leak information about the private key?

Kleopatra/ GPG can create revocation certificates, which look a lot like public/private keys. Obviously, these keys should not be shared or used unless one intends to revoke their keys. But assume ...
2
votes
0answers
74 views

Security of Microsoft key container

How is the security of cryptographic keys stored by Microsoft Windows in the key containers used by CryptoAPI/CNG guaranteed? The keys are stored in the user's directory or a directory for the machine-...
1
vote
0answers
198 views

How does WhatsApp retain private key? [duplicate]

Does anyone know how does WhatsApp retain private key? Based on what I know it looks like private keys are stored on the device. What happens when someone changes their device? How does the private ...
0
votes
1answer
93 views

Cloud provider or self-hosted for key-storage?

I was reading this question: Where do you store your personal private GPG key? I have my set up as noted in this comment: Where do you store your personal private GPG key? But instead of using a ...
4
votes
3answers
535 views

Is it more secure to encrypt separate customers' data with separate keys?

If I am storing multiple customers' data in cloud-based file storage such as an AWS S3 bucket, and I use an encryption service such as AWS KMS to achieve encryption at rest, does it add any extra ...
1
vote
1answer
83 views

Implementing key vault and key rotation for a non-cloud application

I have a desktop application written in Python. The application is connects with an external SAP HANA service and pulls data. There are couple of configuration files where several connection string ...
9
votes
1answer
2k views

OpenSSH declares ssh-rsa deprecated. What do I do next?

With the 8.2 release of OpenSSH, they have declared that ssh-rsa for SHA-1 will soon be removed from the defaults: Future deprecation notice It is now possible[1] to perform chosen-prefix ...
0
votes
0answers
43 views

Establish a symmetric key: KDF based on shared secret and random salt or key wrapping?

I am designing a basic KMS based on a simple HSM, I only have access to: AES256, SHA256, PBKDF2, HMAC (and combinations like AES256-HMAC-SHA256). The admin and the users of the system have a personal ...

1
2 3 4 5
16