Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
0
votes
0answers
18 views
Creating a JAVA Keystore (.jck) with a Symmetric Key [migrated]
I have a need to use a common key on 2 platforms.
The key was created on Linux. It was wrapped and sent to platform 1, where it was added to the local keystore. I need to create the .jck there on ...
1
vote
1answer
61 views
Storing RSA private/public key pairs in a file, on linux
Would it be wise to:
Generate a lot of priv./pub. key pairs, and store them in a file on the server machine(Linux). (Let's say in a companies server room)
Then encrypt the file with AES, and store ...
2
votes
1answer
27 views
OpenVPN client can still connect to the server after client's tls-auth key has changed
I'm currently getting familiar with OpenVPN by building and testing some client–server infrastructure using VMware workstation.
This is what I've recently noticed: if you manually change some values ...
0
votes
0answers
17 views
Security Appliance Key Generation
For devices like decrypting HTTPS proxies, there is often a built-in mechanism for generating a key-pair and CSR. An admin can then have their in-house authority sign the CSR with a subordinate CA ...
1
vote
0answers
32 views
What is this key management scheme called
We are building a system, where the messages between services is encrypted with Data Encryption Key (DEK).
The DEK is attached to the message, but encrypted with another key, Key Encryption Key (KEK)....
2
votes
1answer
59 views
How to properly manage encryption key
To encrypt the database in the organization, I think it is better to use symmetric key encryption.
According to what I've researched from NIST paper.
Cryptoperiod: The originator-usage period ...
1
vote
0answers
23 views
What measures are used to protect private keys on credit card processing devices?
For example, a device that accepts credit card payment to update a store card. These are usually embedded devices with a hard drive for permanent storage. Would it not be possible for a hacker to ...
-1
votes
0answers
67 views
Is it best practice to store customer keys in S3 buckets?
Suppose my customers are storing their Dropbox app key and secret key with me.
I am planning to store those keys in Amazon S3 buckets e.g.:
/customerA/dropbox.txt
/customerB/dropbox.txt
/customerC/...
0
votes
1answer
78 views
Checking if an RSA private key is passphrase protected
I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase.
Note that the problem is not that I forgot the passphrase, but ...
0
votes
0answers
47 views
Multiple PGP key practices for code signing, GitHub, and email
I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is:
Have I overlooked something important that ...
1
vote
2answers
63 views
Should the client or the server generate the client's public-private key pair?
Say I have a mobile messaging app. There is a central server that manages stuff (like a directory of users, onboarding, etc.) and there are all the clients.
My app is professional, so it uses ...
-2
votes
1answer
65 views
Does a private key file created with a passphrase need to be decrypted before use
Let's say that I have created a private key file with some passphrase in ssh-keygen. Now someone sends me a message encrypted with my public key. To decrypt the message I need a private key.
Do I ...
1
vote
1answer
94 views
Hash a secret API key with a random salt instead of sending sending it alone in REST API
Say, I have an internal https API endpoint used only by me being the admin.
In each each request I send a secret API key for authentication. And I'm fine with this solution.
curl -x PUT .......
-...
2
votes
1answer
60 views
Why do people check the passport on key signing events?
I find the common procedure of key signing parties a little awkward:
Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
2
votes
2answers
131 views
Why is an HSM required to protect CA certificates (rather than a regular USB token)?
Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on.
The same vendors also offer distinct products called HSMs (...
3
votes
4answers
961 views
Securing hashes of short enumerated values
The system manages and stores sensitive data of short strings.
Because the sensitive data is of an enumerated type with limited set of well known values, the attacker could easily iterate all the ...
1
vote
1answer
30 views
Safely connect to remote site from cloud based code
I am connecting my computer located at my home to a remote server.
To communicate with the server, I use a config file that contains my private and public keys and a passphrase. My code reads the ...
1
vote
1answer
104 views
how to save RSA keys in a software?
I am working on a non-professional piece of software that is required to generate and store RSA keys (public and private). The generated keys will be used to encrypt communication across the Internet. ...
0
votes
0answers
50 views
What is the best way to access/interact with the code signing server from build server (Jenkins) to sign the binaries in automated way
we have a dedicated build (Jenkins based )server and code signing server,
As part of the post build process,build script access the signing server and perform the code signing.
Is there any way to ...
3
votes
3answers
147 views
Using a windows partition as a decoy
I'm interested in setting up a laptop that dual boots Windows 7 and openSUSE. The plan is to encrypt the openSUSE partition and require a USB thumb drive with the encryption key for it to boot. Where ...
2
votes
3answers
87 views
How to manage PGP private keys?
I am trying to find out a way to protect files that will be stored on a drive accessible to the public. Using permissions is not an option in this case, so I am planning to encrypt the files using PGP ...
3
votes
1answer
99 views
Secure high-portability way to store passwords?
I'm developing a cross-platform Java desktop application which uses a password to derive a cryptographic key. I'd like to add a "Remember me" feature that stores this cryptographic key on the hard ...
2
votes
1answer
139 views
How to store secret key used for hashing?
I am trying to figure out a secure way to store secret keys used in the hashing of social security numbers.
The idea is for de-identification of research subjects yet still permitting follow-ups ...
2
votes
2answers
44 views
What format is an decrypted RSA private key in, specifically in OS X Keychain?
I was trying to extract an un-exportable key from OS X Keychain. I used this tool to extract the key. The tool gives me a hexdump of the private key. An RSA 2048 bit key came out to be 2441 bits, ...
1
vote
1answer
98 views
Windows PFX certificate import: protect private key using virtualization-based security?
On Windows 10 v1803 (i.e. April 2018 update) when importing a PFX, an option like
[ ] Protect private key using virtualization-based security (non-exportable)
appears on the import wizard. What is ...
7
votes
1answer
178 views
How to store nonce and key when working with libsodium secretbox?
Why am I asking?
I am very new to cryptography (so please be patient with me...) and I want to avoid making unnecessary mistakes. I did a lot of research, but - other than with most other programming ...
2
votes
1answer
44 views
Encryption Engine vs Key Server
What is the difference (if any) between a Key Server and an Encryption Engine?
Is a Key Server also the same as a Key Manager?
I've seen the terms Encryption Engine, Key Server and Key Manager used ...
2
votes
1answer
80 views
Secure Key Storage
We have a security solution that is deployed on premise to companies with big technical infrastructures. We do real time vulnerability/configuration assessment of all critical assets in the network.
...
1
vote
0answers
39 views
Do secure elements with microSD interface exist? [closed]
I would like to add a secure element to an embedded system so that I can safely store keys. The system has an unused microSD slot.
I know that in the past it was possible to use SD cards with SDIO to ...
0
votes
0answers
58 views
Let user run binary that reads private key but not read key
I'm running Ubuntu on an embedded device. There is a binary that uses a secret key in a separate file. I want to give some users restricted permissions so that they can run the binary, and have it use ...
0
votes
2answers
94 views
Cryptography in simple words anout one idea?
I'm a student and have one challenge about cryptography. I need clear definition or simple definition to better understand cryptography and related security. I’ve been reading lots of material, seeing ...
1
vote
0answers
44 views
Review: Security model for sync service [closed]
I am working on a sync service for my desktop app. The app tracks (with the user's consent) some computer usage data (comparable in terms of sensitivity to their browser history), so I'd like for this ...
1
vote
0answers
40 views
Password protected secrets on Vault
We're currently improving our custom secrets management system and I'm looking into different solutions such as Hashicorp Vault or AWS KMS.
So far Vault seems to meet most of our current requirements,...
1
vote
0answers
51 views
Android Secure Keystore pre-API 19
Is there any secure Keystore for Android other than Android Keystore?
If an attacker used an emulator, saving a key in SharedPreferences or storage is pretty much useless since she'll have direct ...
3
votes
1answer
118 views
Signing/certifying keys as a YubiKey user
After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys.
I was surprised to learn that one can only sign keys using ...
4
votes
1answer
140 views
TLS private key storage for embedded systems. Are there any best practices?
I am looking for best practices regarding TLS private key storage for small single chip embedded systems, such as Cortex-M MCUs, with monolithic firmware stored in internal flash. Most recommendations ...
5
votes
4answers
769 views
Usage of Android Keystore
I'm using the Android Keystore to store an asymmetric cryptographic (to decrypt a file containing an asymmetric key). I did that because I want to encrypt a large set of data and an asymmetric isn't ...
4
votes
2answers
108 views
How can I improve security in a production environment?
I'm setting up a system where devices are going to be tested right after production. Each device has an individually given AES-key, which must be known in order to communicate. Those individual keys ...
0
votes
2answers
217 views
Safe place for private-public ssh key pairs
Where can I store my private-public ssh key?
I would like to keep these files somewhere safe, and also I would probably need to keep them updated from time to time. Is it a good idea to keep it in a ...
1
vote
0answers
69 views
SSL handshake failure with EC keys but not with RSA keys [closed]
We have been issued a EV certificate. The private key we used in the CSR is a EC key based on prime256v1. It was generated using the following command:
openssl ecparam -genkey -name prime256v1 -out ...
1
vote
0answers
68 views
Best way to store AES keys (web api) while dealing with multi tenants (key per tenant)
I have some data to encrypt on my database and every tenant will have his own database so surely every tenant will have a different key.
I'm searching for the best way to store the key for every ...
4
votes
0answers
102 views
Encryption data keys in single file at same location
I have an external storage which I am wanting to store encrypted files.
Strategy #1:
Each file and folder name is AES encrypted with its own data key
All data keys are saved into a single datakeys....
1
vote
0answers
61 views
Is it safe to retrieve GnuPG public/secret key with fs in Node.js?
So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
3
votes
2answers
78 views
How do we change the public key in our commercial app?
We have a commercial library that uses a public key to sign an XML request that goes up to our license server. The response that comes back is XML that has been signed with our private key, and the ...
1
vote
3answers
56 views
Protecting a private key on Azure
Is there a way on Azure to protect a private key so only I have the key? No one else can get the key?
I understand that this might be impossible as the code we have on Azure needs the key to validate ...
2
votes
2answers
121 views
Is it safe to publicly expose key hashes?
I have a simple API which I want to limit users using a key. For each request, the users will need to post the key and the other parameters.
For example in R:
res <- httr::POST(
"api-url",
...
3
votes
6answers
243 views
Good way to protect lots of private keys
I'm working on a software which deals with lots (several millions) of RSA private keys. Keysize is 2048, I'm going to store them in database in PEM format.
I want keys to be encrypted to mitigate ...
3
votes
2answers
1k views
Do I need to hash or encrypt API keys before storing them in a database?
I'm securing API calls to a REST service I'm building using API Keys. The plan is to:
When we get a new client, generate an API Key (a UUID).
Email the API key to them.
They send the API key on every ...
1
vote
1answer
316 views
How to generate pfx file from private public key?
On my domain name (mydomain.org), I send mails from applications. Some of these applications are on Windows and other on Linux. I use opendkim for Linux and I have also set dns and everything it ...
1
vote
1answer
171 views
Cracking RSA keys, only given N and e
Is it possible to crack RSA keys when only given N and e? If so, is there a limit to how long N or e can be? How do you go about doing that?
In the specific scenario I'm researching, N is about 150 ...
