Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [key-management]

Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

Filter by
Sorted by
Tagged with
0 votes
0 answers
14 views

LKM key copy to new component [closed]

How we may copy the already loaded LMK from the HSM, because the 3 components previously copied are lost?
Defaru Afework's user avatar
0 votes
0 answers
62 views

How does ransomware store their decryption keys? [duplicate]

I've recently got into cyber security and really got into malware, more specifically, ransomware. While studying some of the strongest ransomware ever (example: WannaCrypt, CryptoLocker, etc...) I've ...
JoshuaKasa's user avatar
0 votes
1 answer
86 views

Unique SSH Keys With Identical Password?

I'm a one man shop. All I care about is having my workstations and server stolen. I plan on running a couple dozen VMs on my server, mostly Linux. Question is, obviously having unique passwords for ...
Xoteric's user avatar
0 votes
1 answer
74 views

Would there be any utility for multiple clients sharing the same TLS session key?

I was wondering if there is any utility for multiple hosts sharing the same TLS session key. I have come across proxies and the way they intercept TLS connections is to make the client accept its ...
imawful's user avatar
0 votes
0 answers
78 views

What are the effective open-source methods for storing and managing encryption keys in a language-agnostic manner when an HSM is unavailable?

When HSMs are not accessible, we often need alternative methods for securely storing and managing encryption keys What open-source options exist for effectively managing encryption keys in a language-...
SSpirate's user avatar
0 votes
0 answers
63 views

Rotate or replace EMV keys?

I would like to better understand the mechanism of rotation of EMV keys used for payment cards. Assuming that it intends to provide a rotation of the keys used for the production cards: just recycle ...
MaXbeMan's user avatar
1 vote
0 answers
115 views

How to safely use dm-crypt as overlayfs uper partition?

Context I'm working to make an embedded devices safe against physical access. (publicly accessible device and can be easily stolen) I already made the following action : secure boot is enabled on cpu,...
Anthony's user avatar
  • 111
2 votes
1 answer
195 views

API key embedded in clients: how to defend against over-usage?

I am new to client-side development and I have a naive question. Right now, I'm using Google APIs (the map ones). If I want my client-side application / webapp to display a map, I would include ...
Rififi's user avatar
  • 157
2 votes
2 answers
192 views

Full disk-encryption key vs password

I need to set up full disk encryption on my linux laptop. Questions: Does an encryption key on a USB pendrive protect against rubber-hose cryptanalysis? Is it true that the key on a pendrive is ...
whiteman808's user avatar
0 votes
0 answers
92 views

Stateless Key Management

I'm looking into the differences between stateful and stateless key management. I understand that stateful key management means that I have a database that tracks my keys, and can become very large. ...
Shane Quintard's user avatar
0 votes
1 answer
357 views

What does it mean to store secret keys as an "environment variable" as opposed to hardcoded in the source code?

I see why it is obviously bad to store a secret key and client ID in the source code for a web application. However, how do you go about the alternative? Surely, that information has to be stored ...
BigMistake's user avatar
0 votes
1 answer
257 views

How to avoid performance issues with envelope encryption when using separate DEK's for each piece of data?

Posted this first on stackoverflow but was suggested to repost it here. I am planning on using envelope encryption for data stored in a database in a multi-tenant solution. Envelope encryption suggest ...
user579089's user avatar
0 votes
1 answer
507 views

Consequences of stolen TLS private key

My understanding is that, when you connect to an HTTPS website, the communication is encrypted via asymmetric encryption, therefore private and public keys play a role there. My assumption there is ...
Tripola's user avatar
  • 103
0 votes
0 answers
156 views

What does an exported BitLocker key package contain?

I've learned that a key protector encrypts the VMK (volume master key), then the VMK encrypts the FVEK (full volume encryption key), and finally the FVEK encrypts the actual data blocks. I've also ...
Chris Chen's user avatar
1 vote
0 answers
116 views

Encryption and storing/managing private key in hosted cluster

I am working on an application running in/on a hosted Kubernetes cluster. All services are built using a Java based stack. For a new feature it is required to temporarily store notifications (email ...
Ratlos's user avatar
  • 67
0 votes
2 answers
775 views

Backup GPG private key in KeePassXC

In order to keep all my secret in the same place, I would like to store my GPG private key in KeePassXC, under the "Notes" field. Provided that the db file has very good password, is this ...
robertspierre's user avatar
2 votes
1 answer
353 views

Is there a secure way to embed a private key in compiled code that is released in compiled form to the general public?

It occurred to me that if I could compile a private key in source code, I could prove that log information came exclusively from the application for a given version. I could do this by releasing the ...
Larry Freeman's user avatar
0 votes
1 answer
250 views

PCI compliance - use of ANSI X9.17 for export keys

we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
MaXbeMan's user avatar
1 vote
1 answer
154 views

How to recover data that was encrypted with a revoked or expired key? [closed]

Do you know any processes for recovering data which has been encrypted with a revoked or expired encryption key after the encryption key becomes invalid?
Asclepius's user avatar
-1 votes
2 answers
507 views

Strategy for storing private keys used in an embedded device

I am developing an embedded device using a bootloader. This means that the device will store in its flash an encryption key for decrypting update packages and an ECC public key for verifying update ...
user2563661's user avatar
0 votes
1 answer
115 views

Passing sensitive user data I must not ever see between devices using an identity provider

I have a Progressive Web Application (PWA) with a lot of users, each user creates a public-private keypair and wants to use that across devices simply by logging in using some form of auth, for ...
Phosphorescent's user avatar
0 votes
0 answers
102 views

How could one use multi-factor authentication to derive a static secret key?

Scenario: The setup is that each user has a randomly generated key A used for encrypting data stored on the server and a password-derived key B used to store A on the server without the server getting ...
n-l-i's user avatar
  • 276
0 votes
0 answers
87 views

What is the proper way to manage a company's SSL certificates?

Is there a way/software to manage and sign multiple SSL certificates? We have many intranet web applications that show the certificate error risk in the web browser. I have been googling a lot but SSL ...
SGP's user avatar
  • 101
2 votes
1 answer
424 views

Security of Trusty OS (TEE) Non-Secure World API

Recently I learned about TEE in Android, Trusty OS and its internals. I read through the articles on source.android.com and there is one thing I did not find there. Trusty OS has its own API which ...
Topper Harley's user avatar
3 votes
2 answers
576 views

My web application needs to have my users' private keys to sign documents on their behalf. How do I handle that?

Our web application issues governmental documents for our users. Every one of those documents needs to be signed with a private key. However, because our users find it cumbersome to point their ...
H. Sérvio's user avatar
0 votes
0 answers
99 views

Securing the keystore key?

My program, is installed on specific computers that use a shared, common login. The program decrypts variously sized (1KB-1GB) data assets which were encrypted elsewhere, and transferred over. Each ...
Reahreic's user avatar
  • 121
0 votes
0 answers
152 views

In a web application, what would you consider the best way to store secret keys obtained via an SDK?

Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user. Currently when ...
Ray's user avatar
  • 1
0 votes
1 answer
104 views

Is public key-transport key required for encryption key distribution over HTTPS?

According to NIST Key Management recommendation "8.1.5.2.2.2 Automated Key Distribution/Key Transport/Key Wrapping", it is required to use a key wrapping key or a public key-transport key to ...
user1024888's user avatar
0 votes
2 answers
139 views

What could be the correct and secure ways to store and manage public keys?

I am developing an open source project(PKDSA) that uses ED25519 and ED448. My purpose of this project was to help others to enable user-secretless based passwordless authentication. There're a lot of ...
Hern's user avatar
  • 3
1 vote
1 answer
352 views

How do I best share a shared account's private key?

I made a website which among other things allows users to sign up to events. The HTML form is filled out and submitted, which automatically updates a google spreadsheet with all applications. This of ...
RattatAndyGo's user avatar
2 votes
1 answer
625 views

Key management: Can I delete private key in asymmetric encryption?

If using asymmetric encryption, such as ES256, is there a reason why a private key could not be discarded after signing some data? For example with a JWT, or a file hash use for audit at a later date, ...
vbuser2004's user avatar
1 vote
1 answer
140 views

Is handling keys with vps without kms secure?

I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the ...
Hejhejhej123's user avatar
0 votes
2 answers
354 views

Asymmetric encryption and data sharing

I have a web application created with Flask in python that uses asymmetric encryption using RSA, the private key is generated from the user's password and is only stored in a cookie on the user's ...
user avatar
2 votes
1 answer
264 views

How to use (py)NaCl/libsodium for key wrap, key encapsulation

We want to wrap / encapsulate a symmetric key with an asymmetric keypair, a symmetric key with a symmetric key, a private key with a symmetric key. In each case, we'd like to allow several keys to ...
BGWPVqRM3xIg's user avatar
3 votes
1 answer
374 views

Is sharing private key with CDN dangerous?

When you use a Content Delivery Network (CDN) and want to enable HTTPS, you need to import your certificate there. So you should provide your Private Key to the CDN. Is this secure? I mean CDN can log ...
GameO7er's user avatar
  • 169
1 vote
2 answers
395 views

How do you share private keys for signing e.g. JWTs inside Docker-Containers?

I've written an application in NodeJS which essentially only performs a login: You send your username/password, and you retrieve an JWT (JSON Web Token). Those tokens are being signed by a private key....
Gandalf1783's user avatar
0 votes
0 answers
31 views

Is it possible for an app to sign data it generates so that the data can be guaranteed to come from the app? [duplicate]

Is it possible for an app binary to sign content generated by the app such that a verifier can confirm the data was indeed generated by a specific version of the app? For example: A mobile app from a ...
aphoniko's user avatar
1 vote
0 answers
182 views

The 3-level hierarchy of keys in TPM 2.0

I have a task to create the 3-level RSA key hierarchy (with wolfTPM library), where keys of the 2nd and the 3rd levels are imported keys. Here are the steps that I follow: Generate a primary key on ...
Victoria Seniuk's user avatar
0 votes
1 answer
393 views

After creating an AWS user for S3 access with access key and secret key, how do I share these with the user?

I have a private S3 bucket. I want a user from an external organisation to have access. I have added a user in IAM. How does this external user get notified and how do I share credentials? The secret ...
Architect 's user avatar
0 votes
1 answer
272 views

How to setup a Per-File Encryption architecture

I would like to set up a per-file encryption architecture where every file is encrypted with its own key, and each key is encrypted using a master key. Is there any good articles to read regarding ...
Lina's user avatar
  • 1
0 votes
0 answers
197 views

How long does Signal keep the keys for out-of-order messages?

I was reading the Signal protocol on how it handles out-of-order messages. What if those messages never arrived, does Signal keep the keys forever or are the keys deleted as soon as a new session is ...
user2600798's user avatar
4 votes
0 answers
408 views

Securely store application secrets in production without 3rd party KMS

Integrated Security I have a ASP.NET web application with connection strings and other secrets to protect in production. Ideally I would like to use IntegratedSecurity to keep SQL credentials out of ...
JCasper's user avatar
  • 41
0 votes
1 answer
224 views

Is there a viable zero-knowledge approach for using oAuth to generate and manage private keys?

I've been doing a deep dive into how products like Web3Auth work under the hood and wonder if this is a viable approach to building applications where a user can have the convenience of using oAuth to ...
user3458571's user avatar
1 vote
0 answers
27 views

Does the the key used to encrypt in a ransomware attack reside on the target computer for at least some time? [duplicate]

My understanding is that a ransomware uses the target computer's resources to encrypt files. So does that mean that the key used for encryption resides on the target computer for at least some time? I ...
Abhisek Dash's user avatar
3 votes
1 answer
182 views

Why are key IDs typically the *last* digits of the key hash?

With PGP for example, the "properties" of the following key are: pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02] 6713B62DC36CE36403C724B1FFD641CF2BD6571B uid [...
Turysaz's user avatar
  • 33
0 votes
1 answer
269 views

How do centralized crypto exchanges store seed phrases and users' private keys?

Say I'm trying to develop a CEX, hence I will hold custody of users' keys. How would I go about doing that and ensuring safety and security? From what I know, I can generate the users' keys from a ...
whitebat 199's user avatar
1 vote
1 answer
225 views

Export ECDSA certificate from Windows Store

I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
Amal Jesudas's user avatar
0 votes
1 answer
120 views

How can a client safely post/get a (symmetric) client key to/from a key distribution center?

If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
hurryman2212's user avatar
0 votes
1 answer
760 views

How to preserve key in TPM 2.0

I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
Kostas Moisidis's user avatar
1 vote
2 answers
283 views

Best and safest way to store secret key used for PKA on server?

I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example: Create a 0500 access directory on my server ...
DevelJoe's user avatar
  • 141

1
2 3 4 5
18