Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
738
questions
0
votes
0answers
30 views
Multi-user document encryption: access to user private keys
I am attempting to implement these solutions for multi-user document encryption:
https://security.stackexchange.com/a/71915
https://owncloud.com/wp-content/uploads/2014/10/...
1
vote
2answers
100 views
Is there really any safe way to store an encryption key?
I'm aware of multiple ways to store an encryption key, some very bad, such as in your codebase or elsewhere on the same server, and others much better such as where the encryption/decryption is done ...
1
vote
1answer
33 views
Webhook sending Purchase Details to handling Purchases from a Third Pary Service Secure?
I'm developing a mobile application for a client that sells digital courses on a service called Teachable that hosts their website and handles the purchase process for them. My client wants to keep ...
0
votes
0answers
42 views
How do I find the private key in Android app OpenKeyChain?
I can generate a key easily enough within the app by clicking on "Create My Key" but notice it says "key" not keys. This is confusing in that I don't know whether I am trying to share my public key, ...
0
votes
1answer
60 views
Is it fine to store the key used to encrypt data, in encrypted form alongside the encrypted data?
There is a need to encrypt data and upload somewhere on a periodic basis. We have a master key that is used to generate data keys. On each instance of upload, a new data key is generated and the data ...
1
vote
0answers
40 views
Does a shared (but encrypted) private key for a group of users reduce the effectiveness of the encryption?
That is, is it generally considered more secure to save a single application-wide private key on the web server compared to storing (protected/encrypted) private keys in the database?
More ...
1
vote
1answer
61 views
Would there be a secure way to store an encryption key on server side for front-end decryption?
I am currently working on a web application with sensitive data to store (personal medical data). The app is on the very first stages of conception and I am to quickly produce a beta version that ...
1
vote
0answers
19 views
How to authorize a subkey using a primary master key pair?
I'm using webcrypto, not PGP/GPG.
I would like to use a key pair to create a "subkey" that is authorized by my primary key in a way anyone can publicly verify so I don't need to expose the primary ...
0
votes
0answers
9 views
Key space math clarification [migrated]
The following table specifies a cryptosystem based around a very simple encryption algorithm with four different plaintexts A, B, C and D (one corresponding to each column) and four different ...
2
votes
1answer
156 views
Possible public/private identity recovery after compromise without a centeral authority?
I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust.
This seems to be a ...
3
votes
2answers
85 views
OpenPGP keys on smartcard: what is the real-world security gain of keeping master key offline?
When keeping OpenPGP keys for daily use on a smartcard (a Yubikey, say), what are, from a security point of view, the advantages of keeping the master key offline as compared to simply keeping the ...
1
vote
0answers
31 views
Why GPG signature is not considered as made by a trusted key?
When I verify a file signature I get the the following warning:
$ gpg --verify file.sig
gpg: Signature made So 01 Dez 2019 10:08:27 CET
gpg: using RSA key <Pierre's key ID>
gpg: ...
0
votes
1answer
83 views
Is there any solution to this system?
INTRODUCTION
First of all, I'm a beginner in RSA mechanisms and similar but I'm really interested in knowing if this is possible.
In this scenario, I organized a party where certain people receive a ...
-1
votes
1answer
51 views
Key storage and Password Management Tool [duplicate]
Passwords are not stored in plain text. So we hash them. But for hashing we need a key if we use a keyed hash function. In unix system passwords were stored in etc\password file but now the location ...
0
votes
1answer
92 views
derived key from email + password?
When deriving a private key from a password, will the resulting secret key be any weaker if the user email is included in the function input? Meaning, user email concatenated with the user password.
...
0
votes
1answer
91 views
What are the steps of hashing and steps of verifying password using salt and key? [duplicate]
What are the steps of hashing password during registration and login to an application using salt and key?
Are the following steps considered correct if applied to an application?:
1- During ...
2
votes
2answers
89 views
When gpg encrypt is called from the command line, how is a key chosen to do the encryption?
I am using GnuPG. When gpg encrypt is called from the command line, how is a key chosen to do the encryption? It appears to me that -r, or --recipient, supplies a user id and that is the simple answer....
1
vote
1answer
101 views
Why is Debian not showing the GPG signatures on keys that Arch Linux is?
I downloaded a Qubes OS ISO and I'm trying to verify its legitimacy using this guide. GPG was behaving weirdly, so I created a separate user with a separate keyring to reproduce the issue.
When I try ...
1
vote
2answers
104 views
Is it possible to forge key files and mount a veracrypt container?
If I have a Veracrypt container, and I use a key file with a password, if the key file is too simplistic, is it possible to recreate that key file and open the container?
Suppose if I use a .jpg of a ...
7
votes
3answers
2k views
Why are KDFs slow? Is using a KDF more secure than using the original secret?
According to the Wikipedia page for key derivation functions, a KDF's purpose is to derive a secret key for cryptography:
In cryptography, a key derivation function (KDF) derives one or more secret ...
1
vote
0answers
148 views
Why does Microsoft recommend storing the ASP.NET Core DataProtection Key Ring in EFCore?
After many years that accepted best practice was to never store keys in a database, but Microsoft now recommends storing the data protection key ring (encrypted with certificate) in the database using ...
2
votes
0answers
54 views
How to store a key for a Java app server?
Assume I have a Java app running on a Linux server. The app needs a secret key to do a task, such as decrypting or encrypting a file, after it starts up. This is a question about best practice for ...
2
votes
0answers
31 views
Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?
We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
0
votes
1answer
117 views
How can I distribute highly confidential keys for a symmetric cipher?
Say I want to exchange a key with someone for a symmetric cipher (say AES) without meeting them in person. What would be the most secure way to do this over the Internet? My first instinct would be ...
0
votes
1answer
63 views
Key management for builds for embedded systems
Our medical device has embedded processors and a USB port used for firmware updates and logfile transfers. The usual USB viruses are not a concern (no mechanism to load or execute them, wouldn't run ...
1
vote
0answers
32 views
Root CA key generation compliant with WebTrust and HSM independent
I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust.
One additional requirement I have that the generate private key should be then imported to ...
1
vote
0answers
23 views
Recomendation for automated rotation of a JSON keyring? [closed]
I have a Sailsjs app that is configured to encrypt model attributes with sensitive information. This seems to use bcrypt, under the hood and leverages a JSON keyring in the configuration (...
0
votes
3answers
198 views
Prevent finding key in C++ application binary
I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
1
vote
1answer
72 views
Is encryption/decryption done in the cloud when using CMK keys?
I am trying to understand how AWS KMS works, and there is one thing I am still not completely sure of: when using CMKs, so no Data Keys, no envelop encryption, does the encryption take place in the ...
0
votes
1answer
63 views
Updating Sender-Keys and Key-Management
This question is related to an earlier question I had:
Encryption on Mobile Devices - Multiparty Encryption - Key Management
My situation: I have many mobile devices that want to send sensitive ...
3
votes
2answers
110 views
What is the best strategy for handling a compromised private key within the domain of firmware?
I have a firmware project that uses asymmetric cryptography for assuring integrity and authority of updates. The private key is stored within the company, and the public key is on the firmware to ...
0
votes
0answers
42 views
Server application to hold PGP private keys and decrypt as requested
I don't know if what I'm talking about exists, or if the concept doesn't make any sense, or even if it's just a stupid question. I'm developing a small integration for our business which receives ...
0
votes
1answer
59 views
Are all web servers for a domain wildcard certificate supposed to have the same private key?
If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
1
vote
0answers
99 views
Open source KMIP Server in a production-level environment [closed]
I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
0
votes
0answers
84 views
How do you generate a RSA private key that is BER encoded with OpenSSL?
According to the Linux Kernel's Asymmetric Cipher API found at the following URL: https://www.kernel.org/doc/html/latest/crypto/api-akcipher.html#asymmetric-cipher-api, you must pass a BER encoded ...
0
votes
0answers
48 views
Public blockchain, encrypted blocks with access list; Key revocation; Is it a fit for attribute based cryptography?
I've got the requirement to put the company data onto blockchain for traceability and auditability.
Some of that data is public, whilst some of this data is confidential to 1+ (could be many) user ...
2
votes
3answers
194 views
In PGP how can I be sure about the public key?
I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
2
votes
2answers
128 views
Is it a good idea to use asymmetric encryption for a chat application?
I am reading design documents of an internal Whats-app like chat application.
Developers are planning to use asymmetric encryption to encrypt all messages.
Every user will have a public/private key ...
1
vote
1answer
60 views
Does encapsulation of encryption within a library provide some kind of additional security?
Lets say there is an industrial device communicating with a central system. Secure communication is required from an end to end point of view. From time to time keys of the devices must be renewed by ...
0
votes
0answers
41 views
How Cloudera Key Trustee Servers are caching Master Keys from HSM
We are building Cloudera platform with Encryption at rest for HDFS. We plan to use HSMs for key management. To lower the load we can generate on HSMs we will be using KeyTrustee servers to cache ...
0
votes
1answer
230 views
Can AWS KMS be used for both KEK and DEK for PCI DSS?
Right now we're using our own built-in solution based on SSS, and we want to switch to KMS.
How far can we go? Can we use AWS' KMS for both the KEK and the DEK?
1
vote
1answer
97 views
Android key protection
I was reading this documentation and saw this part;
When an application performs cryptographic operations using an Android Keystore key, behind the scenes plaintext, ciphertext, and messages to be ...
0
votes
2answers
303 views
What is Cloud KMS? What's it's purpose/benefit of KMS? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)
What is Cloud KMS? What's it's purpose/benefit of KMS? Is there a concrete example of a problem I solve using it? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)
Whenever I've ...
0
votes
0answers
54 views
How does Google restrict API access by mobile App ID?
Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers.
How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
0
votes
2answers
496 views
Understanding AES Keys and Passphrases
I am trying to get my head around how AES works and in particular I have queries around the key generation and 'passphrases'.
My understanding is that AES has a 128 bit block size but the key length ...
0
votes
0answers
97 views
Where/How are SNMP v3 passwords stored on the agent?
Security wise, SNMP v3 improves over v2 by using users for polling agents or agents sending trap data to the management system. But what if the agent is compromised? Will the attacker be able to get ...
2
votes
0answers
79 views
Storing users' private keys to clone git repositories on their behalf
Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
1
vote
1answer
99 views
Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it
The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
1
vote
1answer
132 views
Is it secure to store a cryptographic key in a class member variable?
Consider an application that runs locally on a Windows PC. The application uses a local folder for reading/storing encrypted data (i.e. images). A user logs in (authenticated from a local encrypted DB)...
0
votes
1answer
78 views
Storing server-side secret key in environment variable - is a concern?
Is it a security concern to store server-side key in plaintext in environment variables? And specifically with PHP, would I be safe by not calling phpinfo() or other kind of dumper?
