Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
780
questions
5
votes
3answers
601 views
Hierarchical Key Rotation. Should I rotate the lowest level keys?
I have a hierarchical key system designed for my project. In this system a block of data is encrypted using a Data Encryption Key (DEK). This DEK is encrypted using a Key Encryption Key (KEK) which is ...
0
votes
1answer
95 views
It's secure to store private keys in AWS Secret Manager?
I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
2
votes
1answer
80 views
How can Bitwarden claim it cannot access your passwords if the vault password is the same as the web account password?
Bitwarden claims that it is more secure than traditional cloud password managers (such as Google) as it only stores the encrypted version of the passwords database. But for some reason the password ...
0
votes
0answers
25 views
Seamless Key Management with Key Management Systems?
I'm keeping it vague on purpose so that it can help other cases as well.
Goal
The goal is to store information that is encrypted on client side and then delivered to the database.
Server should never ...
0
votes
0answers
36 views
KMS Key Exposure
I've found some KMS key exposed in some code and am wondering what exactly the severity would be.
What could an attacker achieve by having this key?
1
vote
0answers
57 views
Is it ok to store my Android app keystore password in a text file on my disk?
I am reading on how to sign and publish my flutter app on android.
When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
0
votes
1answer
70 views
if computer is compromised, does hardware key still protect in ssh?
Let's say I sign into my local pc with a hardware key (eg yubicon). Let's say I further sign into a sensitive server (as root) via ssh using yubicon hardware key as well (ie only way to get into ...
0
votes
1answer
49 views
Information disclosure via ktpass tool
The Microsoft ktpass tool can be used to generate a .keytab file that contains a secret key. I'd like to understand the output of the tool.
An example output can be found here. I'm interested in the ...
1
vote
0answers
30 views
Securing API keys for accessing Google APIs via Front End (UI)
This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below.
We currently have hybrid ...
0
votes
1answer
74 views
Most secure way to store a cryptographic key for encrypting/decrypting stored application data
I would like to encrypt some of my application data stored on a MySQL DB using AES-128. I wonder thus what is the best way to store my key on the webserver.
Should I encrypt the key itself or store it ...
0
votes
2answers
100 views
How safe is XOR with multiple preprinted stainless steel key tags purchased from different channel?
This is related to https://crypto.stackexchange.com/questions/48622/how-safe-is-xor-with-multiple-independent-but-non-random-keys but not exactly the same question.
Let's say there are three different ...
0
votes
1answer
32 views
Azure Ad B2C Users access resources in other directory
I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
1
vote
0answers
32 views
Reusing content-encryption key in cms enveloped data
OpenSSL keeps the structure CMS_ContentInfo opaque and in the case of enveloped data generates and manages the content-encryption key completely by itself. It is not possible to provide a content-...
-1
votes
1answer
57 views
How to secure the key in an offline package
I have a package to be shared to Bob which contains:
an encrypted data.zip
Application, which will have logic to decrypt the data
Bob will run Application and it will decrypt the data.zip.
Now for ...
0
votes
2answers
78 views
pgp public key failed to propogate
I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key ...
2
votes
1answer
71 views
Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?
I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
1
vote
1answer
126 views
Is this a good way to manage encryption keys?
I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything
from a leave of absence form to potentially confidential agreements.
Being ...
1
vote
1answer
68 views
use custom 'key' for hardware security keys
Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
0
votes
1answer
126 views
Which would be the best “keyfile” for KeepassXC and/or Veracrypt?
I am a Mac user. I opened a keyfile generated by Veracrypt and one generated by KeepassXC. The texts in both of them were quite short. Which keyfile is best (i.e., most random and harder to break ...
0
votes
0answers
38 views
Handling API keys for client-side app with cloud key vault
I would like to hear about the security implications of my desktop app's current API usage workflow:
Client-side WPF desktop app connects to Azure Key Vault, a cloud vault, by authenticating via a ...
1
vote
1answer
106 views
Web developer needs customer's private key
As a non security expert, I'm looking for advice from those who are.
I work with company X who have hired company Y to develop their website. Company Y needs to integrate server-side online payment ...
0
votes
1answer
72 views
What's a secure way to generate a keypair from a secret password?
I like to generate a public-private key pair that is seeded from a string. So having the string and the generation algorithm is enough to recreate the keys. I want to do this because I can then ...
1
vote
1answer
61 views
Subkey rotation and revocation
If I decided today get new subkeys because I simply want to rotate them or because they are about to expire, do I have to sign all keys of other people I signed with my old signing key again? And if I ...
2
votes
0answers
90 views
What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?
My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home.
Since the laptop uses BitLocker ...
0
votes
0answers
131 views
Why do I need --batch to import a secret key from a pipe?
Once I used this guide to transfer my secret key to my smartphone, so today I did the same thing for transfering the secret key from my workstation to my laptop.
Yes, I could have used a USB key, or I ...
1
vote
1answer
121 views
An intranet web app for decrypting values : a bad idea, and if so, why?
We have to protect a database connection string for a .NET desktop application that has an application-level database user. One option is to encrypt a section of the app.config using asp_regiis. But ...
0
votes
0answers
31 views
GPG Questions About Exporting Subkeys to File
GPG novice here so please bear with me.
From what I understand, when you generate a keypair with GPG it will automatically create a subkey pair (sub, ssb).
If I wanted to give these to another party ...
1
vote
2answers
85 views
How to devise cryptographic system with sharing ability
I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
0
votes
0answers
155 views
Should Group Key Update Interval be Off or On?
My router has this option and I was wondering if it should be turned off or on for better security? If it is better security to leave it on what is the best interval for maximum security?
3
votes
3answers
135 views
Drawback of Multi Level Encryption
I am backing up my files to a RAID mirrored HDD, that has full disk encryption (FDE) in place with LUKS. Until now I did this with rsync, but I recently switched to a new backup program that does file ...
1
vote
1answer
35 views
Storing private keys for updates to remote device
I'm reading up on how to perform signed updates for remote hardware devices. I need to check if the new software has been generated by a "trusted" source, ie me.
Based on my understanding of ...
1
vote
1answer
59 views
Can I copy a PGP revocation to another server?
I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
4
votes
2answers
140 views
Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?
I implemented this kind of authentication for my REST API, is this secure and is my logic sound?
I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
9
votes
8answers
6k views
Can a large corporation make a believable promise
Say there is a secret encryption key that a third party has to handle. The third party is supposed to destroy the secret key when they are done, and tell everyone else it was destroyed and therefore ...
3
votes
4answers
186 views
Methods for backing up key on paper
What are the methods to backup a key to paper?
The idea is to have reasonable protection and the ability to restore the key in case of the digital backup is lost.
Are there things that convert a ...
0
votes
0answers
51 views
Password Vault Storing Passwords
I've been working on just a fun side project in C++ to practice encryption algorithms and I sort of ran into a bit of a roadblock of sorts. To summarize the project I have a text file of encrypted ...
0
votes
0answers
62 views
SSL/TLS communication in connected embedded (IoT) device
while establishing the SSL/TLS based communication in an embedded device, is it necessary that device needs to acquire the keys/certificates from a CA? I read that there is also provision for device ...
4
votes
2answers
204 views
What is the difference between the many identifiers in GnuPG?
GnuPG seems to have number of different ways to refer to a (sub)key(pair):
Key IDs
Fingerprints
Keygrips
Additionally, gpg --list-sigs seems to show hexadecimal identifiers for signatures and such ...
1
vote
0answers
61 views
Is this reasonable privacy for storing sensitive information?
Outline
I am writing a web app that will need to store some transaction data (amount, date, merchant...).
Objective
I want to keep this data reasonably private from unwelcome eyes.
Threat Model
...
0
votes
0answers
63 views
How to facilitate secure chats between users
My company runs a chat room service where the users can securely send messages to one another. All users are authenticated by the service in advance, and will install software from the service onto ...
0
votes
1answer
45 views
Is HMAC really a benefit for AES-CBC?
I think I quite well understand the theoretical benefit of adding the HMAC (authenticity/integrity on top of confidentiality), but I am looking at this from a key management point-of-view.
Premise: ...
1
vote
1answer
34 views
Single key pairs for SFTP
I have a single machine (client) and several servers and I need to take from them several files through sftp. My idea is to generate a pair of public and private keys in the client, and copy the ...
1
vote
1answer
70 views
Does a revocation certificate leak information about the private key?
Kleopatra/ GPG can create revocation certificates, which look a lot like public/private keys. Obviously, these keys should not be shared or used unless one intends to revoke their keys. But assume ...
2
votes
0answers
74 views
Security of Microsoft key container
How is the security of cryptographic keys stored by Microsoft Windows in the key containers used by CryptoAPI/CNG guaranteed?
The keys are stored in the user's directory or a directory for the machine-...
1
vote
0answers
198 views
How does WhatsApp retain private key? [duplicate]
Does anyone know how does WhatsApp retain private key? Based on what I know it looks like private keys are stored on the device. What happens when someone changes their device? How does the private ...
0
votes
1answer
93 views
Cloud provider or self-hosted for key-storage?
I was reading this question: Where do you store your personal private GPG key?
I have my set up as noted in this comment: Where do you store your personal private GPG key?
But instead of using a ...
4
votes
3answers
535 views
Is it more secure to encrypt separate customers' data with separate keys?
If I am storing multiple customers' data in cloud-based file storage such as an AWS S3 bucket, and I use an encryption service such as AWS KMS to achieve encryption at rest, does it add any extra ...
1
vote
1answer
83 views
Implementing key vault and key rotation for a non-cloud application
I have a desktop application written in Python. The application is connects with an external SAP HANA service and pulls data. There are couple of configuration files where several connection string ...
9
votes
1answer
2k views
OpenSSH declares ssh-rsa deprecated. What do I do next?
With the 8.2 release of OpenSSH, they have declared that ssh-rsa for SHA-1 will soon be removed from the defaults:
Future deprecation notice
It is now possible[1] to perform chosen-prefix ...
0
votes
0answers
43 views
Establish a symmetric key: KDF based on shared secret and random salt or key wrapping?
I am designing a basic KMS based on a simple HSM, I only have access to: AES256, SHA256, PBKDF2, HMAC (and combinations like AES256-HMAC-SHA256).
The admin and the users of the system have a personal ...
