Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
700
questions
1
vote
1answer
58 views
Does encapsulation of encryption within a library provide some kind of additional security?
Lets say there is an industrial device communicating with a central system. Secure communication is required from an end to end point of view. From time to time keys of the devices must be renewed by ...
0
votes
0answers
25 views
How Cloudera Key Trustee Servers are caching Master Keys from HSM
We are building Cloudera platform with Encryption at rest for HDFS. We plan to use HSMs for key management. To lower the load we can generate on HSMs we will be using KeyTrustee servers to cache ...
0
votes
1answer
76 views
Can AWS KMS be used for both KEK and DEK for PCI DSS?
Right now we're using our own built-in solution based on SSS, and we want to switch to KMS.
How far can we go? Can we use AWS' KMS for both the KEK and the DEK?
1
vote
1answer
65 views
Android key protection
I was reading this documentation and saw this part;
When an application performs cryptographic operations using an Android Keystore key, behind the scenes plaintext, ciphertext, and messages to be ...
0
votes
2answers
78 views
What is Cloud KMS? What's it's purpose/benefit of KMS? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)
What is Cloud KMS? What's it's purpose/benefit of KMS? Is there a concrete example of a problem I solve using it? How does it work? How do I use it? (AWS KMS, GCP KMS, Azure Key Vault)
Whenever I've ...
0
votes
0answers
45 views
How does Google restrict API access by mobile App ID?
Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers.
How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
0
votes
2answers
131 views
Understanding AES Keys and Passphrases
I am trying to get my head around how AES works and in particular I have queries around the key generation and 'passphrases'.
My understanding is that AES has a 128 bit block size but the key length ...
0
votes
0answers
43 views
Where/How are SNMP v3 passwords stored on the agent?
Security wise, SNMP v3 improves over v2 by using users for polling agents or agents sending trap data to the management system. But what if the agent is compromised? Will the attacker be able to get ...
2
votes
0answers
67 views
Storing users' private keys to clone git repositories on their behalf
Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
0
votes
1answer
69 views
Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it
The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
1
vote
1answer
121 views
Is it secure to store a cryptographic key in a class member variable?
Consider an application that runs locally on a Windows PC. The application uses a local folder for reading/storing encrypted data (i.e. images). A user logs in (authenticated from a local encrypted DB)...
0
votes
1answer
55 views
Storing server-side secret key in environment variable - is a concern?
Is it a security concern to store server-side key in plaintext in environment variables? And specifically with PHP, would I be safe by not calling phpinfo() or other kind of dumper?
1
vote
0answers
56 views
HSM best practice for access
I've been building a product using AWS CloudHSM and things are working well in the POC.
Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
0
votes
0answers
32 views
Store secret for HS256 (JWT) in repository?
For JWT generation in my Java application I need to use the secret. Thus, I need to include this along with other source code into repository, which is a no-no.
So how can I store the secret in ...
0
votes
0answers
36 views
Android keystore and accessing keys
I'm reading this documentation on how to use Android keystore. There're couple of points I don't quite understand.
First of all, in the docs, it says;
Key material never enters the application ...
0
votes
1answer
69 views
Key penetration from guest OS directly to hard drive
Most of the key protections are used to encrypt key to protect it from malware or other tenants. What if the hypervisor "steals" my key?
If I am using a VM provided by a CSP, when I input a key to ...
-1
votes
1answer
64 views
How can I mitigate the possibility of SSL private key being copied without my knowledge?
OCSP stapling and Certificate Transparency logs seem to provide a pretty good defense against man-in-the-middle attacks if I discover that my private key has been stolen. I can revoke my old ...
1
vote
0answers
119 views
Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey
I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
0
votes
1answer
53 views
Is it a bad idea to share a private key generated from a self-signed root CA?
Pardon if this is a noob question. I'm writing an authorization function to determine if a REST API request should be allowed to proceed or not. It is using a standard JWT passed in the Authorization: ...
1
vote
0answers
35 views
Make key trusted in Enigmail?
I have tried to import a public key of someone into enigmail. The import failed silently (nothing absolutely happened, not even an error). I tried key from file and from clipboard.
Then I used gpg --...
0
votes
2answers
104 views
What factors should I consider when choosing the key for encryption and decryption?
We have an application that uses cookies to transmit employee personal data over from the front end to the server. We have planned to use TLS 1.2 for the encryption in transit. However once the java ...
0
votes
1answer
54 views
How can we be assure that people with read access to keys, can not also read the ciphertext and vice versa?
We have this segregation of duties requirement and don't understand it fully. Is it not always possible, that an employee who is generating keys can also get access to the encrypted messages?
0
votes
0answers
96 views
Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?
Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys
Mallory ensures that Bob uses her keyserver, which offers her own key, which
is sharing the 32-bit "short" Key ...
0
votes
0answers
139 views
CVV/CVC code algorithm [duplicate]
I'm looking for a definition of algorithm how to calculate CVV/CVC codes?
I know that there are the following inputs:
PAN Expiration
Date
Service Code
CVK A/B
But I'm not able to find the specific ...
7
votes
1answer
321 views
Preparing to change over to new GPG-key - what to do with my old ones?
I've just created a new off-line GPG-key with a sign/certify master-key and two sub-keys - one for signing and one for encrypting. 5 yr expiration for the master, 2 yr for the subs. My master-key got ...
0
votes
0answers
27 views
Know the setting used in creating key pair in GNUPG4Win version 3.15
I am using GNUpg4Win version 3.15. For the last few hours I am trying to figure out what default settings are used for Cipher and Hash during key generation.
Basically I want to use AES-128, 3DES ...
0
votes
0answers
170 views
How to securely store private keys in the DB?
I am implementing a web application that deals with signing blockchain transactions similar to what all cryptocurrency stock exchange applications are doing.
I am wondering how do they store private ...
-1
votes
1answer
60 views
How does key exchange work? Using symmetric algorithm such as AES
I was wondering how does the sender give the encrypted file and the key to the receiver securely? Particularly on situations where the sender doesnt meet with the receiver (through email or through ...
1
vote
1answer
72 views
Security implications of exposing payment gateway secret API key
Introduction
In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow:
POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL.
...
2
votes
1answer
179 views
One GPG key with multiple user identities for my career?
I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs.
My understanding is that there are two ways this could be done:
Have one main/master GPG ...
4
votes
1answer
166 views
If my private key is password protected, then how is it used without asking me for it?
Relating to TLS and SSH. If my private key is password / passphrase protected, how is this then used automatically during TLS or SSH communication without asking me for the password?
1
vote
0answers
34 views
Sharing individually encrypted elements between users of a system
I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file.
For simplicity, lets say the unique keys are the file names.
I'd ...
3
votes
1answer
99 views
Why are passphrases protecting GPG / SSH private keys needed? [duplicate]
SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed ...
1
vote
2answers
72 views
Possible to get sshd (openssh) to log the public key of failed key based login attempts?
As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key.
What I'm looking for is ...
0
votes
1answer
129 views
Why do SSL certs use saved private keys?
If an encrypted connection can be compromised when a server's private key is stollen, why don't servers simply generate a new private key for each unique session. It seems like it would eliminate a ...
1
vote
2answers
924 views
Rotating encryption keys - how does it work?
I haven't found a duplicate which explains with sufficient clarity how does the process of rotating encryption keys work in simple layman terms.
I know how private/public key cryptography works, I ...
3
votes
1answer
122 views
Are there any known collisions of a “long” (64 bit) OpenPGP key ID?
We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
2
votes
1answer
61 views
Are there risks to having many uids on my gpg key?
I'm fairly new to the world of pgp/gpg, I came to it first through Keybase and then the gpg client and now I think I'm in a place where I'm quite happy with my key setup. I've just started a new job ...
0
votes
1answer
217 views
Crypto-shredding & backups of keys
I was wondering, how is crypto-shredding implemented in an environment, where data backups/mirroring is mandatory for the "key database" - as it must not be possible to lose the machine/db with all ...
2
votes
1answer
90 views
How to Manage Public Key with Asymmetric Cryptography
I'm working on an iOS chat project using Firebase RealTime Database.
I want to use asymmetric cryptography for the management of messages between two users ..
Browsing the net I found an excellent ...
1
vote
0answers
296 views
Where To Store Public and Private Key files?
I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting.
In my project, I'm generating two files: Public Key file and ...
1
vote
1answer
60 views
Ensuring key integrity
I have encrypted AES key stored in the database with the encrypted data. AES key is encrypted with a key derived from the passphrase. I want to ensure the integrity of the stored AES key. Is the ...
0
votes
1answer
43 views
Protecting Keys with External Factor
I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
2
votes
2answers
240 views
Proper security for IoT device
I'm developing a product with simple Cortex-M MCU (with no OS on board, firmware on bare metal) and internet connectivity via external module.
How do I make it secure? More specifically, how do I ...
4
votes
1answer
124 views
What fundamental problems are solved by using a Key Encrypting Key (KEK)?
I've read several questions regarding KEKs but have not quite found one that comprehensively addresses why we would choose to use a KEK. This excellent answer by Mike Ounsworth explains how KEKs allow ...
1
vote
0answers
27 views
Generating new E and S subkeys for a key that has been moved to card
I accidentally messed up months ago by keytocard'ing a seret key before making an offline locked-away backup of it. I failed at reading comprehension and did not know that this would delete the key ...
0
votes
1answer
93 views
How does Authenticator gets the PMK which is used to calculate PTK?
I am trying to setup a Supplicant- authenticator and AAA server to perform EAPOL mechanism.
I am able to successfully completed the EAP authentication procedure but 4-way handshake was not initiated ...
1
vote
1answer
65 views
What advantages do Secret Managers offer in terms of authentication [API usage]?
The problem I am seeing with secret managers (programs which serve as a store of secrets for other programs/APIs) is that at some level, a key or credentials must still be provided programmatically, ...
0
votes
1answer
96 views
Best way to manage private keys for users of an application?
We're building an application which will leverage blockchain for financial transaction within itself.
We won't be forcing users to manage their own keys. Our clients (we're building a B2B platform) ...
0
votes
1answer
114 views
How can AWS API Gateway be used to rapidly rotate credentials in this fashion?
Reading through this article, I hit a little wall of understanding. The author states:
This is because my laptop doesn’t have the secret weapon. Once you get
this up and running on an EC2 ...
