Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
788
questions
1
vote
1answer
93 views
How does a Certificate get associated to the private key pair? [duplicate]
I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
2
votes
1answer
81 views
How can I store and manage my GPG key pair securely?
I've taken measures and thoughts on how to securely store and manage my key pair. In the process of it a few questions arose, which I'm not capable of answering yet. My key pair will be used to ...
0
votes
0answers
57 views
Windows X.509 certificate private keys lost
Have the same certificates installed on several machines, but this happens on only one of them.
The certificates are self-signed certificates.
The certificates are used for WCF message security.
...
0
votes
1answer
53 views
Storing a key in a symmetric encryption for password manager using cryptography module
I am making a password generator and manager, I make a the user create login information, I hash their password. I then generate the password and I encrypt the password with a key that is stored ...
2
votes
1answer
72 views
ssh-keygen: How to guarantee the uniqueness of serial numbers?
(FYI: I'm using Ubuntu 18.04 Desktop although I don't think my question is platform-dependent.)
I read the article Scalable and secure access with SSH and it says:
... if you want to use revocation ...
1
vote
0answers
36 views
Browser session storage
Is it some secure way to store private keys in session storage? or is there any place to store that info securely?
1
vote
1answer
44 views
Key pairs extension / version
I read in some docs, there are several version of GPG key extension available.
For ex: gpg, ascii, p12
I know .gpg extension is in binary, and Ascii is in text.
But I want to know their differences ...
2
votes
0answers
101 views
Long-term symmetric key storage
I have some sensitive data that I need to encrypt and retain long-term (i.e., 5+ years at least). I'd ideally like to secure it using multiple hardware devices via a Shamir share. Something like:
...
7
votes
2answers
1k views
TPM or OpenSSL for key generation?
I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
2
votes
0answers
91 views
How can I get `gpg` to sign with certain key again (end of file error)
Disclaimer: This is a cross-post after I initially was looking for help on the Gentoo forums since I suspected some major update of my Gentoo system to be the reason behind my problem.
However, since ...
1
vote
1answer
38 views
Private keys with or without password for webservices?
What is the industry standard on this matter? How do you handle the keys for your websites, apis, micro-services, etc.
If I create private keys without password they will be 100% compromised if one ...
5
votes
3answers
726 views
Hierarchical Key Rotation. Should I rotate the lowest level keys?
I have a hierarchical key system designed for my project. In this system a block of data is encrypted using a Data Encryption Key (DEK). This DEK is encrypted using a Key Encryption Key (KEK) which is ...
0
votes
1answer
200 views
It's secure to store private keys in AWS Secret Manager?
I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
2
votes
1answer
163 views
How can Bitwarden claim it cannot access your passwords if the vault password is the same as the web account password?
Bitwarden claims that it is more secure than traditional cloud password managers (such as Google) as it only stores the encrypted version of the passwords database. But for some reason the password ...
0
votes
0answers
25 views
Seamless Key Management with Key Management Systems?
I'm keeping it vague on purpose so that it can help other cases as well.
Goal
The goal is to store information that is encrypted on client side and then delivered to the database.
Server should never ...
0
votes
0answers
39 views
KMS Key Exposure
I've found some KMS key exposed in some code and am wondering what exactly the severity would be.
What could an attacker achieve by having this key?
1
vote
0answers
59 views
Is it ok to store my Android app keystore password in a text file on my disk?
I am reading on how to sign and publish my flutter app on android.
When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
0
votes
1answer
77 views
if computer is compromised, does hardware key still protect in ssh?
Let's say I sign into my local pc with a hardware key (eg yubicon). Let's say I further sign into a sensitive server (as root) via ssh using yubicon hardware key as well (ie only way to get into ...
0
votes
1answer
57 views
Information disclosure via ktpass tool
The Microsoft ktpass tool can be used to generate a .keytab file that contains a secret key. I'd like to understand the output of the tool.
An example output can be found here. I'm interested in the ...
1
vote
0answers
37 views
Securing API keys for accessing Google APIs via Front End (UI)
This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below.
We currently have hybrid ...
0
votes
1answer
97 views
Most secure way to store a cryptographic key for encrypting/decrypting stored application data
I would like to encrypt some of my application data stored on a MySQL DB using AES-128. I wonder thus what is the best way to store my key on the webserver.
Should I encrypt the key itself or store it ...
0
votes
2answers
102 views
How safe is XOR with multiple preprinted stainless steel key tags purchased from different channel?
This is related to https://crypto.stackexchange.com/questions/48622/how-safe-is-xor-with-multiple-independent-but-non-random-keys but not exactly the same question.
Let's say there are three different ...
0
votes
1answer
57 views
Azure Ad B2C Users access resources in other directory
I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
1
vote
0answers
33 views
Reusing content-encryption key in cms enveloped data
OpenSSL keeps the structure CMS_ContentInfo opaque and in the case of enveloped data generates and manages the content-encryption key completely by itself. It is not possible to provide a content-...
-1
votes
1answer
67 views
How to secure the key in an offline package
I have a package to be shared to Bob which contains:
an encrypted data.zip
Application, which will have logic to decrypt the data
Bob will run Application and it will decrypt the data.zip.
Now for ...
0
votes
2answers
97 views
pgp public key failed to propogate
I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key ...
2
votes
1answer
106 views
Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?
I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
1
vote
1answer
179 views
Is this a good way to manage encryption keys?
I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything
from a leave of absence form to potentially confidential agreements.
Being ...
1
vote
1answer
87 views
use custom 'key' for hardware security keys
Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
0
votes
1answer
209 views
Which would be the best “keyfile” for KeepassXC and/or Veracrypt?
I am a Mac user. I opened a keyfile generated by Veracrypt and one generated by KeepassXC. The texts in both of them were quite short. Which keyfile is best (i.e., most random and harder to break ...
0
votes
0answers
38 views
Handling API keys for client-side app with cloud key vault
I would like to hear about the security implications of my desktop app's current API usage workflow:
Client-side WPF desktop app connects to Azure Key Vault, a cloud vault, by authenticating via a ...
1
vote
1answer
111 views
Web developer needs customer's private key
As a non security expert, I'm looking for advice from those who are.
I work with company X who have hired company Y to develop their website. Company Y needs to integrate server-side online payment ...
0
votes
1answer
78 views
What's a secure way to generate a keypair from a secret password?
I like to generate a public-private key pair that is seeded from a string. So having the string and the generation algorithm is enough to recreate the keys. I want to do this because I can then ...
1
vote
1answer
77 views
Subkey rotation and revocation
If I decided today get new subkeys because I simply want to rotate them or because they are about to expire, do I have to sign all keys of other people I signed with my old signing key again? And if I ...
2
votes
0answers
147 views
What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?
My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home.
Since the laptop uses BitLocker ...
0
votes
0answers
217 views
Why do I need --batch to import a secret key from a pipe?
Once I used this guide to transfer my secret key to my smartphone, so today I did the same thing for transfering the secret key from my workstation to my laptop.
Yes, I could have used a USB key, or I ...
1
vote
1answer
121 views
An intranet web app for decrypting values : a bad idea, and if so, why?
We have to protect a database connection string for a .NET desktop application that has an application-level database user. One option is to encrypt a section of the app.config using asp_regiis. But ...
0
votes
0answers
39 views
GPG Questions About Exporting Subkeys to File
GPG novice here so please bear with me.
From what I understand, when you generate a keypair with GPG it will automatically create a subkey pair (sub, ssb).
If I wanted to give these to another party ...
1
vote
2answers
97 views
How to devise cryptographic system with sharing ability
I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
0
votes
0answers
214 views
Should Group Key Update Interval be Off or On?
My router has this option and I was wondering if it should be turned off or on for better security? If it is better security to leave it on what is the best interval for maximum security?
3
votes
3answers
143 views
Drawback of Multi Level Encryption
I am backing up my files to a RAID mirrored HDD, that has full disk encryption (FDE) in place with LUKS. Until now I did this with rsync, but I recently switched to a new backup program that does file ...
1
vote
1answer
36 views
Storing private keys for updates to remote device
I'm reading up on how to perform signed updates for remote hardware devices. I need to check if the new software has been generated by a "trusted" source, ie me.
Based on my understanding of ...
1
vote
1answer
69 views
Can I copy a PGP revocation to another server?
I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
5
votes
2answers
225 views
Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?
I implemented this kind of authentication for my REST API, is this secure and is my logic sound?
I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
9
votes
8answers
6k views
Can a large corporation make a believable promise
Say there is a secret encryption key that a third party has to handle. The third party is supposed to destroy the secret key when they are done, and tell everyone else it was destroyed and therefore ...
3
votes
4answers
209 views
Methods for backing up key on paper
What are the methods to backup a key to paper?
The idea is to have reasonable protection and the ability to restore the key in case of the digital backup is lost.
Are there things that convert a ...
0
votes
0answers
53 views
Password Vault Storing Passwords
I've been working on just a fun side project in C++ to practice encryption algorithms and I sort of ran into a bit of a roadblock of sorts. To summarize the project I have a text file of encrypted ...
0
votes
0answers
63 views
SSL/TLS communication in connected embedded (IoT) device
while establishing the SSL/TLS based communication in an embedded device, is it necessary that device needs to acquire the keys/certificates from a CA? I read that there is also provision for device ...
5
votes
2answers
382 views
What is the difference between the many identifiers in GnuPG?
GnuPG seems to have number of different ways to refer to a (sub)key(pair):
Key IDs
Fingerprints
Keygrips
Additionally, gpg --list-sigs seems to show hexadecimal identifiers for signatures and such ...
1
vote
0answers
62 views
Is this reasonable privacy for storing sensitive information?
Outline
I am writing a web app that will need to store some transaction data (amount, date, merchant...).
Objective
I want to keep this data reasonably private from unwelcome eyes.
Threat Model
...
