Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
800
questions
0
votes
1answer
38 views
Is there an encryption mechanism for binary data with expiration for rotating keys?
We have a web server with an application - there is a large data array attached to the application via a mount point. We have to fulfill the requirement of securing in-transit data and at-rest data. ...
0
votes
0answers
19 views
Nitro Enclave / KMS Equivalent for Google and Azure
In AWS KMS I can set a key policy on a CMK so that it can only be used from within a Nitro Enclave that either has a particular signature or a particular image hash. Is there something similar to this ...
0
votes
1answer
26 views
Is there any standard or protocol of key exchange between multiple nodes?
A little context: I'm working in designing a system to sign and verify data sent between modules of a bigger system. Currently the system has two parts, a central application and a SDK inside modules ...
0
votes
1answer
64 views
E2E-Encrypted storage: What to do when the lifetime of a key is over?
When using AES-GCM-256 with random nonces, a limit of 2^32 encryptions is specified in order to have a low nonce collision probability. A new key has to be generated to take its place afterwards, I am ...
20
votes
3answers
6k views
Not understanding why I should use public/private key encryption over password?
My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue.
Now ...
0
votes
1answer
64 views
I want my customers to download the encrypted video file to a secured usb and play it directly in TV by providing unique key which i shared to them
How do I make sure that this content is not hacked by anyone ?
Do I encrypt every file and store the key before my customers download their unique copy?
0
votes
0answers
18 views
Is there hardware (like u2f-keys) for passwordless client-side encryption & decryption [duplicate]
I know that u2f keys are designed as authentication factors, but I think it would not be far fetched to also add a protocol that the user can use to encrypt or decrypt data on the client-side. This ...
0
votes
0answers
17 views
How do i store Private and Public keys in Google Cloud [migrated]
So, we have our own Internal CA which needs to the signing for internal app. So, do I store the Root CA's private and public key in Google Secrets?
These keys will need to be accessed to sign CSR, ...
0
votes
1answer
149 views
How to get PGP key passphrase out of Thunderbird?
I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it ...
0
votes
1answer
58 views
How to securely encrypt shared data for a dynamic amount of users?
Example:
Bob uploads a file to my custom file server locked with a password, which then the file server generates a link for him to share
Bob wants to be able to share this data to anyone that has ...
0
votes
1answer
73 views
Storing client keys in cloud app
I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, ...
0
votes
0answers
136 views
How to get Future Keys (Session Key) from IPEK for decryption data?
I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal.
So far, when I receive KSN and encrypted data, I understand that I ...
0
votes
1answer
77 views
Where is the PDF encryption key stored
Assuming you have the user protected PDF file. Using the password, the cryptographic key is generated and the file encrypted. Where is the key stored, is it on the RAM every time the file is opened?
1
vote
1answer
140 views
How does a Certificate get associated to the private key pair? [duplicate]
I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
2
votes
1answer
146 views
How can I store and manage my GPG key pair securely?
I've taken measures and thoughts on how to securely store and manage my key pair. In the process of it a few questions arose, which I'm not capable of answering yet. My key pair will be used to ...
0
votes
0answers
72 views
Windows X.509 certificate private keys lost
Have the same certificates installed on several machines, but this happens on only one of them.
The certificates are self-signed certificates.
The certificates are used for WCF message security.
...
0
votes
1answer
67 views
Storing a key in a symmetric encryption for password manager using cryptography module
I am making a password generator and manager, I make a the user create login information, I hash their password. I then generate the password and I encrypt the password with a key that is stored ...
2
votes
1answer
94 views
ssh-keygen: How to guarantee the uniqueness of serial numbers?
(FYI: I'm using Ubuntu 18.04 Desktop although I don't think my question is platform-dependent.)
I read the article Scalable and secure access with SSH and it says:
... if you want to use revocation ...
1
vote
0answers
40 views
Browser session storage
Is it some secure way to store private keys in session storage? or is there any place to store that info securely?
1
vote
1answer
70 views
Key pairs extension / version
I read in some docs, there are several version of GPG key extension available.
For ex: gpg, ascii, p12
I know .gpg extension is in binary, and Ascii is in text.
But I want to know their differences ...
2
votes
0answers
109 views
Long-term symmetric key storage
I have some sensitive data that I need to encrypt and retain long-term (i.e., 5+ years at least). I'd ideally like to secure it using multiple hardware devices via a Shamir share. Something like:
...
7
votes
2answers
1k views
TPM or OpenSSL for key generation?
I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
2
votes
0answers
103 views
How can I get `gpg` to sign with certain key again (end of file error)
Disclaimer: This is a cross-post after I initially was looking for help on the Gentoo forums since I suspected some major update of my Gentoo system to be the reason behind my problem.
However, since ...
1
vote
1answer
44 views
Private keys with or without password for webservices?
What is the industry standard on this matter? How do you handle the keys for your websites, apis, micro-services, etc.
If I create private keys without password they will be 100% compromised if one ...
5
votes
3answers
802 views
Hierarchical Key Rotation. Should I rotate the lowest level keys?
I have a hierarchical key system designed for my project. In this system a block of data is encrypted using a Data Encryption Key (DEK). This DEK is encrypted using a Key Encryption Key (KEK) which is ...
0
votes
1answer
388 views
It's secure to store private keys in AWS Secret Manager?
I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
2
votes
1answer
243 views
How can Bitwarden claim it cannot access your passwords if the vault password is the same as the web account password?
Bitwarden claims that it is more secure than traditional cloud password managers (such as Google) as it only stores the encrypted version of the passwords database. But for some reason the password ...
0
votes
0answers
30 views
Seamless Key Management with Key Management Systems?
I'm keeping it vague on purpose so that it can help other cases as well.
Goal
The goal is to store information that is encrypted on client side and then delivered to the database.
Server should never ...
0
votes
0answers
43 views
KMS Key Exposure
I've found some KMS key exposed in some code and am wondering what exactly the severity would be.
What could an attacker achieve by having this key?
1
vote
0answers
65 views
Is it ok to store my Android app keystore password in a text file on my disk?
I am reading on how to sign and publish my flutter app on android.
When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
0
votes
1answer
83 views
if computer is compromised, does hardware key still protect in ssh?
Let's say I sign into my local pc with a hardware key (eg yubicon). Let's say I further sign into a sensitive server (as root) via ssh using yubicon hardware key as well (ie only way to get into ...
0
votes
1answer
62 views
Information disclosure via ktpass tool
The Microsoft ktpass tool can be used to generate a .keytab file that contains a secret key. I'd like to understand the output of the tool.
An example output can be found here. I'm interested in the ...
1
vote
0answers
50 views
Securing API keys for accessing Google APIs via Front End (UI)
This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below.
We currently have hybrid ...
0
votes
1answer
106 views
Most secure way to store a cryptographic key for encrypting/decrypting stored application data
I would like to encrypt some of my application data stored on a MySQL DB using AES-128. I wonder thus what is the best way to store my key on the webserver.
Should I encrypt the key itself or store it ...
0
votes
2answers
105 views
How safe is XOR with multiple preprinted stainless steel key tags purchased from different channel?
This is related to https://crypto.stackexchange.com/questions/48622/how-safe-is-xor-with-multiple-independent-but-non-random-keys but not exactly the same question.
Let's say there are three different ...
0
votes
1answer
87 views
Azure Ad B2C Users access resources in other directory
I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
1
vote
0answers
36 views
Reusing content-encryption key in cms enveloped data
OpenSSL keeps the structure CMS_ContentInfo opaque and in the case of enveloped data generates and manages the content-encryption key completely by itself. It is not possible to provide a content-...
-1
votes
1answer
91 views
How to secure the key in an offline package
I have a package to be shared to Bob which contains:
an encrypted data.zip
Application, which will have logic to decrypt the data
Bob will run Application and it will decrypt the data.zip.
Now for ...
0
votes
2answers
122 views
pgp public key failed to propogate
I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key ...
2
votes
1answer
137 views
Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?
I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
1
vote
1answer
222 views
Is this a good way to manage encryption keys?
I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything
from a leave of absence form to potentially confidential agreements.
Being ...
1
vote
1answer
97 views
use custom 'key' for hardware security keys
Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
0
votes
1answer
298 views
Which would be the best “keyfile” for KeepassXC and/or Veracrypt?
I am a Mac user. I opened a keyfile generated by Veracrypt and one generated by KeepassXC. The texts in both of them were quite short. Which keyfile is best (i.e., most random and harder to break ...
0
votes
0answers
40 views
Handling API keys for client-side app with cloud key vault
I would like to hear about the security implications of my desktop app's current API usage workflow:
Client-side WPF desktop app connects to Azure Key Vault, a cloud vault, by authenticating via a ...
1
vote
1answer
120 views
Web developer needs customer's private key
As a non security expert, I'm looking for advice from those who are.
I work with company X who have hired company Y to develop their website. Company Y needs to integrate server-side online payment ...
0
votes
1answer
89 views
What's a secure way to generate a keypair from a secret password?
I like to generate a public-private key pair that is seeded from a string. So having the string and the generation algorithm is enough to recreate the keys. I want to do this because I can then ...
1
vote
1answer
100 views
Subkey rotation and revocation
If I decided today get new subkeys because I simply want to rotate them or because they are about to expire, do I have to sign all keys of other people I signed with my old signing key again? And if I ...
2
votes
0answers
217 views
What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?
My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home.
Since the laptop uses BitLocker ...
1
vote
1answer
122 views
An intranet web app for decrypting values : a bad idea, and if so, why?
We have to protect a database connection string for a .NET desktop application that has an application-level database user. One option is to encrypt a section of the app.config using asp_regiis. But ...
1
vote
2answers
108 views
How to devise cryptographic system with sharing ability
I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
