Questions tagged [key-management]

Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

Passwordless gnome-keyring - Does it present a security issue?

I've been looking around, but I can't seem to find an unified answer for my question. eg. Some say it's safe: What’s the security risk when setting the Gnome keyring password to blank on an FED system ...
user avatar
1 vote
0 answers
23 views

Does the the key used to encrypt in a ransomware attack reside on the target computer for at least some time? [duplicate]

My understanding is that a ransomware uses the target computer's resources to encrypt files. So does that mean that the key used for encryption resides on the target computer for at least some time? I ...
user avatar
0 votes
0 answers
40 views

How to viably use HSM on public cloud providers (AWS or GCP)

I don't have any experience with HSMs. My goal is to secure critical seed phrases used to generate crypto wallets I found a good approach is to use HSMs to store encryption keys and encrypt the seed ...
user avatar
3 votes
1 answer
89 views

Why are key IDs typically the *last* digits of the key hash?

With PGP for example, the "properties" of the following key are: pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02] 6713B62DC36CE36403C724B1FFD641CF2BD6571B uid [...
user avatar
  • 33
0 votes
1 answer
92 views

How do centralized crypto exchanges store seed phrases and users' private keys?

Say I'm trying to develop a CEX, hence I will hold custody of users' keys. How would I go about doing that and ensuring safety and security? From what I know, I can generate the users' keys from a ...
user avatar
1 vote
1 answer
34 views

Export ECDSA certificate from Windows Store

I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
user avatar
1 vote
0 answers
17 views

SIM hardware protection of master and long lived keys

4G and 5G authentication procedures includes master keys or long term keys which are shared between subscribers and Home Networks, for 4G they are called Ki. A case was reported here in which NSA ...
user avatar
0 votes
1 answer
36 views

How can a client safely post/get a (symmetric) client key to/from a key distribution center?

If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
user avatar
0 votes
0 answers
26 views

Import BDK encrypted under the Transport Key KEK on HSM

I received a two-component KEK TDES key and a BDK cryptogram, which is encrypted for this KEK. Do you have any suggestions on how to load such a key into the HSM device? Eg. Luna HSM
user avatar
0 votes
1 answer
61 views

How to preserve key in TPM 2.0

I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
user avatar
0 votes
0 answers
73 views

Alternative to AWS CloudHSM?

I am not using AWS, google cloud or similar. I have a vps on another webhosting service. I am going to encrypt my data but don’t know where the best place to save the encryption keys would be? I can ...
user avatar
1 vote
1 answer
40 views

Best and safest way to store secret key used for PKA on server?

I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example: Create a 0500 access directory on my server ...
user avatar
  • 115
1 vote
1 answer
163 views

Why should encryption key be rotated after it has been used to encrypt a specific amount of data?

I'm going through OWASP Cryptographic Storage Cheat Sheet and it says: Encryption keys should be changed (or rotated) based on a number of different criteria: (...) After the key has been used to ...
user avatar
  • 155
1 vote
0 answers
98 views

Storing AES key for later usage

I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
user avatar
0 votes
1 answer
118 views

Can an encrypted RSA key be committed to git?

I have a pair of RSA keys where the private key is encrypted with a passphrase. Would it be a security risk if the public and private keys are committed to version control without any further ...
user avatar
1 vote
0 answers
44 views

Uses for TR-31 Key Version Number?

The standard for TR-31 (and Thales) Key blocks (ref) have a field for "Key Version Number", which is only defined in the spec as Two-digit ASCII character version number, optionally used to ...
user avatar
  • 1,446
0 votes
0 answers
27 views

Is it possible to configure Github to allow writes to a particular repo/organisation, only from a particular SSH key?

It's not uncommon for an organization to allow developers to use their personal Github to do their work. A potential problem I see with this, is that the organization doesn't have control over that ...
user avatar
1 vote
0 answers
64 views

Is it possible to regenerate the stub private key from just the physical key in OpenSSH?

Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key. If I lose ...
user avatar
  • 111
0 votes
0 answers
47 views

Validate the conformance of an OpenSSL created certificate with FIPs standards

Trying to test the conformance of the certificates inside our application, with the below requirement: The application shall [selection: invoke platform-provided functionality, implement ...
user avatar
0 votes
1 answer
72 views

How to manage a users private key in a secure document storage solution?

I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
user avatar
1 vote
1 answer
313 views

Key management for End-to-end encryption for Chat application

I want to implement end-to-end encryption on my chat application (available on android, iOS and web). For that I've following mechanism in mind. Generate Key pairs (Private key and Public key) on ...
user avatar
1 vote
1 answer
152 views

Does Re-Encryption make our data more secure?

We are focusing on mobile phone and hard drive encryptions. This idea can be extended to any data encryption also. iPhone and recent Androids are all encrypted. We know that changing the password will ...
user avatar
  • 111
0 votes
0 answers
61 views

Strange keystore from payment processor

I am working on an older software for a company at the moment and in my work have been upgrading a number of libraries. The app connects to a web service hosted by the third party payment processor, ...
user avatar
  • 1,092
4 votes
1 answer
111 views

Is it possible to use HKDF in the TPM?

Is it possible to use HKDF in the TPM? My goal is to load in a master symmetric key and derive keys from that using HKDF. I see there are other KDF functions available, but no mention of HKDF.
user avatar
  • 43
0 votes
0 answers
153 views

Almost unattended generation of "a pretty good keypair"

I need to generate quite a lot of gpg-keys for different tasks on my Debian Bullseye (Stable) machine. Also I want the highest level of security while being able to automate as much as possible. ...
user avatar
  • 121
6 votes
1 answer
454 views

How are the PGP keys that Thunderbird 78+ uses encrypted?

With Thunderbird 78, a new PGP subsystem has been introduced which handles PGP keys internally. In previous versions, the add-on Enigmail has handled PGP-related stuff, by letting do GnuPG the work ...
user avatar
  • 547
3 votes
0 answers
145 views

Move signing subkey to authentication slot on YubiKey (OpenPGP card)?

My PGP primary key is only used for certification—I use a separate subkey for signing. Like this: sec rsa4096/0x891781D0EDC66456 ...
user avatar
1 vote
2 answers
152 views

How to manage Encryption Key for Server Side Encryption in AWS S3

I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows: All the existing data ...
user avatar
0 votes
0 answers
93 views

Why does KMIP require to request two keys for AES-XTS?

According to KMIP user’s guide, when a client application desires to retrieve a 512 bits AES-XTS key, it should request 2 separate KMIP keys of 256 bits each. This is to support the structure of an ...
user avatar
  • 21
1 vote
0 answers
237 views

AWS KMS CMK compromise

Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
user avatar
0 votes
1 answer
132 views

Is there an encryption mechanism for binary data with expiration for rotating keys?

We have a web server with an application - there is a large data array attached to the application via a mount point. We have to fulfill the requirement of securing in-transit data and at-rest data. ...
user avatar
1 vote
1 answer
119 views

Is there any standard or protocol of key exchange between multiple nodes?

A little context: I'm working in designing a system to sign and verify data sent between modules of a bigger system. Currently the system has two parts, a central application and a SDK inside modules ...
user avatar
  • 11
0 votes
1 answer
125 views

E2E-Encrypted storage: What to do when the lifetime of a key is over?

When using AES-GCM-256 with random nonces, a limit of 2^32 encryptions is specified in order to have a low nonce collision probability. A new key has to be generated to take its place afterwards, I am ...
user avatar
  • 697
20 votes
3 answers
6k views

Not understanding why I should use public/private key encryption over password?

My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue. Now ...
user avatar
0 votes
1 answer
113 views

I want my customers to download the encrypted video file to a secured usb and play it directly in TV by providing unique key which i shared to them

How do I make sure that this content is not hacked by anyone ? Do I encrypt every file and store the key before my customers download their unique copy?
user avatar
0 votes
0 answers
19 views

Is there hardware (like u2f-keys) for passwordless client-side encryption & decryption [duplicate]

I know that u2f keys are designed as authentication factors, but I think it would not be far fetched to also add a protocol that the user can use to encrypt or decrypt data on the client-side. This ...
user avatar
  • 697
2 votes
2 answers
928 views

How to get PGP key passphrase out of Thunderbird?

I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it ...
user avatar
0 votes
1 answer
111 views

How to securely encrypt shared data for a dynamic amount of users?

Example: Bob uploads a file to my custom file server locked with a password, which then the file server generates a link for him to share Bob wants to be able to share this data to anyone that has ...
user avatar
0 votes
1 answer
115 views

Storing client keys in cloud app

I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, ...
user avatar
1 vote
1 answer
505 views

How to get Future Keys (Session Key) from IPEK for decryption data?

I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal. So far, when I receive KSN and encrypted data, I understand that I ...
user avatar
0 votes
1 answer
410 views

Where is the PDF encryption key stored

Assuming you have the user protected PDF file. Using the password, the cryptographic key is generated and the file encrypted. Where is the key stored, is it on the RAM every time the file is opened?
user avatar
2 votes
1 answer
329 views

How does a Certificate get associated to the private key pair? [duplicate]

I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
user avatar
  • 131
3 votes
1 answer
504 views

How can I store and manage my GPG key pair securely?

I've taken measures and thoughts on how to securely store and manage my key pair. In the process of it a few questions arose, which I'm not capable of answering yet. My key pair will be used to ...
user avatar
1 vote
0 answers
167 views

Windows X.509 certificate private keys lost

Have the same certificates installed on several machines, but this happens on only one of them. The certificates are self-signed certificates. The certificates are used for WCF message security. ...
user avatar
  • 135
0 votes
2 answers
428 views

Storing a key in a symmetric encryption for password manager using cryptography module

I am making a password manager and generator. The user creates the login information, and then I hash their password. After that, I generate the password and encrypt the password with a key stored ...
user avatar
2 votes
1 answer
273 views

ssh-keygen: How to guarantee the uniqueness of serial numbers?

(FYI: I'm using Ubuntu 18.04 Desktop although I don't think my question is platform-dependent.) I read the article Scalable and secure access with SSH and it says: ... if you want to use revocation ...
user avatar
  • 121
1 vote
0 answers
86 views

Browser session storage

Is it some secure way to store private keys in session storage? or is there any place to store that info securely?
user avatar
1 vote
1 answer
239 views

Key pairs extension / version

I read in some docs, there are several version of GPG key extension available. For ex: gpg, ascii, p12 I know .gpg extension is in binary, and Ascii is in text. But I want to know their differences ...
user avatar
  • 13
2 votes
0 answers
166 views

Long-term symmetric key storage

I have some sensitive data that I need to encrypt and retain long-term (i.e., 5+ years at least). I'd ideally like to secure it using multiple hardware devices via a Shamir share. Something like: ...
user avatar
  • 123
8 votes
2 answers
2k views

TPM or OpenSSL for key generation?

I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
user avatar

1
2 3 4 5
17