Questions tagged [key-management]

Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

107 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7 votes
2 answers
3k views

Can TPM "Storage Keys" be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
user avatar
5 votes
0 answers
449 views

Sharing subkeys among two master keys

I would like to have a GnuPG identity that I can use both for a long time (so that I can build a wide web of trust) and immediately with as many people as possible. As of today, the second goal is ...
user avatar
  • 55
5 votes
1 answer
948 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
user avatar
4 votes
0 answers
196 views

Encryption data keys in single file at same location

I have an external storage which I am wanting to store encrypted files. Strategy #1: Each file and folder name is AES encrypted with its own data key All data keys are saved into a single datakeys....
user avatar
  • 141
4 votes
1 answer
732 views

How to securely store 3rd party API keys directly on web server

I'm building a private web app that I plan to use between myself and a few select friends. Each of us have API keys for a 3rd party service that my web app needs to access so it can call the 3rd party ...
user avatar
4 votes
0 answers
380 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
user avatar
  • 91
3 votes
0 answers
145 views

Move signing subkey to authentication slot on YubiKey (OpenPGP card)?

My PGP primary key is only used for certification—I use a separate subkey for signing. Like this: sec rsa4096/0x891781D0EDC66456 ...
user avatar
2 votes
0 answers
166 views

Long-term symmetric key storage

I have some sensitive data that I need to encrypt and retain long-term (i.e., 5+ years at least). I'd ideally like to secure it using multiple hardware devices via a Shamir share. Something like: ...
user avatar
  • 123
2 votes
0 answers
212 views

How can I get `gpg` to sign with certain key again (end of file error)

Disclaimer: This is a cross-post after I initially was looking for help on the Gentoo forums since I suspected some major update of my Gentoo system to be the reason behind my problem. However, since ...
user avatar
  • 121
2 votes
1 answer
239 views

Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?

I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
user avatar
  • 121
2 votes
0 answers
502 views

What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?

My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home. Since the laptop uses BitLocker ...
user avatar
2 votes
2 answers
190 views

How to devise cryptographic system with sharing ability

I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
user avatar
2 votes
1 answer
270 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
user avatar
  • 313
2 votes
0 answers
98 views

Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?

We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
user avatar
2 votes
0 answers
173 views

Storing users' private keys to clone git repositories on their behalf

Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
user avatar
2 votes
1 answer
249 views

HSM best practice for access

I've been building a product using AWS CloudHSM and things are working well in the POC. Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
user avatar
  • 679
2 votes
0 answers
89 views

Sharing individually encrypted elements between users of a system

I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file. For simplicity, lets say the unique keys are the file names. I'd ...
user avatar
2 votes
0 answers
688 views

Where To Store Public and Private Key files?

I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting. In my project, I'm generating two files: Public Key file and ...
user avatar
  • 21
2 votes
0 answers
105 views

What is this key management scheme called

We are building a system, where the messages between services is encrypted with Data Encryption Key (DEK). The DEK is attached to the message, but encrypted with another key, Key Encryption Key (KEK)....
user avatar
2 votes
0 answers
273 views

Is it safe to retrieve GnuPG public/secret key with fs in Node.js?

So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
user avatar
2 votes
0 answers
461 views

How to securely store a PIN-encrypted prime number?

Situation: within a mobile application, we're generating and storing a private key (RSA or ECC) which we use to sign miscellaneous requests with (to authenticate using the mobile as a 2nd factor, or ...
user avatar
  • 1,781
2 votes
0 answers
149 views

Key Management and Authentication in Note Taking App with Client-Side Encryption

I've been working for some time on a pet project of mine: a note-taking application similar to Evernote with the difference that all content is client-side encrypted. I would like to get some feedback ...
user avatar
2 votes
0 answers
212 views

Manual IPsec and session key(s)

I am evaluating IPsec. I have determined it is best for my case to not use AH (will use PSK for authentication). One issue I have is that at the start there will be no connectivity, so IKE will not ...
user avatar
  • 315
2 votes
0 answers
818 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
user avatar
  • 1,637
2 votes
1 answer
191 views

How does the password protect the data keys on an encrypted HDD / SSD?

How is the data key used for full disk encryption protected? Is a wrapping key derived from the password, or is it simply unlocked once the password has been supplied? If an existing or proprietary ...
user avatar
1 vote
0 answers
17 views

SIM hardware protection of master and long lived keys

4G and 5G authentication procedures includes master keys or long term keys which are shared between subscribers and Home Networks, for 4G they are called Ki. A case was reported here in which NSA ...
user avatar
1 vote
1 answer
40 views

Best and safest way to store secret key used for PKA on server?

I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example: Create a 0500 access directory on my server ...
user avatar
  • 115
1 vote
0 answers
96 views

Storing AES key for later usage

I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
user avatar
1 vote
0 answers
44 views

Uses for TR-31 Key Version Number?

The standard for TR-31 (and Thales) Key blocks (ref) have a field for "Key Version Number", which is only defined in the spec as Two-digit ASCII character version number, optionally used to ...
user avatar
  • 1,446
1 vote
0 answers
64 views

Is it possible to regenerate the stub private key from just the physical key in OpenSSH?

Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key. If I lose ...
user avatar
  • 111
1 vote
2 answers
152 views

How to manage Encryption Key for Server Side Encryption in AWS S3

I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows: All the existing data ...
user avatar
1 vote
0 answers
237 views

AWS KMS CMK compromise

Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
user avatar
1 vote
1 answer
119 views

Is there any standard or protocol of key exchange between multiple nodes?

A little context: I'm working in designing a system to sign and verify data sent between modules of a bigger system. Currently the system has two parts, a central application and a SDK inside modules ...
user avatar
  • 11
1 vote
1 answer
504 views

How to get Future Keys (Session Key) from IPEK for decryption data?

I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal. So far, when I receive KSN and encrypted data, I understand that I ...
user avatar
1 vote
0 answers
166 views

Windows X.509 certificate private keys lost

Have the same certificates installed on several machines, but this happens on only one of them. The certificates are self-signed certificates. The certificates are used for WCF message security. ...
user avatar
  • 135
1 vote
0 answers
86 views

Browser session storage

Is it some secure way to store private keys in session storage? or is there any place to store that info securely?
user avatar
1 vote
0 answers
125 views

Is it ok to store my Android app keystore password in a text file on my disk?

I am reading on how to sign and publish my flutter app on android. When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
user avatar
  • 111
1 vote
0 answers
187 views

Securing API keys for accessing Google APIs via Front End (UI)

This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below. We currently have hybrid ...
user avatar
1 vote
0 answers
73 views

Reusing content-encryption key in cms enveloped data

OpenSSL keeps the structure CMS_ContentInfo opaque and in the case of enveloped data generates and manages the content-encryption key completely by itself. It is not possible to provide a content-...
user avatar
  • 111
1 vote
1 answer
141 views

Can I copy a PGP revocation to another server?

I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
user avatar
1 vote
0 answers
104 views

Is this reasonable privacy for storing sensitive information?

Outline I am writing a web app that will need to store some transaction data (amount, date, merchant...). Objective I want to keep this data reasonably private from unwelcome eyes. Threat Model ...
user avatar
1 vote
0 answers
158 views

Security of Microsoft key container

How is the security of cryptographic keys stored by Microsoft Windows in the key containers used by CryptoAPI/CNG guaranteed? The keys are stored in the user's directory or a directory for the machine-...
user avatar
  • 111
1 vote
2 answers
259 views

Cloud provider or self-hosted for key-storage?

I was reading this question: Where do you store your personal private GPG key? I have my set up as noted in this comment: Where do you store your personal private GPG key? But instead of using a ...
user avatar
  • 111
1 vote
1 answer
181 views

Implementing key vault and key rotation for a non-cloud application

I have a desktop application written in Python. The application is connects with an external SAP HANA service and pulls data. There are couple of configuration files where several connection string ...
user avatar
  • 195
1 vote
1 answer
115 views

Webhook sending Purchase Details to handling Purchases from a Third Pary Service Secure?

I'm developing a mobile application for a client that sells digital courses on a service called Teachable that hosts their website and handles the purchase process for them. My client wants to keep ...
user avatar
  • 111
1 vote
0 answers
339 views

Does a shared (but encrypted) private key for a group of users reduce the effectiveness of the encryption?

That is, is it generally considered more secure to save a single application-wide private key on the web server compared to storing (protected/encrypted) private keys in the database? More ...
user avatar
  • 113
1 vote
0 answers
73 views

How to authorize a subkey using a primary master key pair?

I'm using webcrypto, not PGP/GPG. I would like to use a key pair to create a "subkey" that is authorized by my primary key in a way anyone can publicly verify so I don't need to expose the primary ...
user avatar
  • 313
1 vote
0 answers
379 views

Why GPG signature is not considered as made by a trusted key?

When I verify a file signature I get the the following warning: $ gpg --verify file.sig gpg: Signature made So 01 Dez 2019 10:08:27 CET gpg: using RSA key <Pierre's key ID> gpg: ...
user avatar
  • 233
1 vote
0 answers
139 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
user avatar
  • 1,089
1 vote
0 answers
107 views

Make key trusted in Enigmail?

I have tried to import a public key of someone into enigmail. The import failed silently (nothing absolutely happened, not even an error). I tried key from file and from clipboard. Then I used gpg --...
user avatar