Questions tagged [key-management]

Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.

101 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
389 views

Sharing subkeys among two master keys

I would like to have a GnuPG identity that I can use both for a long time (so that I can build a wide web of trust) and immediately with as many people as possible. As of today, the second goal is ...
5
votes
2answers
2k views

Can TPM "Storage Keys" be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
5
votes
1answer
869 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
4
votes
0answers
157 views

Encryption data keys in single file at same location

I have an external storage which I am wanting to store encrypted files. Strategy #1: Each file and folder name is AES encrypted with its own data key All data keys are saved into a single datakeys....
4
votes
0answers
333 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
3
votes
0answers
80 views

How are the PGP keys that Thunderbird 78+ uses encrypted?

With Thunderbird 78, a new PGP subsystem has been introduced which handles PGP keys internally. In previous versions, the add-on Enigmail has handled PGP-related stuff, by letting do GnuPG the work ...
3
votes
1answer
616 views

How to securely store 3rd party API keys directly on web server

I'm building a private web app that I plan to use between myself and a few select friends. Each of us have API keys for a 3rd party service that my web app needs to access so it can call the 3rd party ...
2
votes
0answers
111 views

Long-term symmetric key storage

I have some sensitive data that I need to encrypt and retain long-term (i.e., 5+ years at least). I'd ideally like to secure it using multiple hardware devices via a Shamir share. Something like: ...
2
votes
0answers
111 views

How can I get `gpg` to sign with certain key again (end of file error)

Disclaimer: This is a cross-post after I initially was looking for help on the Gentoo forums since I suspected some major update of my Gentoo system to be the reason behind my problem. However, since ...
2
votes
1answer
143 views

Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?

I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
2
votes
0answers
248 views

What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?

My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home. Since the laptop uses BitLocker ...
2
votes
0answers
94 views

Security of Microsoft key container

How is the security of cryptographic keys stored by Microsoft Windows in the key containers used by CryptoAPI/CNG guaranteed? The keys are stored in the user's directory or a directory for the machine-...
2
votes
1answer
198 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
2
votes
0answers
55 views

Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?

We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
2
votes
0answers
124 views

Storing users' private keys to clone git repositories on their behalf

Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
2
votes
0answers
49 views

Sharing individually encrypted elements between users of a system

I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file. For simplicity, lets say the unique keys are the file names. I'd ...
2
votes
0answers
589 views

Where To Store Public and Private Key files?

I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting. In my project, I'm generating two files: Public Key file and ...
2
votes
0answers
62 views

What is this key management scheme called

We are building a system, where the messages between services is encrypted with Data Encryption Key (DEK). The DEK is attached to the message, but encrypted with another key, Key Encryption Key (KEK)....
2
votes
0answers
208 views

Is it safe to retrieve GnuPG public/secret key with fs in Node.js?

So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
2
votes
0answers
408 views

How to securely store a PIN-encrypted prime number?

Situation: within a mobile application, we're generating and storing a private key (RSA or ECC) which we use to sign miscellaneous requests with (to authenticate using the mobile as a 2nd factor, or ...
2
votes
0answers
115 views

Key Management and Authentication in Note Taking App with Client-Side Encryption

I've been working for some time on a pet project of mine: a note-taking application similar to Evernote with the difference that all content is client-side encrypted. I would like to get some feedback ...
2
votes
0answers
167 views

Manual IPsec and session key(s)

I am evaluating IPsec. I have determined it is best for my case to not use AH (will use PSK for authentication). One issue I have is that at the start there will be no connectivity, so IKE will not ...
2
votes
0answers
747 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
2
votes
1answer
145 views

How does the password protect the data keys on an encrypted HDD / SSD?

How is the data key used for full disk encryption protected? Is a wrapping key derived from the password, or is it simply unlocked once the password has been supplied? If an existing or proprietary ...
1
vote
0answers
41 views

Move signing subkey to authentication slot on YubiKey (OpenPGP card)?

My PGP primary key is only used for certification—I use a separate subkey for signing. Like this: sec rsa4096/0x891781D0EDC66456 ...
1
vote
2answers
55 views

How to manage Encryption Key for Server Side Encryption in AWS S3

I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows: All the existing data ...
1
vote
0answers
42 views

Browser session storage

Is it some secure way to store private keys in session storage? or is there any place to store that info securely?
1
vote
0answers
67 views

Is it ok to store my Android app keystore password in a text file on my disk?

I am reading on how to sign and publish my flutter app on android. When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
1
vote
0answers
53 views

Securing API keys for accessing Google APIs via Front End (UI)

This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below. We currently have hybrid ...
1
vote
0answers
36 views

Reusing content-encryption key in cms enveloped data

OpenSSL keeps the structure CMS_ContentInfo opaque and in the case of enveloped data generates and manages the content-encryption key completely by itself. It is not possible to provide a content-...
1
vote
1answer
98 views

use custom 'key' for hardware security keys

Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
1
vote
2answers
110 views

How to devise cryptographic system with sharing ability

I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
1
vote
1answer
78 views

Can I copy a PGP revocation to another server?

I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
1
vote
0answers
62 views

Is this reasonable privacy for storing sensitive information?

Outline I am writing a web app that will need to store some transaction data (amount, date, merchant...). Objective I want to keep this data reasonably private from unwelcome eyes. Threat Model ...
1
vote
2answers
157 views

Cloud provider or self-hosted for key-storage?

I was reading this question: Where do you store your personal private GPG key? I have my set up as noted in this comment: Where do you store your personal private GPG key? But instead of using a ...
1
vote
1answer
109 views

Implementing key vault and key rotation for a non-cloud application

I have a desktop application written in Python. The application is connects with an external SAP HANA service and pulls data. There are couple of configuration files where several connection string ...
1
vote
1answer
68 views

Webhook sending Purchase Details to handling Purchases from a Third Pary Service Secure?

I'm developing a mobile application for a client that sells digital courses on a service called Teachable that hosts their website and handles the purchase process for them. My client wants to keep ...
1
vote
0answers
183 views

Does a shared (but encrypted) private key for a group of users reduce the effectiveness of the encryption?

That is, is it generally considered more secure to save a single application-wide private key on the web server compared to storing (protected/encrypted) private keys in the database? More ...
1
vote
0answers
29 views

How to authorize a subkey using a primary master key pair?

I'm using webcrypto, not PGP/GPG. I would like to use a key pair to create a "subkey" that is authorized by my primary key in a way anyone can publicly verify so I don't need to expose the primary ...
1
vote
0answers
127 views

Why GPG signature is not considered as made by a trusted key?

When I verify a file signature I get the the following warning: $ gpg --verify file.sig gpg: Signature made So 01 Dez 2019 10:08:27 CET gpg: using RSA key <Pierre's key ID> gpg: ...
1
vote
0answers
331 views

Why does Microsoft recommend storing the ASP.NET Core DataProtection Key Ring in EFCore?

After many years that accepted best practice was to never store keys in a database, but Microsoft now recommends storing the data protection key ring (encrypted with certificate) in the database using ...
1
vote
0answers
75 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
1
vote
0answers
153 views

HSM best practice for access

I've been building a product using AWS CloudHSM and things are working well in the POC. Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
1
vote
0answers
303 views

Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey

I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
1
vote
0answers
74 views

Make key trusted in Enigmail?

I have tried to import a public key of someone into enigmail. The import failed silently (nothing absolutely happened, not even an error). I tried key from file and from clipboard. Then I used gpg --...
1
vote
0answers
32 views

Generating new E and S subkeys for a key that has been moved to card

I accidentally messed up months ago by keytocard'ing a seret key before making an offline locked-away backup of it. I failed at reading comprehension and did not know that this would delete the key ...
1
vote
0answers
27 views

What measures are used to protect private keys on credit card processing devices?

For example, a device that accepts credit card payment to update a store card. These are usually embedded devices with a hard drive for permanent storage. Would it not be possible for a hacker to ...
1
vote
0answers
155 views

Password protected secrets on Vault

We're currently improving our custom secrets management system and I'm looking into different solutions such as Hashicorp Vault or AWS KMS. So far Vault seems to meet most of our current requirements,...
1
vote
0answers
209 views

Android Secure Keystore pre-API 19

Is there any secure Keystore for Android other than Android Keystore? If an attacker used an emulator, saving a key in SharedPreferences or storage is pretty much useless since she'll have direct ...
1
vote
0answers
180 views

Best way to store AES keys (web api) while dealing with multi tenants (key per tenant)

I have some data to encrypt on my database and every tenant will have his own database so surely every tenant will have a different key. I'm searching for the best way to store the key for every ...