Skip to main content

Questions tagged [key]

Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.

Filter by
Sorted by
Tagged with
3 votes
1 answer
1k views

What is the point of the “AES Key Wrap” algorithm?

What is the point of the “AES Key Wrap” algorithm prescribed for use with CMS-like contexts in IETF RFC 3394? Just look at the algorithm (tacked on to the end of this post), informally, it smells a ...
1 vote
2 answers
410 views

How to manage Encryption Key for Server Side Encryption in AWS S3

I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows: All the existing data ...
0 votes
1 answer
70 views

Why is the boot key used to access the encrypted SAM database hashes?

A quick something I’ve been wondering: why is the boot key used to access the encrypted SAM database hashes, (and not another key,) and also what encryption mechanism is actually used to encrypt the ...
0 votes
1 answer
287 views

Secure chat application with multiple users on one device?

I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application. My thought was to store a private key in ...
1 vote
3 answers
3k views

What format is this private key in, and how can I process it using bouncycastle?

I have the following private key. I'd like to be able to process it into an instance of ECPrivateKey using Bouncycastle (or the builtin Java security API if bouncycastle isn't necessary). -----BEGIN ...
1 vote
1 answer
253 views

Detecting signal amplification attacks against PKE keyless fobs

During the early hours of the morning there was an attempt to enter and presumably steal various vehicles on my street, detected well after the fact via householders reviewing CCTV motion detection ...
1 vote
1 answer
554 views

CVV2 calculation with TR-31 Key

I need to use the CVK Key (in key block format) to calculate the CVV2. In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
3 votes
3 answers
5k views

Securely changing Veracrypt password

How can I change a Veracrypt (master) password efficiently and securely? Based on the answers here, it is not safe to use system --> change password due to various reasons. I cannot simply image ...
0 votes
1 answer
293 views

PCI compliance - use of ANSI X9.17 for export keys

we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
5 votes
1 answer
2k views

OpenVPN Key Size 1024 vs 2048 and Eavesdrop vs Access?

OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size. I'm trying to determine if it's worth ...
0 votes
0 answers
74 views

Rotate or replace EMV keys?

I would like to better understand the mechanism of rotation of EMV keys used for payment cards. Assuming that it intends to provide a rotation of the keys used for the production cards: just recycle ...
2 votes
0 answers
323 views

PGP expired encryption subkey : renew or replace?

I am in the process of learning PGP (GnuPG more precisely). I am trying to figure out which is the best strategy for my encryption ([E]) subkey in terms of expiration/revocation/renewal. Could you ...
2 votes
1 answer
220 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
0 votes
0 answers
166 views

HSM Thales PayShield vulnerabilities

My management requested to investigate about security of HSM Thales Payshield. Have you ever heard of any security bugs on the HSM Thales Payshield? I mean, except for the known bugs reported in their ...
6 votes
2 answers
6k views

Difference in ECDSA private key format

I have two private ssh keys, - one was originally created with ssh-keygen the other one with a python script. They are supposed to be the same, however one works for authentication and the other one ...
0 votes
0 answers
79 views

Security implication of loading untrusted private keys

The FIPS draft for Dilithium signature scheme (official name ML-DSA) had just been released not long ago. In the specification for skDecode (which is the subroutine that loads the private signing key) ...
1 vote
1 answer
120 views

Key Hash With Securely-Optimal Setting : For Encryption vs For Password

Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ? So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
1 vote
1 answer
359 views

The NIST randomness tests for a generated key

Does different tests for key randomness provided by NIST are available online? where one can test that which test for key generated are passed and which are failed?
0 votes
1 answer
217 views

Permanent Keys/Secrets in TLS 1.3

In TLS 1.3 (RFC8446), there are many secrets and keys. As far as I've understood, every certificate (usually only the server) has a long term key associated with it which is used with HKDF to generate ...
12 votes
6 answers
5k views

Can secrets be made safe in memory?

Say, I am running an application on a cloud server such as AWS. Suppose I supply a key at run-time (so its not stored anywhere alongside/inside code), is there a way to secure this key in memory? So ...
3 votes
1 answer
496 views

Can someone with access to only my Yubikey gain access to my server that has SSH access via an ED25519-sk keypair?

My understanding is that an ED25519-sk SSH key generated by OpenSSH generates a private key stub that lives on your host machine. This stub is just a reference to the actual private key that lives on ...
2 votes
0 answers
182 views

How do you know what KDF was used to protect an SSH-Key?

Assuming I have found several OpenSSH private keys on my client's system, how can I detect (at scale) which of them are: completely unprotected (i.e. no passphrase) using an old hashing algorithm for ...
1 vote
2 answers
5k views

Does certutil -delkey actually delete the certificate and private key?

I am trying to delete a certificate and it's private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command ...
1 vote
3 answers
7k views

Tricky apartment key fob copies frequency & code correctly but the copy doesn't work - not a rolling fob

I have this key fob for our apartment building, and I want to make a copy of it. I've taken it to 3 locksmiths who are able to create a copy, but the copies don't work. I've confirmed that it doesn't ...
1 vote
1 answer
904 views

Cracking RSA keys, only given N and e

Is it possible to crack RSA keys when only given N and e? If so, is there a limit to how long N or e can be? How do you go about doing that? In the specific scenario I'm researching, N is about 150 ...
5 votes
1 answer
922 views

Impact of having more X509v3 Key Usage fields than required?

I was wondering if having an "oversubscription" of "Key usage fields" inside a X509v3 certificate can negatively impact the performance and/or the security of a server. For example ...
0 votes
1 answer
111 views

Is my PGP key which I uploaded to sync.net compromised?

I just accidentally uploaded my PGP key in unencrypted format to rsync.net. As far as I know, nobody but me has access to the account. Is my key compromised?
3 votes
1 answer
4k views

Is it safe to send an API key in an HTTPS request? [duplicate]

Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ? We need to send data to a 3rd party from ...
2 votes
1 answer
662 views

Is encryption with MySQL Aes_encrypt() + stored procedure ok?

I would like to do encryption with MySQL AES_ENCRYPT() function used in a stored procedure on the database. Firstly, I changed the encryption block mode from aes-128-ecb to aes-256-cbc in the MySQL ...
3 votes
3 answers
11k views

Why is an HSM required to protect CA certificates (rather than a regular USB token)?

Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on. The same vendors also offer distinct products called HSMs (...
0 votes
3 answers
92 views

Encryption key fuzzing for forensics analysts

I'm trying to make a simple encryption tool for Debian-like systems. I would simply hash a password, use it to lock/unlock a file, and it would never be stored on the drive. My dad threw out the idea ...
1 vote
1 answer
115 views

Changing openssl key/IV when encrypting diffrent rows of data in database?

I'm looking for a way to encrypt data in MySQL database securely. The data come from a web interface from a POST form and each POST request from the user insert a new line in the database. Right now, ...
-3 votes
1 answer
6k views

Write a Python or C program to guess the key [closed]

Key generation program in C: #include <stdio.h> #include <stdlib.h> #include <time.h> #define KEYSIZE 16 void main() { int i; char key[KEYSIZE]...
2 votes
1 answer
2k views

ThinkShield secure wipe - SSD does it forbid data recovering?

I have to give my computer back to my boss. I want to delete all the data from my SSD. I found "ThinkShield secure wipe" which is implemented in the BIOS apparently. It gives me two options: ...
1 vote
1 answer
264 views

Do sites like reddit and Quora expose their Google API client keys to the public?

On Quora, when I want to sign in using Google, I am redirected to this URL, which has a parameter client_id=917071888555.apps.googleusercontent.com. Similarly, reddit takes me here, which has ...
0 votes
4 answers
829 views

Benefits of non-standard SSH port when password authentication is turned off

Is there any benefit of using a non-standard SSH port when PasswordAuthentication is turned off in sshd? The only benefit of non-standard SSH ports I know of is a reduction of the amount of brute ...
0 votes
1 answer
124 views

How can a client safely post/get a (symmetric) client key to/from a key distribution center?

If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
7 votes
1 answer
5k views

Is `gpg --refresh-keys` secure and where is this documented?

From the gpg manual: --refresh-keys Request updates from a keyserver for keys that already exist on the local keyring. This is useful for updating a key with the latest signatures, user IDs, etc. ...
0 votes
1 answer
445 views

deleted a subkey and can now no longer decrypt

My public key had expired so I tried to edit the expiry date with gpg --edit-key It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the ...
1 vote
0 answers
543 views

How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?

Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
0 votes
1 answer
7k views

Static Key Ciphers and key persistence

A vulnerability report states the following: The server is configured to support ciphers known as static key ciphers. These ciphers don't support "Forward Secrecy". In the new specification for ...
1 vote
1 answer
471 views

Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?

When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a ...
0 votes
2 answers
167 views

When will it be feasible to enumerate all possible private/public key pairs [closed]

One way to defeat public key encryption would be to make a list of all public and private key pairings. For 128-bit and 256-bit keys, there are lots of possible pairs: 2^128 = 3.40e38 2^256 = 1.16e77 ...
3 votes
1 answer
4k views

How to securely share sensitive info (such as API keys) with freelancers?

My business partner and I are building a webapplication. We have partnered with some third party services which make use of API (public and secret) keys. The freelance developer we worked with ...
1 vote
0 answers
371 views

Storing AES key for later usage

I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
0 votes
1 answer
687 views

Where should private key(s) reside in IPsec VPN tunnel

I setup an IKE VPN server for road warriors. I actually have this working (YAY!) but took some shortcuts that are leaving me with a working yet not-right/secure setup. My setup is as follows: My ...
-2 votes
2 answers
108 views

Is the term "only-unlocking key" more accurate than the term "private key"?

Paraphrasing this: Symmetric cryptography is like a door lock. Everyone that has a key can lock and unlock. Asymmetric cryptography is like a common lock or handcuff. Anyone can lock it but only the (...
0 votes
0 answers
220 views

Storing an encryption key securely

I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options. Option 1) Storing the key on the same server (not recommended, ...
0 votes
1 answer
2k views

Does alias in a truststore matter?

I was trying to add a new certificate to our truststore. But I got the alias already exists error. I can't remove the old certificate yet, but I have to add the new certificate. Will it matter if I ...
0 votes
0 answers
119 views

Acquiring true randomness for generating a key

Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to ...

1
2 3 4 5