Questions tagged [key]
Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.
212
questions
1
vote
1
answer
206
views
CVV2 calculation with TR-31 Key
I need to use the CVK Key (in key block format) to calculate the CVV2.
In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
CommunityBot
- 1
3
votes
3
answers
4k
views
Securely changing Veracrypt password
How can I change a Veracrypt (master) password efficiently and securely?
Based on the answers here, it is not safe to use system --> change password due to various reasons.
I cannot simply image ...
CommunityBot
- 1
0
votes
1
answer
114
views
PCI compliance - use of ANSI X9.17 for export keys
we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
CommunityBot
- 1
5
votes
1
answer
2k
views
OpenVPN Key Size 1024 vs 2048 and Eavesdrop vs Access?
OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size. I'm trying to determine if it's worth ...
CommunityBot
- 1
2
votes
1
answer
180
views
Malware abusing SSH agent active keys
I am thinking about this lately a lot, so I wanted to get someone else's opinion.
Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
- 407
0
votes
0
answers
63
views
HSM Thales PayShield vulnerabilities
My management requested to investigate about security of HSM Thales Payshield.
Have you ever heard of any security bugs on the HSM Thales Payshield? I mean, except for the known bugs reported in their ...
- 128k
6
votes
2
answers
5k
views
Difference in ECDSA private key format
I have two private ssh keys, - one was originally created with ssh-keygen the other one with a python script. They are supposed to be the same, however one works for authentication and the other one ...
- 10.6k
0
votes
0
answers
40
views
Security implication of loading untrusted private keys
The FIPS draft for Dilithium signature scheme (official name ML-DSA) had just been released not long ago. In the specification for skDecode (which is the subroutine that loads the private signing key) ...
- 370
1
vote
2
answers
342
views
How to manage Encryption Key for Server Side Encryption in AWS S3
I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows:
All the existing data ...
CommunityBot
- 1
0
votes
1
answer
206
views
Secure chat application with multiple users on one device?
I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application.
My thought was to store a private key in ...
CommunityBot
- 1
0
votes
3
answers
2k
views
What format is this private key in, and how can I process it using bouncycastle?
I have the following private key. I'd like to be able to process it into an instance of ECPrivateKey using Bouncycastle (or the builtin Java security API if bouncycastle isn't necessary).
-----BEGIN ...
CommunityBot
- 1
1
vote
1
answer
102
views
Detecting signal amplification attacks against PKE keyless fobs
During the early hours of the morning there was an attempt to enter and presumably steal various vehicles on my street, detected well after the fact via householders reviewing CCTV motion detection ...
CommunityBot
- 1
1
vote
1
answer
72
views
Key Hash With Securely-Optimal Setting : For Encryption vs For Password
Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ?
So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
- 46.4k
1
vote
1
answer
305
views
The NIST randomness tests for a generated key
Does different tests for key randomness provided by NIST are available online? where one can test that which test for key generated are passed and which are failed?
0
votes
0
answers
108
views
Management of CVK key in Key Block format
I use a Thales PayShield 10K with a LMK KeyBlock 3DES. I have to send a CVK Key to a Scheme for the valorization of CVV2 value. Now, in my envorinment i generated a CVK Key with "Key Usage"= ...
- 11
0
votes
1
answer
98
views
Permanent Keys/Secrets in TLS 1.3
In TLS 1.3 (RFC8446), there are many secrets and keys. As far as I've understood, every certificate (usually only the server) has a long term key associated with it which is used with HKDF to generate ...
- 3,438
12
votes
6
answers
4k
views
Can secrets be made safe in memory?
Say, I am running an application on a cloud server such as AWS. Suppose I supply a key at run-time (so its not stored anywhere alongside/inside code), is there a way to secure this key in memory?
So ...
- 128k
3
votes
1
answer
364
views
What is the point of the “AES Key Wrap” algorithm?
What is the point of the “AES Key Wrap” algorithm prescribed for use with CMS-like contexts in IETF RFC 3394?
Just look at the algorithm (tacked on to the end of this post), informally, it smells a ...
- 34.1k
3
votes
1
answer
262
views
Can someone with access to only my Yubikey gain access to my server that has SSH access via an ED25519-sk keypair?
My understanding is that an ED25519-sk SSH key generated by OpenSSH generates a private key stub that lives on your host machine. This stub is just a reference to the actual private key that lives on ...
- 3,438
2
votes
0
answers
97
views
How do you know what KDF was used to protect an SSH-Key?
Assuming I have found several OpenSSH private keys on my client's system, how can I detect (at scale) which of them are:
completely unprotected (i.e. no passphrase)
using an old hashing algorithm for ...
- 98
1
vote
2
answers
3k
views
Does certutil -delkey actually delete the certificate and private key?
I am trying to delete a certificate and it's private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command ...
CommunityBot
- 1
1
vote
3
answers
4k
views
Tricky apartment key fob copies frequency & code correctly but the copy doesn't work - not a rolling fob
I have this key fob for our apartment building, and I want to make a copy of it.
I've taken it to 3 locksmiths who are able to create a copy, but the copies don't work.
I've confirmed that it doesn't ...
- 128k
1
vote
1
answer
800
views
Cracking RSA keys, only given N and e
Is it possible to crack RSA keys when only given N and e? If so, is there a limit to how long N or e can be? How do you go about doing that?
In the specific scenario I'm researching, N is about 150 ...
- 12k
5
votes
1
answer
808
views
Impact of having more X509v3 Key Usage fields than required?
I was wondering if having an "oversubscription" of "Key usage fields" inside a X509v3 certificate can negatively impact the performance and/or the security of a server.
For example ...
- 101
0
votes
1
answer
65
views
Is my PGP key which I uploaded to sync.net compromised?
I just accidentally uploaded my PGP key in unencrypted format to rsync.net. As far as I know, nobody but me has access to the account. Is my key compromised?
- 15.4k
3
votes
1
answer
2k
views
Is it safe to send an API key in an HTTPS request? [duplicate]
Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ?
We need to send data to a 3rd party from ...
- 198k
2
votes
1
answer
452
views
Is encryption with MySQL Aes_encrypt() + stored procedure ok?
I would like to do encryption with MySQL AES_ENCRYPT() function used in a stored procedure on the database.
Firstly, I changed the encryption block mode from aes-128-ecb to aes-256-cbc in the MySQL ...
- 1,071
3
votes
3
answers
10k
views
Why is an HSM required to protect CA certificates (rather than a regular USB token)?
Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on.
The same vendors also offer distinct products called HSMs (...
- 319
0
votes
3
answers
52
views
Encryption key fuzzing for forensics analysts
I'm trying to make a simple encryption tool for Debian-like systems. I would simply hash a password, use it to lock/unlock a file, and it would never be stored on the drive. My dad threw out the idea ...
CommunityBot
- 1
1
vote
1
answer
58
views
Changing openssl key/IV when encrypting diffrent rows of data in database?
I'm looking for a way to encrypt data in MySQL database securely. The data come from a web interface from a POST form and each POST request from the user insert a new line in the database.
Right now, ...
-3
votes
1
answer
5k
views
Write a Python or C program to guess the key [closed]
Key generation program in C:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#define KEYSIZE 16
void main()
{
int i;
char key[KEYSIZE]...
- 947
1
vote
1
answer
2k
views
ThinkShield secure wipe - SSD does it forbid data recovering?
I have to give my computer back to my boss.
I want to delete all the data from my SSD. I found "ThinkShield secure wipe" which is implemented in the BIOS apparently.
It gives me two options:
...
- 66.5k
1
vote
1
answer
211
views
Do sites like reddit and Quora expose their Google API client keys to the public?
On Quora, when I want to sign in using Google, I am redirected to this URL, which has a parameter client_id=917071888555.apps.googleusercontent.com.
Similarly, reddit takes me here, which has ...
- 126
0
votes
4
answers
567
views
Benefits of non-standard SSH port when password authentication is turned off
Is there any benefit of using a non-standard SSH port when PasswordAuthentication is turned off in sshd?
The only benefit of non-standard SSH ports I know of is a reduction of the amount of brute ...
- 308
0
votes
1
answer
81
views
How can a client safely post/get a (symmetric) client key to/from a key distribution center?
If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
- 1,476
7
votes
1
answer
4k
views
Is `gpg --refresh-keys` secure and where is this documented?
From the gpg manual:
--refresh-keys
Request updates from a keyserver for keys that already exist on the local keyring.
This is useful for updating a key with the latest signatures, user IDs, etc.
...
CommunityBot
- 1
0
votes
1
answer
319
views
deleted a subkey and can now no longer decrypt
My public key had expired so I tried to edit the expiry date with
gpg --edit-key
It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the ...
- 132
1
vote
0
answers
368
views
How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?
Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
- 66.5k
0
votes
1
answer
7k
views
Static Key Ciphers and key persistence
A vulnerability report states the following:
The server is configured to support ciphers known as static key ciphers. These ciphers don't support "Forward Secrecy". In the new specification for ...
- 5,487
1
vote
1
answer
308
views
Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?
When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a ...
- 1,982
0
votes
2
answers
143
views
When will it be feasible to enumerate all possible private/public key pairs [closed]
One way to defeat public key encryption would be to make a list of all public and private key pairings. For 128-bit and 256-bit keys, there are lots of possible pairs:
2^128 = 3.40e38
2^256 = 1.16e77
...
- 66.5k
2
votes
1
answer
4k
views
How to securely share sensitive info (such as API keys) with freelancers?
My business partner and I are building a webapplication. We have partnered with some third party services which make use of API (public and secret) keys.
The freelance developer we worked with ...
1
vote
0
answers
306
views
Storing AES key for later usage
I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
0
votes
1
answer
474
views
Where should private key(s) reside in IPsec VPN tunnel
I setup an IKE VPN server for road warriors. I actually have this working (YAY!) but took some shortcuts that are leaving me with a working yet not-right/secure setup. My setup is as follows:
My ...
- 1,399
-2
votes
2
answers
74
views
Is the term "only-unlocking key" more accurate than the term "private key"?
Paraphrasing this:
Symmetric cryptography is like a door lock. Everyone that has a key can lock and unlock.
Asymmetric cryptography is like a common lock or handcuff. Anyone can lock it but only the (...
- 12.2k
0
votes
0
answers
119
views
Storing an encryption key securely
I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options.
Option 1) Storing the key on the same server (not recommended, ...
- 121
0
votes
1
answer
1k
views
Does alias in a truststore matter?
I was trying to add a new certificate to our truststore. But I got the alias already exists error.
I can't remove the old certificate yet, but I have to add the new certificate.
Will it matter if I ...
- 128k
0
votes
0
answers
85
views
Acquiring true randomness for generating a key
Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to ...
- 101
1
vote
1
answer
525
views
Security requirements for public API keys
I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients.
The scripts will be run on the endpoints several ...
- 341
0
votes
1
answer
823
views
Encryption Algorithm With Separate One-Way (Hashing) And Two-Way (Decryption) Keys
In cryptography, generally we have two ways of handling sensitive information.
We can use one-way encryption such as hashing. This is useful when we never need to retrieve it again. In this case, we ...
- 753