Questions tagged [key]

Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.

Filter by
Sorted by
Tagged with
0 votes
0 answers
63 views

HSM Thales PayShield vulnerabilities

My management requested to investigate about security of HSM Thales Payshield. Have you ever heard of any security bugs on the HSM Thales Payshield? I mean, except for the known bugs reported in their ...
MaXbeMan's user avatar
0 votes
0 answers
40 views

Security implication of loading untrusted private keys

The FIPS draft for Dilithium signature scheme (official name ML-DSA) had just been released not long ago. In the specification for skDecode (which is the subroutine that loads the private signing key) ...
DannyNiu's user avatar
  • 370
1 vote
1 answer
72 views

Key Hash With Securely-Optimal Setting : For Encryption vs For Password

Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ? So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
Agus Setiawan's user avatar
1 vote
1 answer
207 views

CVV2 calculation with TR-31 Key

I need to use the CVK Key (in key block format) to calculate the CVV2. In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
MaXbeMan's user avatar
0 votes
1 answer
117 views

PCI compliance - use of ANSI X9.17 for export keys

we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
MaXbeMan's user avatar
0 votes
0 answers
109 views

Management of CVK key in Key Block format

I use a Thales PayShield 10K with a LMK KeyBlock 3DES. I have to send a CVK Key to a Scheme for the valorization of CVV2 value. Now, in my envorinment i generated a CVK Key with "Key Usage"= ...
MaXbeMan's user avatar
0 votes
1 answer
101 views

Permanent Keys/Secrets in TLS 1.3

In TLS 1.3 (RFC8446), there are many secrets and keys. As far as I've understood, every certificate (usually only the server) has a long term key associated with it which is used with HKDF to generate ...
bacle173's user avatar
3 votes
1 answer
377 views

What is the point of the “AES Key Wrap” algorithm?

What is the point of the “AES Key Wrap” algorithm prescribed for use with CMS-like contexts in IETF RFC 3394? Just look at the algorithm (tacked on to the end of this post), informally, it smells a ...
JamesTheAwesomeDude's user avatar
3 votes
1 answer
265 views

Can someone with access to only my Yubikey gain access to my server that has SSH access via an ED25519-sk keypair?

My understanding is that an ED25519-sk SSH key generated by OpenSSH generates a private key stub that lives on your host machine. This stub is just a reference to the actual private key that lives on ...
angryserver's user avatar
2 votes
0 answers
97 views

How do you know what KDF was used to protect an SSH-Key?

Assuming I have found several OpenSSH private keys on my client's system, how can I detect (at scale) which of them are: completely unprotected (i.e. no passphrase) using an old hashing algorithm for ...
John Nemo's user avatar
1 vote
1 answer
104 views

Detecting signal amplification attacks against PKE keyless fobs

During the early hours of the morning there was an attempt to enter and presumably steal various vehicles on my street, detected well after the fact via householders reviewing CCTV motion detection ...
CuriousTechie's user avatar
0 votes
1 answer
65 views

Is my PGP key which I uploaded to sync.net compromised?

I just accidentally uploaded my PGP key in unencrypted format to rsync.net. As far as I know, nobody but me has access to the account. Is my key compromised?
Someone's user avatar
  • 149
3 votes
1 answer
3k views

Is it safe to send an API key in an HTTPS request? [duplicate]

Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ? We need to send data to a 3rd party from ...
Pure.Krome's user avatar
0 votes
3 answers
52 views

Encryption key fuzzing for forensics analysts

I'm trying to make a simple encryption tool for Debian-like systems. I would simply hash a password, use it to lock/unlock a file, and it would never be stored on the drive. My dad threw out the idea ...
R-Rothrock's user avatar
2 votes
1 answer
455 views

Is encryption with MySQL Aes_encrypt() + stored procedure ok?

I would like to do encryption with MySQL AES_ENCRYPT() function used in a stored procedure on the database. Firstly, I changed the encryption block mode from aes-128-ecb to aes-256-cbc in the MySQL ...
Poubelle Dirty's user avatar
1 vote
1 answer
58 views

Changing openssl key/IV when encrypting diffrent rows of data in database?

I'm looking for a way to encrypt data in MySQL database securely. The data come from a web interface from a POST form and each POST request from the user insert a new line in the database. Right now, ...
JohnyJohny's user avatar
0 votes
1 answer
206 views

Secure chat application with multiple users on one device?

I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application. My thought was to store a private key in ...
JavaForAndroid's user avatar
1 vote
1 answer
2k views

ThinkShield secure wipe - SSD does it forbid data recovering?

I have to give my computer back to my boss. I want to delete all the data from my SSD. I found "ThinkShield secure wipe" which is implemented in the BIOS apparently. It gives me two options: ...
mat's user avatar
  • 13
1 vote
1 answer
211 views

Do sites like reddit and Quora expose their Google API client keys to the public?

On Quora, when I want to sign in using Google, I am redirected to this URL, which has a parameter client_id=917071888555.apps.googleusercontent.com. Similarly, reddit takes me here, which has ...
Cornelius Brand's user avatar
0 votes
4 answers
572 views

Benefits of non-standard SSH port when password authentication is turned off

Is there any benefit of using a non-standard SSH port when PasswordAuthentication is turned off in sshd? The only benefit of non-standard SSH ports I know of is a reduction of the amount of brute ...
303's user avatar
  • 101
0 votes
1 answer
319 views

deleted a subkey and can now no longer decrypt

My public key had expired so I tried to edit the expiry date with gpg --edit-key It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the ...
cardamom's user avatar
  • 379
1 vote
0 answers
370 views

How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?

Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
Letal1s's user avatar
  • 109
1 vote
1 answer
311 views

Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?

When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a ...
Letal1s's user avatar
  • 109
0 votes
1 answer
82 views

How can a client safely post/get a (symmetric) client key to/from a key distribution center?

If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
hurryman2212's user avatar
0 votes
3 answers
2k views

What format is this private key in, and how can I process it using bouncycastle?

I have the following private key. I'd like to be able to process it into an instance of ECPrivateKey using Bouncycastle (or the builtin Java security API if bouncycastle isn't necessary). -----BEGIN ...
rurouniwallace's user avatar
1 vote
0 answers
307 views

Storing AES key for later usage

I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
Rak Laptudirm's user avatar
0 votes
1 answer
477 views

Where should private key(s) reside in IPsec VPN tunnel

I setup an IKE VPN server for road warriors. I actually have this working (YAY!) but took some shortcuts that are leaving me with a working yet not-right/secure setup. My setup is as follows: My ...
TSG's user avatar
  • 159
-2 votes
2 answers
74 views

Is the term "only-unlocking key" more accurate than the term "private key"?

Paraphrasing this: Symmetric cryptography is like a door lock. Everyone that has a key can lock and unlock. Asymmetric cryptography is like a common lock or handcuff. Anyone can lock it but only the (...
humble-learner's user avatar
0 votes
0 answers
119 views

Storing an encryption key securely

I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options. Option 1) Storing the key on the same server (not recommended, ...
JavaForAndroid's user avatar
0 votes
1 answer
1k views

Does alias in a truststore matter?

I was trying to add a new certificate to our truststore. But I got the alias already exists error. I can't remove the old certificate yet, but I have to add the new certificate. Will it matter if I ...
ssl_noob's user avatar
1 vote
3 answers
4k views

Tricky apartment key fob copies frequency & code correctly but the copy doesn't work - not a rolling fob

I have this key fob for our apartment building, and I want to make a copy of it. I've taken it to 3 locksmiths who are able to create a copy, but the copies don't work. I've confirmed that it doesn't ...
user avatar
0 votes
0 answers
85 views

Acquiring true randomness for generating a key

Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to ...
Brakke Baviaan's user avatar
0 votes
1 answer
830 views

Encryption Algorithm With Separate One-Way (Hashing) And Two-Way (Decryption) Keys

In cryptography, generally we have two ways of handling sensitive information. We can use one-way encryption such as hashing. This is useful when we never need to retrieve it again. In this case, we ...
azoundria's user avatar
  • 753
0 votes
0 answers
107 views

Is it safe to use a Digital Signature created with a PKI certificate's private key as a password

I'm trying to create application-layer encryption for user data in my database, using password derivation function. But there is a problem, that there must be an admin user, who can access all user's ...
Владимир Лопаткин's user avatar
0 votes
1 answer
1k views

VeraCrypt: Is it possible to change the master key?

The password in VeraCrypt is used to en-/decrypt a header, that contains a master key, that is used to en-/decrypt the data. I know, that I can change the password, which will not change the master ...
stackprotector's user avatar
1 vote
1 answer
527 views

Security requirements for public API keys

I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients. The scripts will be run on the endpoints several ...
uvzz's user avatar
  • 11
1 vote
2 answers
342 views

How to manage Encryption Key for Server Side Encryption in AWS S3

I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows: All the existing data ...
abhishekti7's user avatar
5 votes
1 answer
810 views

Impact of having more X509v3 Key Usage fields than required?

I was wondering if having an "oversubscription" of "Key usage fields" inside a X509v3 certificate can negatively impact the performance and/or the security of a server. For example ...
metriXc's user avatar
  • 65
1 vote
0 answers
2k views

"Failed connecting to the YubiKey. Make sure the application has the required permissions." [closed]

I have a Yubikey version 5.2.7 and I can't generate any new certificates on yubikey manager app, which is weird since I have already generated two certs (on 9d slot) and they worked fine. Now the ...
Gibberish's user avatar
  • 111
1 vote
1 answer
1k views

Looking for a lost PKE keyless entry fob

I have been looking for my lost car key. I have RTL-SDR and I am able to listen to key fobs frequency which varies between 350-444MHZ. I was trying to understand how most of the keyless entry systems ...
mack44452's user avatar
0 votes
1 answer
246 views

Can you obtain the passphrase of an encrypted SSH key, given the unencrypted key?

Imagine you get hold of someone's private SSH key, which is encrypted. Now imagine you also get hold of the unencrypted key (e.g., because some SSH client stores it after decryption). Can you ...
bers's user avatar
  • 240
1 vote
2 answers
532 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
CHOO YJ's user avatar
  • 113
1 vote
1 answer
1k views

How safe is AES 256bitkey encoded in HEX, Base64?

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv}); The secret is generated through: function generateKey(passphrase) { const salt = CryptoJS....
Kim Mỹ's user avatar
  • 145
1 vote
2 answers
3k views

Does certutil -delkey actually delete the certificate and private key?

I am trying to delete a certificate and it's private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command ...
lee23's user avatar
  • 131
1 vote
1 answer
507 views

gnu gcc source archives signed with expired GPG key?

I'm in the course of rescuing a legacy app that got left behind and turned out to be needed on rare occasions, one of which occurred yesterday. I need to rebuild some libraries and the libraries have ...
Scott's user avatar
  • 165
9 votes
2 answers
3k views

Securing API keys for a Twitter account for a program to be run on other PC's

I've created a method to allow my project EditVideoBot to be 'decentralised', where rather than the program processing and uploading all video editing requests on my own central server, users can ...
pigeonburger's user avatar
1 vote
1 answer
637 views

Key pairs extension / version

I read in some docs, there are several version of GPG key extension available. For ex: gpg, ascii, p12 I know .gpg extension is in binary, and Ascii is in text. But I want to know their differences ...
tadata's user avatar
  • 13
1 vote
0 answers
92 views

Necessary fingerprint length etc. when Alice wants to send multiple pseudonymous messages in public to Bob and keep option of proving authorship later [closed]

Alice wants to send Bob messages. She has the following requirements. She plans to send him messages that are sequentially numbered, pseudonymous, and sent to him publicly over a period of time. Each ...
user avatar
0 votes
1 answer
293 views

The risk of RSA encryption. Would individually encrypted characters be risky?

Is it possible to decrypt a RSA message if the characters of the message are individually encrypted? The info you have is the message, the public key and the n which is too big to be factorizable.
M PB's user avatar
  • 3
2 votes
1 answer
3k views

OpenSSL encrypt DER format private key

When converting a password-protected PEM/PKCS1-encoded private key to DER format one is not able to encrypt the key, OpenSSL automagically asks for the password and writes the plain-text key in the ...
Rob's user avatar
  • 131

1
2 3 4 5