Questions tagged [key]
Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.
45
questions with no upvoted or accepted answers
5
votes
1
answer
3k
views
OpenVPN Key Size 1024 vs 2048 and Eavesdrop vs Access?
OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size. I'm trying to determine if it's worth ...
- 303
4
votes
0
answers
2k
views
GPG: how to encrypt using a keyfile? (symmetric)
In Ubuntu this produces a "filename.txt.gpg" file and works:
$ gpg --symmetric --passphrase-file keyfile.key filename.txt
In debian, I get a popup requesting I enter a password...
How do I encrypt ...
- 41
3
votes
0
answers
464
views
Best practices for storing long-term access credentials locally in a desktop application?
I'm wondering how applications like Skype and Dropbox store access credentials securely on a user's computer. I imagine the flow for doing this would look something like this:
Prompt the user for a ...
- 131
3
votes
0
answers
2k
views
How does Veracrypt work?
I’m a layman in security and was trying to understand how hashes and encryption algorithms are used in Veracrypt/Truecrypt.
Reading the documentation, this is what I understood (please, feel free to ...
- 31
3
votes
3
answers
5k
views
Securely changing Veracrypt password
How can I change a Veracrypt (master) password efficiently and securely?
Based on the answers here, it is not safe to use system --> change password due to various reasons.
I cannot simply image ...
- 169
2
votes
0
answers
200
views
How do you know what KDF was used to protect an SSH-Key?
Assuming I have found several OpenSSH private keys on my client's system, how can I detect (at scale) which of them are:
completely unprotected (i.e. no passphrase)
using an old hashing algorithm for ...
- 98
2
votes
0
answers
381
views
Is it safe to generate a temporary API key from a random generator seeded by a secure random generator?
I have a need to generate a key consisting of a given number of random characters that will be used to access resources via a public API. It should not be possible to predict the key. This is done in ...
- 121
2
votes
0
answers
890
views
Where To Store Public and Private Key files?
I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting.
In my project, I'm generating two files: Public Key file and ...
- 21
2
votes
0
answers
283
views
How to implement a Crysis ransomware master key?
I see there have been master keys released to decrypt computers affected by the Crysis ransomware. If a computer is infected with Crysis, how would one actually test/run the key on the computer?
...
- 121
2
votes
0
answers
149
views
Secure Golden Boot Key without Microsoft keys
I'm an Arch Linux user. I'd like to protect myself from the live-usb hack by using SecureBoot:
Create my own Platform Key and sign the kernel with my own key.
Delete the Microsoft PKs
Enable ...
- 141
1
vote
1
answer
723
views
CVV2 calculation with TR-31 Key
I need to use the CVK Key (in key block format) to calculate the CVV2.
In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
- 11
1
vote
1
answer
277
views
Detecting signal amplification attacks against PKE keyless fobs
During the early hours of the morning there was an attempt to enter and presumably steal various vehicles on my street, detected well after the fact via householders reviewing CCTV motion detection ...
1
vote
0
answers
604
views
How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?
Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
- 109
1
vote
3
answers
3k
views
What format is this private key in, and how can I process it using bouncycastle?
I have the following private key. I'd like to be able to process it into an instance of ECPrivateKey using Bouncycastle (or the builtin Java security API if bouncycastle isn't necessary).
-----BEGIN ...
- 111
1
vote
0
answers
395
views
Storing AES key for later usage
I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and ...
- 111
1
vote
2
answers
425
views
How to manage Encryption Key for Server Side Encryption in AWS S3
I need to encrypt personal data like email, phone number, etc. I am using AWS KMS for managing the encryption keys. This is the system that is already implemented is as follows:
All the existing data ...
- 11
1
vote
0
answers
314
views
Is it ok to store my Android app keystore password in a text file on my disk?
I am reading on how to sign and publish my flutter app on android.
When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
- 111
1
vote
0
answers
400
views
Securing API keys for accessing Google APIs via Front End (UI)
This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below.
We currently have hybrid ...
1
vote
0
answers
497
views
Lost GPG private key and revocation certificate
I have created a GPG key and uploaded it to pgp.mit.edu. Then I accidentally wiped the drive that contained both the key and the revocation certificate. So what to do now?
I found a possible answer ...
- 111
1
vote
0
answers
147
views
Does TDE not protect against disk theft?
I read the following on Microsoft's site. Can someone please clarify -
"With TDE, is the data stored in my data, log, and backup files protected from a disk theft?"
Yes, but only if the files ...
- 13
1
vote
0
answers
994
views
Is it possible decrypt Android 8 encryption, if the device encryption key is gone (but with a known PIN and KEK)?
main question is in the title. Some clarification though:
When you factory reset your encrypted phone, the old device encryption key (DEK a) gets deleted and a new encryption key (DEK b) is being ...
- 41
1
vote
0
answers
202
views
TLS session refresh - DROWN attack
According to the full technical paper of DROWN attack,
A typical scenario requires the attacker to observe 1,000 TLS
handshakes, then initiate 40,000 SSLv2 connections and perform 2 50
offline ...
- 737
1
vote
1
answer
522
views
Automatically import/deploy/distribute private key to users for use with S/MIME
it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt ...
- 11
0
votes
0
answers
79
views
Rotate or replace EMV keys?
I would like to better understand the mechanism of rotation of EMV keys used for payment cards.
Assuming that it intends to provide a rotation of the keys used for the production cards:
just recycle ...
- 11
0
votes
0
answers
199
views
HSM Thales PayShield vulnerabilities
My management requested to investigate about security of HSM Thales Payshield.
Have you ever heard of any security bugs on the HSM Thales Payshield? I mean, except for the known bugs reported in their ...
- 11
0
votes
0
answers
83
views
Security implication of loading untrusted private keys
The FIPS draft for Dilithium signature scheme (official name ML-DSA) had just been released not long ago. In the specification for skDecode (which is the subroutine that loads the private signing key) ...
- 374
0
votes
1
answer
366
views
PCI compliance - use of ANSI X9.17 for export keys
we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
- 11
0
votes
1
answer
297
views
Secure chat application with multiple users on one device?
I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application.
My thought was to store a private key in ...
- 131
0
votes
0
answers
235
views
Storing an encryption key securely
I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options.
Option 1) Storing the key on the same server (not recommended, ...
- 131
0
votes
0
answers
121
views
Acquiring true randomness for generating a key
Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to ...
- 101
0
votes
0
answers
149
views
Is it safe to use a Digital Signature created with a PKI certificate's private key as a password
I'm trying to create application-layer encryption for user data in my database, using password derivation function. But there is a problem, that there must be an admin user, who can access all user's ...
0
votes
0
answers
162
views
Authenticate Windows/Linux process against hardware security module
I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
0
votes
0
answers
574
views
Is it safe to use HMAC to create an API key?
I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
- 23
0
votes
0
answers
243
views
Decrypting a file knowing only the password
I have encrypted a file using a program with a password and would like to decrypt it on another device just with the password. Is there any software that takes the password, runs it through all key ...
user237020
0
votes
0
answers
405
views
Can we keep Pusher API keys public?
I was looking at my company site and I saw Pusher API keys are exposed. Should it be kept public?
0
votes
0
answers
100
views
How could I verify that a contract was actually sent to me from the client as soon as the contract is received?
If I want to store electronic contracts for clients over a long period of time. I need to make sure that those files are not readable by anyone other than the client until the client retrieves them at ...
- 73
0
votes
0
answers
146
views
How TLS symmetric encryption works?
After the secret symmetric key is exchanged, how does it look like?
What length (in a production use) is it and what can influence it?
How the key is used to encrypt / decrypt a piece of data? I ...
- 101
0
votes
0
answers
134
views
Securely distributing passwords and salts that will be derived by client programs
I am creating a client-server architecture running on top of the KCP protocol in Go. The package for KCP that I'm using is KCP-Go (https://github.com/xtaci/kcp-go). The package supports packet-level ...
0
votes
0
answers
127
views
Embeddable 3rd party web tools security against stealing the key
We are building a website and we are using plenty of third-party tools that basically give you an HTML script tag and ask you to place it into your index.html. A few examples of such tools are:
...
- 289
0
votes
0
answers
449
views
EMV card secret key + PIN to generate HOTP key
The Open Authentication HOTP algorithm is considered very reliable when using a 160 bits long secret key. Suppose I have this idea to generate such a 160 bits long key without requiring any further ...
- 113
0
votes
0
answers
221
views
How to securely generate a License tied to 1 Computer for each user
This question is related to my first question: How secure is this schema for Online Licensing System?
I'm trying to sell a subscription based software and I can't find a good way to generate a serial ...
0
votes
0
answers
621
views
SSH-1 key length
What is the maximum size in bits of one SSH-1 key? 4096?
I found some docs where this value is listed and others without limit
- 1
0
votes
1
answer
193
views
How can I distribute highly confidential keys for a symmetric cipher?
Say I want to exchange a key with someone for a symmetric cipher (say AES) without meeting them in person. What would be the most secure way to do this over the Internet? My first instinct would be ...
user216316
-1
votes
3
answers
1k
views
how do i find the number of possible keys / password to decrypt a plain text
I would like to know if there is any way to recover the plain-text of a message that's been encrypted with 55 rounds of the Caesar cipher, with a different (independently chosen) key for each round; I ...
- 1
-1
votes
1
answer
317
views
Public key encryption for initial challenge-repsonse
I understand public key encryption, public key authentication, how digital signatures work and challenge-response authentication, but what confuses me is when they are all combined, and the question ...
- 11