Questions tagged [key]
Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.
212
questions
38
votes
3
answers
7k
views
Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?
A common saying among people in the field of cryptography and security is that when providing a back door to law enforcement, you also provide a back door for hackers.
I was trying to examine the ...
- 467
28
votes
3
answers
6k
views
Use multiple computers for faster brute force [duplicate]
I've watched Mr. Robot lately and can't stop thinking why it was so hard to decrypt files encrypted using AES encryption with a 256-bit key.
Let us say the only method to find the key is through brute ...
- 845
22
votes
1
answer
4k
views
Is assigning decrypted keys to a variable in application secure? [duplicate]
Let's say I've retrieved an encrypted secret key from the server. I decrypt it to get the actual secret key, assign the decrypted key to a variable in my app. Something along this:
const encryptedKey ...
- 367
12
votes
6
answers
4k
views
Can secrets be made safe in memory?
Say, I am running an application on a cloud server such as AWS. Suppose I supply a key at run-time (so its not stored anywhere alongside/inside code), is there a way to secure this key in memory?
So ...
- 1,375
12
votes
2
answers
17k
views
Where should a keystore (.jks) be stored in a repository
I've got a question about the best practice in storing a Keystore file (.jks) in source control. This Keystore is called by a stand-alone Java component that retrieves a private key for the purpose of ...
- 181
9
votes
2
answers
3k
views
Securing API keys for a Twitter account for a program to be run on other PC's
I've created a method to allow my project EditVideoBot to be 'decentralised', where rather than the program processing and uploading all video editing requests on my own central server, users can ...
- 671
8
votes
2
answers
8k
views
HMAC and key size
I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths.
Do we have to use a key with a fixed size in HMAC? If so, what is the key size? ...
- 265
8
votes
1
answer
3k
views
Do I need to use salt with api key hashing?
I will generate api keys. I plan to store their hashes instead of plain text. do i also need salt, similar to storing password?
AFAIK salt prevents rainbow table attack and those are more ...
- 289
7
votes
1
answer
3k
views
Validating an Ed25519 public key
Is it possibly to test if an Ed25519 public key is valid without having access to the private key, a signed message or anything except the public key?
"Valid" as in "Not just 32 random bytes".
I'm ...
- 205
7
votes
1
answer
5k
views
Car Key Security Questions [duplicate]
I am wondering how car key security works.
Do cars keys just send a simple "lock" and "unlock" signal that works with any car from the manufacturer or any car of the same model? Or are specific keys ...
- 225
7
votes
1
answer
4k
views
Is `gpg --refresh-keys` secure and where is this documented?
From the gpg manual:
--refresh-keys
Request updates from a keyserver for keys that already exist on the local keyring.
This is useful for updating a key with the latest signatures, user IDs, etc.
...
- 221
6
votes
2
answers
5k
views
Difference in ECDSA private key format
I have two private ssh keys, - one was originally created with ssh-keygen the other one with a python script. They are supposed to be the same, however one works for authentication and the other one ...
- 185
6
votes
2
answers
972
views
Is it safe to publish something encrypted with a password if you make it insanely difficult to crack?
Let's say you have a very important private key that you don't want to lose. You think of posting it to http://pastebin.com/ but then relize that elimanates the point. So you think of encrypting with ...
- 2,937
6
votes
1
answer
5k
views
How to securely store API keys
I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
- 161
6
votes
2
answers
778
views
Public key for SSH over the internet differs from a key for SSH over the LAN
I have a Raspberry Pi and can access it via SSH (authentication via user password) when my laptop is in the same network. Now I want to access it over the internet.
I already set my router to forward ...
- 2,340
5
votes
3
answers
2k
views
Hierarchical Key Rotation. Should I rotate the lowest level keys?
I have a hierarchical key system designed for my project. In this system a block of data is encrypted using a Data Encryption Key (DEK). This DEK is encrypted using a Key Encryption Key (KEK) which is ...
- 51
5
votes
1
answer
7k
views
How to protect API Key in Android application
I was working on one Android App which was communicating with RESTFull server. We made an API Key which was inserted in header of GET and POST requests. This API Key was stored in Strings. App is no ...
- 153
5
votes
3
answers
888
views
Public part of SSH key (*.pub): Keep or destroy?
I have set up authentication with a remote system using SSH. I sent the sysadmin the public part of the SSH key (*.pub).
What are the implications of keeping this public key on my machine? Is it good ...
- 151
5
votes
1
answer
1k
views
Why should I hide API keys?
I need to integrate my android app with dropbox, basically all I want is for the user to choose a file from his dropbox and give it to my app. In order to do that I'm using dropboxChooserSDK, and it ...
- 151
5
votes
1
answer
808
views
Impact of having more X509v3 Key Usage fields than required?
I was wondering if having an "oversubscription" of "Key usage fields" inside a X509v3 certificate can negatively impact the performance and/or the security of a server.
For example ...
- 65
5
votes
4
answers
4k
views
Generate API keys with JWT and regenerate the same key when needed
I recently found my self in need of developing a public API for my application. I developed my application with node.js and MongoDB. After some research, I decided to use jwt for generating API keys ...
- 151
5
votes
2
answers
4k
views
How to properly protect a private key?
I'm a beginner to security, and trying to understand how best to secure a private key. I understand keys should never be stored in plaintext - however, surely encrypting them with another key provides ...
- 415
5
votes
2
answers
132
views
is it possible to extract a "hint hash" of some kind from another hash?
I'm a web developer starting to dip into cryptography so please bare with me on this...
Let's say I have a collection of hashes that were generated from some common data i.e. changes to multiple ...
- 51
5
votes
1
answer
8k
views
Understand the "Windows Key Store"
I work in a enterprise environment and I often hear the use of the "Windows Key Store" to store various keys including symmetric. I do understand there is a "Windows Certificate Store" which as the ...
- 237
5
votes
1
answer
2k
views
OpenVPN Key Size 1024 vs 2048 and Eavesdrop vs Access?
OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size. I'm trying to determine if it's worth ...
- 303
4
votes
1
answer
2k
views
What would be a simple example of an asymmetric encryption function (asymmetric function)?
I am trying to understand RSA encryption but the algorithm seems quite complex.
I know that with asymmetric encryption you use a key and a function to encrypt data and a different function to decrypt ...
- 183
4
votes
1
answer
2k
views
Is it possible to LUKS require both password and key file?
My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in ...
user164059
4
votes
4
answers
2k
views
Can I use a user's password hash as the AES key to make a one time token?
I want to make a one time token that users use to reset their password. The token should be invalidated once it is used, is it safe to use their currently hashed password as the aes key to encrypt the ...
- 43
4
votes
1
answer
2k
views
If my private key is password protected, then how is it used without asking me for it?
Relating to TLS and SSH. If my private key is password / passphrase protected, how is this then used automatically during TLS or SSH communication without asking me for the password?
- 267
4
votes
2
answers
2k
views
Using weak Veracrypt password safe?
Is it safe to create a Veracrypt partition (on a USB) such that
it takes up the whole device (ie. not a "file", but using the USB as the storage container)
it contains only a standard volume (no ...
- 169
4
votes
2
answers
4k
views
How fast is it to bruteforce a 48-bit key with current technology?
Say you have a truly random hexadecimal key formatted as 1234.5678.ABCD, with 48-bit entropy. Assuming the key is stored with no hashing/salting, how fast/easy would it be to brute force it with ...
- 1,001
4
votes
1
answer
91
views
Understanding Shake on IT key exchange
Shot paper
I am reading a paper about key exchange and trying to understand the protocol described in Figure 4 on page 6 in the above paper. I understand the majority of the notation but am having a ...
- 43
4
votes
2
answers
2k
views
Best practice for securing encrypted content on Android app
I have an Android APK which loads in locally stored content files protected by AES encryption, and I want to keep the encryption key secret from all users. Only the app itself should be able to read ...
- 41
4
votes
2
answers
1k
views
Storing Keys on Embedded Devices
What is a reasonable way of storing private keys/certs on an embedded device that doesn't have trust-zone, TPM or write-once storage? Without hardware backing the key-storage the key must be stored in ...
- 1,239
4
votes
0
answers
2k
views
GPG: how to encrypt using a keyfile? (symmetric)
In Ubuntu this produces a "filename.txt.gpg" file and works:
$ gpg --symmetric --passphrase-file keyfile.key filename.txt
In debian, I get a popup requesting I enter a password...
How do I encrypt ...
- 41
3
votes
3
answers
10k
views
Why is an HSM required to protect CA certificates (rather than a regular USB token)?
Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on.
The same vendors also offer distinct products called HSMs (...
- 3,610
3
votes
2
answers
9k
views
How to generate the most secure private key? [closed]
I need to generate the most secure private key.
Usually I use a command:
openssl genrsa -des3 -out mykey.key 2048
Is triple DES secure enough?
Is 2048 large enough?
Are there any other ways to ...
- 1,085
3
votes
1
answer
1k
views
Why are SSH host keys stored un-encrypted?
Do we have any standard way to encrypt SSH host keys (like /etc/ssh/ssh_host_rsa_key)? If not, why is it stored in plaintext? Isn't it sensitive information?
3
votes
3
answers
219
views
Are my home keys compromised if I use a key duplication machine?
Given that if someone has physical access to your home keys for enough time to take a picture of them, you've already lost, what stops key duplication machines such as MinuteKey from taking pictures ...
- 1,965
3
votes
1
answer
355
views
What is the point of the “AES Key Wrap” algorithm?
What is the point of the “AES Key Wrap” algorithm prescribed for use with CMS-like contexts in IETF RFC 3394?
Just look at the algorithm (tacked on to the end of this post), informally, it smells a ...
3
votes
1
answer
7k
views
If PGP is 2048 or 4098, then what is 128-bit encryption? [duplicate]
PGP is 2048 bit encryption?
That a whole lot more than 128 bits.
But, I thought 128 bits is more "serious" and "legit"
- 133
3
votes
2
answers
509
views
TLS protocol, session key for secure connection
In Wikipedia, as part of handshaking between a client and a server, the server send a public encryption key as part of the digital certificate.
Then the client uses Diffie–Hellman key exchange to ...
3
votes
4
answers
4k
views
Private Key Storage in a Java Desktop Application
I am talking about system private keys for API, Google Analytics and etc... (not user´s private key)
Where is the best place to store it? (Java class, properties, hidden file, preferences) (Cross-...
- 81
3
votes
1
answer
258
views
Can someone with access to only my Yubikey gain access to my server that has SSH access via an ED25519-sk keypair?
My understanding is that an ED25519-sk SSH key generated by OpenSSH generates a private key stub that lives on your host machine. This stub is just a reference to the actual private key that lives on ...
- 101
3
votes
1
answer
6k
views
RSA key exchange is obsolete. Enable an ECDHE-based cipher suite
If what this says is what I think, does that mean the connection could be compromised and or vulnerable to MitM &/or other attacks? Cert shows to be good, but there is this "RSA key exchange is ...
3
votes
1
answer
4k
views
Generate and add new encryption subkey?
My encryption subkey (but not my signing or other subkeys) expired. How do I generate and add a new encryption subkey using gpg?
- 1,726
3
votes
1
answer
2k
views
Is it safe to send an API key in an HTTPS request? [duplicate]
Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ?
We need to send data to a 3rd party from ...
- 133
3
votes
2
answers
9k
views
When/why should the "mark this key as exportable" option be selected when importing a certificate?
When a certificate is being imported on Windows, at some point the following option is available:
[] mark this key as exportable
I understand that this is used in case the certificate needs to be ...
- 145
3
votes
1
answer
6k
views
SSL/TLS Client certificate's key with or without pass phrase?
I have a small PKI for our web server that will require client certificates.
When generating the private key for CSR (edit: CSR for a client certificate ), I can do it with or without a pass phrase.
...
- 31
3
votes
1
answer
651
views
API Key in microservices
Is sending an encrypted connection string as an API Key through headers a good idea?
Someone once told me, storing API Keys in a DB is a bad thing to do but I can't seem to figure out how, when in ...
- 131