Questions tagged [key]
Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.
212
questions
1
vote
0
answers
291
views
How to use TPM for key management [closed]
I have read about TPM that these are the secured ways of storing cryptographic keys. I want to know how can I use it. I have an application running on a PC which has TPM. This application has hard ...
- 11
0
votes
1
answer
632
views
Difference between these two extracted public keys?
I generated an RSA Private Key using openssl genrsa -out mykey.pem 2048
To extract the public key I have found 2 commands, one using openssl :
openssl rsa -in mykey.pem -pubout > mykey.pub
And the ...
- 103
5
votes
3
answers
2k
views
Hierarchical Key Rotation. Should I rotate the lowest level keys?
I have a hierarchical key system designed for my project. In this system a block of data is encrypted using a Data Encryption Key (DEK). This DEK is encrypted using a Key Encryption Key (KEK) which is ...
- 51
1
vote
1
answer
326
views
Can a host access a VPS disk's encrypted directory directly while running?
I have an Ubuntu VPS running at a remote host. The disk is not encrypted but I have a specific directory that is encrypted for which I must provide a password via an SSH session (not stored anywhere ...
- 165
1
vote
1
answer
807
views
How to create same ssh key pair on different systesm at different times
Was going through the SSH key pair generation and did tried with the few systems i have. refer to the below command and the thumbprint value post key pair generation.
$ ssh-keygen.exe -t rsa
...
- 11
1
vote
0
answers
270
views
Is it ok to store my Android app keystore password in a text file on my disk?
I am reading on how to sign and publish my flutter app on android.
When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
- 111
1
vote
0
answers
331
views
Securing API keys for accessing Google APIs via Front End (UI)
This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below.
We currently have hybrid ...
7
votes
1
answer
4k
views
Is `gpg --refresh-keys` secure and where is this documented?
From the gpg manual:
--refresh-keys
Request updates from a keyserver for keys that already exist on the local keyring.
This is useful for updating a key with the latest signatures, user IDs, etc.
...
- 221
0
votes
0
answers
116
views
Authenticate Windows/Linux process against hardware security module
I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
2
votes
2
answers
267
views
use custom 'key' for hardware security token
Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
- 121
1
vote
1
answer
276
views
TLS- Key exchange for session keys. Why?
I have a question about the Key Exchange Algorithm used in TLS process.
I have read that the Key Exchange algorithm is used by client and server to exchange session keys.
Do the client and server ...
- 11
0
votes
0
answers
452
views
Is it safe to use HMAC to create an API key?
I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
- 23
1
vote
0
answers
412
views
Lost GPG private key and revocation certificate
I have created a GPG key and uploaded it to pgp.mit.edu. Then I accidentally wiped the drive that contained both the key and the revocation certificate. So what to do now?
I found a possible answer ...
- 111
0
votes
1
answer
498
views
What's a secure way to generate a keypair from a secret password?
I like to generate a public-private key pair that is seeded from a string. So having the string and the generation algorithm is enough to recreate the keys. I want to do this because I can then ...
- 121
0
votes
3
answers
912
views
Associate API key with user
I am creating a public API that will require API key authentication. When a user wants to register a new API key, they send a request to one of our endpoints with a list of permissions they want. We ...
1
vote
1
answer
2k
views
Wrap key operation in Azure Key Vault - symmetric keys
Could anyone explain why the bolded part of the wrap key description?
Wraps a symmetric key using a specified key. The WRAP operation
supports encryption of a symmetric key using a key encryption key ...
- 113
5
votes
1
answer
2k
views
OpenVPN Key Size 1024 vs 2048 and Eavesdrop vs Access?
OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size. I'm trying to determine if it's worth ...
- 303
0
votes
0
answers
201
views
Decrypting a file knowing only the password
I have encrypted a file using a program with a password and would like to decrypt it on another device just with the password. Is there any software that takes the password, runs it through all key ...
user237020
3
votes
2
answers
9k
views
When/why should the "mark this key as exportable" option be selected when importing a certificate?
When a certificate is being imported on Windows, at some point the following option is available:
[] mark this key as exportable
I understand that this is used in case the certificate needs to be ...
- 145
7
votes
1
answer
3k
views
Validating an Ed25519 public key
Is it possibly to test if an Ed25519 public key is valid without having access to the private key, a signed message or anything except the public key?
"Valid" as in "Not just 32 random bytes".
I'm ...
- 205
-1
votes
3
answers
1k
views
how do i find the number of possible keys / password to decrypt a plain text
I would like to know if there is any way to recover the plain-text of a message that's been encrypted with 55 rounds of the Caesar cipher, with a different (independently chosen) key for each round; I ...
- 1
2
votes
2
answers
1k
views
How to protect web server private keys on Ubuntu with Nginx without exposing any plain text credentials?
I'm developing a set of internal websites and services for a customer who has high levels of bureaucracy and strict formal rules about many things, one of them being "not storing passwords in plain ...
- 121
0
votes
0
answers
306
views
Can we keep Pusher API keys public?
I was looking at my company site and I saw Pusher API keys are exposed. Should it be kept public?
0
votes
1
answer
214
views
Is using SecureString in combination with Xor considered secure enough for standalone Windows app?
The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string.
License.Import(string name, string email, ...
- 1,335
3
votes
0
answers
355
views
Best practices for storing long-term access credentials locally in a desktop application?
I'm wondering how applications like Skype and Dropbox store access credentials securely on a user's computer. I imagine the flow for doing this would look something like this:
Prompt the user for a ...
- 131
0
votes
0
answers
73
views
How could I verify that a contract was actually sent to me from the client as soon as the contract is received?
If I want to store electronic contracts for clients over a long period of time. I need to make sure that those files are not readable by anyone other than the client until the client retrieves them at ...
- 63
0
votes
1
answer
475
views
How to implement challenge-response with keyed hash algorithm when 2 people share same key?
Suppose that 2 people have a keyed hash algorithm (that is, a MAC) with a key that they both know. How could they implement challenge-response using their keyed hash algorithm? This confuses me...
- 63
2
votes
1
answer
538
views
Should we use API keys for authorization on a public API (instead of JWT)?
We are building a public-facing API. The consumers of this API will be business partners of ours - we will probably have a personal relationship with each one, and I suspect there will only ever be 10-...
- 125
-3
votes
1
answer
5k
views
Write a Python or C program to guess the key [closed]
Key generation program in C:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#define KEYSIZE 16
void main()
{
int i;
char key[KEYSIZE]...
0
votes
2
answers
1k
views
Accidentally Shared my Private Key - How to Remedy?
I accidentally shared my SSH private and public keys with others. I changed keys within 2 minutes of sharing the private key. I've since added a password to access my private key as well as deleted ...
0
votes
2
answers
144
views
Using the same password to encrypt and to authenticate other actions
Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN.
I would also like to use this same PIN as a secondary protection for some ...
- 3
0
votes
2
answers
192
views
Recreating the Half Coins of Jin-Qua [closed]
In the Asian Saga series by James Clavell, the Struan family gave away the half-coins of Jin-qua: in exchange for a desperately needed loan, the pirate Dirk Struan received 4 halves of 4 coins. The ...
2
votes
2
answers
1k
views
Can I use the same truststore and keystore on the client and the server?
TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides?
More info if helpful:
I'm trying to test ...
- 123
0
votes
1
answer
84
views
PIN transfer between payment schemes
I am wondering, if it should be possible to transfer PIN in case of migrating between different payment schemes like Mastercard or VISA.
For example, when I have a card issued by Mastercard, and it ...
- 1,119
0
votes
1
answer
455
views
Protect sensitive data in memory
Is there a way to protect sensitive data which is in RAM?
Our setup is a microcontroller with no hardware support for security.
When there is a need to encrypt data, then the secret key exists in RAM.
...
- 1
1
vote
1
answer
6k
views
Thales HSM: relationship between the various key types?
I am going through the Thales HSM manuals, and frankly the key acronyms are driving me crazy. I would like to understand the differences between the following keys, and how they relate to one another:
...
- 111
2
votes
0
answers
337
views
Is it safe to generate a temporary API key from a random generator seeded by a secure random generator?
I have a need to generate a key consisting of a given number of random characters that will be used to access resources via a public API. It should not be possible to predict the key. This is done in ...
- 121
2
votes
2
answers
733
views
Hawk vs. API key authentication
For a HTTP(S) API, which is better (/ which is better under which circumstances)?
Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...
0
votes
1
answer
2k
views
How i can generate a DES3 key coded in base64 in openssl
How can I generate a DES3 key encoded in base64 using openssl tool?
- 1
0
votes
0
answers
110
views
How TLS symmetric encryption works?
After the secret symmetric key is exchanged, how does it look like?
What length (in a production use) is it and what can influence it?
How the key is used to encrypt / decrypt a piece of data? I ...
- 101
0
votes
1
answer
2k
views
What are the steps of hashing and steps of verifying password using salt and key? [duplicate]
What are the steps of hashing password during registration and login to an application using salt and key?
Are the following steps considered correct if applied to an application?:
1- During ...
-4
votes
2
answers
305
views
Can I publish my domain's ssl certificate's private key?
I want to buy a new domain (example.com) and a Wildcard certificate for that domain (*.example.com) from namecheap. Then I will set up an NS server to define a rule to resolve part of my subdomain to ...
- 97
0
votes
0
answers
110
views
Securely distributing passwords and salts that will be derived by client programs
I am creating a client-server architecture running on top of the KCP protocol in Go. The package for KCP that I'm using is KCP-Go (https://github.com/xtaci/kcp-go). The package supports packet-level ...
6
votes
2
answers
5k
views
Difference in ECDSA private key format
I have two private ssh keys, - one was originally created with ssh-keygen the other one with a python script. They are supposed to be the same, however one works for authentication and the other one ...
- 185
3
votes
1
answer
6k
views
RSA key exchange is obsolete. Enable an ECDHE-based cipher suite
If what this says is what I think, does that mean the connection could be compromised and or vulnerable to MitM &/or other attacks? Cert shows to be good, but there is this "RSA key exchange is ...
0
votes
1
answer
169
views
How can I distribute highly confidential keys for a symmetric cipher?
Say I want to exchange a key with someone for a symmetric cipher (say AES) without meeting them in person. What would be the most secure way to do this over the Internet? My first instinct would be ...
user216316
3
votes
0
answers
2k
views
How does Veracrypt work?
I’m a layman in security and was trying to understand how hashes and encryption algorithms are used in Veracrypt/Truecrypt.
Reading the documentation, this is what I understood (please, feel free to ...
- 31
-4
votes
1
answer
201
views
Binary Numbers converted to Hexadecimal private key [closed]
Couldn't you use brute force to guess someone’s binary number because it's 1 or 0 - 256 times then just keep switching 1's and 0's around- which then can be converted hexadecimal to guess their ...
1
vote
0
answers
116
views
Does TDE not protect against disk theft?
I read the following on Microsoft's site. Can someone please clarify -
"With TDE, is the data stored in my data, log, and backup files protected from a disk theft?"
Yes, but only if the files ...
- 13
5
votes
4
answers
4k
views
Generate API keys with JWT and regenerate the same key when needed
I recently found my self in need of developing a public API for my application. I developed my application with node.js and MongoDB. After some research, I decided to use jwt for generating API keys ...
- 151