Questions tagged [key]
Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.
212
questions
2
votes
1
answer
4k
views
How to securely share sensitive info (such as API keys) with freelancers?
My business partner and I are building a webapplication. We have partnered with some third party services which make use of API (public and secret) keys.
The freelance developer we worked with ...
- 123
0
votes
1
answer
251
views
Update letsencrypt certificates without changing the private key
I want to renew the letsencrypt certificate on my webserver but want to keep the private key same.
I've installed the certificate using certbot 0.35.1
How can I update the certificate (preferably ...
- 121
1
vote
1
answer
195
views
Android key protection
I was reading this documentation and saw this part;
When an application performs cryptographic operations using an Android Keystore key, behind the scenes plaintext, ciphertext, and messages to be ...
- 501
2
votes
2
answers
5k
views
Understanding AES Keys and Passphrases
I am trying to get my head around how AES works and in particular I have queries around the key generation and 'passphrases'.
My understanding is that AES has a 128 bit block size but the key length ...
- 237
1
vote
1
answer
139
views
Can we define a single immutant state of a device (modern computers at least) to derive a key from?
Please be open and bear with me, I read a lot about encryption, but practiced very little.
I want to write a simple application that uses common encryption algorithms, but based on a derived key ...
- 135
5
votes
1
answer
8k
views
Understand the "Windows Key Store"
I work in a enterprise environment and I often hear the use of the "Windows Key Store" to store various keys including symmetric. I do understand there is a "Windows Certificate Store" which as the ...
- 237
0
votes
3
answers
828
views
How is the strength of a key/Password determined
I was reading about the Principle of Key Sizes and came across this table:
The deduction I made off this is that after a certain key size, increase in a single bit causes Time required for search to ...
- 185
1
vote
3
answers
2k
views
Which function to hash 128 bit API key with?
I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
- 289
8
votes
1
answer
3k
views
Do I need to use salt with api key hashing?
I will generate api keys. I plan to store their hashes instead of plain text. do i also need salt, similar to storing password?
AFAIK salt prevents rainbow table attack and those are more ...
- 289
38
votes
3
answers
7k
views
Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?
A common saying among people in the field of cryptography and security is that when providing a back door to law enforcement, you also provide a back door for hackers.
I was trying to examine the ...
- 467
1
vote
0
answers
917
views
Is it possible decrypt Android 8 encryption, if the device encryption key is gone (but with a known PIN and KEK)?
main question is in the title. Some clarification though:
When you factory reset your encrypted phone, the old device encryption key (DEK a) gets deleted and a new encryption key (DEK b) is being ...
- 41
0
votes
1
answer
337
views
Effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption [closed]
I'm a high school student taking IB and for my EE on Maths, I'm comparing the effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption....
0
votes
0
answers
103
views
Embeddable 3rd party web tools security against stealing the key
We are building a website and we are using plenty of third-party tools that basically give you an HTML script tag and ask you to place it into your index.html. A few examples of such tools are:
...
- 289
0
votes
0
answers
957
views
TLS Pre-master key [duplicate]
If I have access to the pre-master key of a TLS handshake, is it possible to decrypt the rest of the handshake following this?
If so, is it possible to get the pre-master key while it is still not ...
- 1
1
vote
3
answers
360
views
Is it safe if SSH and HTTPS server share the same RSA/DSA keys?
I'm configuring an ssh server for an embedded device. This device already has an x.509 certificate and a pair of public key and private keys stored in it that is used for its HTTPS server. Is it safe ...
- 21
4
votes
1
answer
2k
views
Is it possible to LUKS require both password and key file?
My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in ...
user164059
8
votes
2
answers
8k
views
HMAC and key size
I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths.
Do we have to use a key with a fixed size in HMAC? If so, what is the key size? ...
- 265
0
votes
0
answers
379
views
EMV card secret key + PIN to generate HOTP key
The Open Authentication HOTP algorithm is considered very reliable when using a 160 bits long secret key. Suppose I have this idea to generate such a 160 bits long key without requiring any further ...
- 113
3
votes
1
answer
4k
views
KeePass Key File - Does it provide any meaningful security?
KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much.
I can see a couple of scenario's:
The database and key are on ...
user198611
3
votes
2
answers
9k
views
How to generate the most secure private key? [closed]
I need to generate the most secure private key.
Usually I use a command:
openssl genrsa -des3 -out mykey.key 2048
Is triple DES secure enough?
Is 2048 large enough?
Are there any other ways to ...
- 1,085
1
vote
3
answers
1k
views
How often do brute force attacks find the password or key in a much shorter amount of time than the theoretical max?
For a 128-bit key, it would theoretically take many years and a percentage of the entire worlds power output to check every possible key, or for 256-bit it would take 3 sexdecillion years. But the ...
- 13
0
votes
0
answers
167
views
How to securely generate a License tied to 1 Computer for each user
This question is related to my first question: How secure is this schema for Online Licensing System?
I'm trying to sell a subscription based software and I can't find a good way to generate a serial ...
0
votes
0
answers
525
views
SSH-1 key length
What is the maximum size in bits of one SSH-1 key? 4096?
I found some docs where this value is listed and others without limit
- 1
2
votes
1
answer
159
views
Does this attack on RSA keys reveals a major flaw, or this is no big deal with good entropy?
William Kuszmaul published a study of an attack for RSA public keys on his blog https://algorithmsoup.wordpress.com/2019/01/15/breaking-an-unbreakable-code-part-1-the-hack/
The basic idea is, when ...
- 163
2
votes
2
answers
293
views
Private key DES password
If I have a SSL private key that is encrypted with a DES password, and I have to share with another admin a NODES copy of the private key, can the other admin determine what my DES password is?
- 21
3
votes
1
answer
7k
views
If PGP is 2048 or 4098, then what is 128-bit encryption? [duplicate]
PGP is 2048 bit encryption?
That a whole lot more than 128 bits.
But, I thought 128 bits is more "serious" and "legit"
- 133
4
votes
4
answers
2k
views
Can I use a user's password hash as the AES key to make a one time token?
I want to make a one time token that users use to reset their password. The token should be invalidated once it is used, is it safe to use their currently hashed password as the aes key to encrypt the ...
- 43
4
votes
1
answer
2k
views
If my private key is password protected, then how is it used without asking me for it?
Relating to TLS and SSH. If my private key is password / passphrase protected, how is this then used automatically during TLS or SSH communication without asking me for the password?
- 267
2
votes
1
answer
180
views
Malware abusing SSH agent active keys
I am thinking about this lately a lot, so I wanted to get someone else's opinion.
Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
- 125
2
votes
0
answers
836
views
Where To Store Public and Private Key files?
I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting.
In my project, I'm generating two files: Public Key file and ...
- 21
1
vote
1
answer
302
views
The NIST randomness tests for a generated key
Does different tests for key randomness provided by NIST are available online? where one can test that which test for key generated are passed and which are failed?
- 13
4
votes
0
answers
2k
views
GPG: how to encrypt using a keyfile? (symmetric)
In Ubuntu this produces a "filename.txt.gpg" file and works:
$ gpg --symmetric --passphrase-file keyfile.key filename.txt
In debian, I get a popup requesting I enter a password...
How do I encrypt ...
- 41
0
votes
1
answer
138
views
Secure Routing without relying on Cryptography? [closed]
Is anyone aware of a routing protocols for Ad Hoc Networks (such as OLSR, AODV, ZRP) which are secure without relying on pre-established key management? What I mean by secure is, preventing data ...
- 11
3
votes
1
answer
651
views
API Key in microservices
Is sending an encrypted connection string as an API Key through headers a good idea?
Someone once told me, storing API Keys in a DB is a bad thing to do but I can't seem to figure out how, when in ...
- 131
1
vote
2
answers
3k
views
AES-256 decryption after key destruction. Possible or not?
Can AES-256 be decrypted if after the encryption process you destroy the key that must be used to decrypt the data, is it possible?
- 15
1
vote
1
answer
464
views
Automatically import/deploy/distribute private key to users for use with S/MIME
it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt ...
- 11
6
votes
1
answer
5k
views
How to securely store API keys
I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
- 161
-1
votes
2
answers
756
views
PGP public key is visible
I have found a page with lots of PGP public keys. There is an email address on url.
This page is:
-----BEGIN PGP PUBLIC KEY BLOCK-----
...
- 57
3
votes
3
answers
10k
views
Why is an HSM required to protect CA certificates (rather than a regular USB token)?
Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on.
The same vendors also offer distinct products called HSMs (...
- 3,610
-5
votes
1
answer
308
views
What are the most used encryption/decryption keys?
I started Working On a encryption project, but I am facing a problem with the leak of encryption keys. Is there a list of the most popular encryption keys used, like the password lists of most used ...
1
vote
1
answer
2k
views
Multiple CSRs from the same private key
Consider that I generate a new undisclosed private key using openssl:
openssl genrsa -out personal.key 2048
I then generate the multiple CSR requests (called csr1.csr and csr2.csr):
openssl req -...
- 153
4
votes
1
answer
91
views
Understanding Shake on IT key exchange
Shot paper
I am reading a paper about key exchange and trying to understand the protocol described in Figure 4 on page 6 in the above paper. I understand the majority of the notation but am having a ...
- 43
3
votes
2
answers
509
views
TLS protocol, session key for secure connection
In Wikipedia, as part of handshaking between a client and a server, the server send a public encryption key as part of the digital certificate.
Then the client uses Diffie–Hellman key exchange to ...
1
vote
1
answer
313
views
Is there a standard checksum for verifying multipart key fragments?
We will have a symmetric key arriving in three component parts. Once all parts arrive, the key custodians will get together for a ceremony where each enters their part of the key into a secured ...
- 34.1k
2
votes
1
answer
349
views
Encryption Engine vs Key Server
What is the difference (if any) between a Key Server and an Encryption Engine?
Is a Key Server also the same as a Key Manager?
I've seen the terms Encryption Engine, Key Server and Key Manager used ...
- 21
3
votes
3
answers
4k
views
Securely changing Veracrypt password
How can I change a Veracrypt (master) password efficiently and securely?
Based on the answers here, it is not safe to use system --> change password due to various reasons.
I cannot simply image ...
- 169
4
votes
2
answers
2k
views
Using weak Veracrypt password safe?
Is it safe to create a Veracrypt partition (on a USB) such that
it takes up the whole device (ie. not a "file", but using the USB as the storage container)
it contains only a standard volume (no ...
- 169
1
vote
1
answer
798
views
Cracking RSA keys, only given N and e
Is it possible to crack RSA keys when only given N and e? If so, is there a limit to how long N or e can be? How do you go about doing that?
In the specific scenario I'm researching, N is about 150 ...
- 45
3
votes
1
answer
6k
views
SSL/TLS Client certificate's key with or without pass phrase?
I have a small PKI for our web server that will require client certificates.
When generating the private key for CSR (edit: CSR for a client certificate ), I can do it with or without a pass phrase.
...
- 31
0
votes
1
answer
340
views
Key Generation on FIPS device or using SW with FIPS generator
I would like to understand the difference between these two options how to generate AES key.
AES key is generated directly in FIPS 140-2 Level 3 device with validated AES
algorithm
AES key is ...
- 1,119