Questions tagged [key]
Physical or digital keys. Digital keys are used for encryption or signing, or for authentication (e.g. API key). For product keys, use the tag product-key.
212
questions
3
votes
4
answers
4k
views
Private Key Storage in a Java Desktop Application
I am talking about system private keys for API, Google Analytics and etc... (not user´s private key)
Where is the best place to store it? (Java class, properties, hidden file, preferences) (Cross-...
- 81
3
votes
1
answer
1k
views
Why are SSH host keys stored un-encrypted?
Do we have any standard way to encrypt SSH host keys (like /etc/ssh/ssh_host_rsa_key)? If not, why is it stored in plaintext? Isn't it sensitive information?
2
votes
0
answers
259
views
How to implement a Crysis ransomware master key?
I see there have been master keys released to decrypt computers affected by the Crysis ransomware. If a computer is infected with Crysis, how would one actually test/run the key on the computer?
...
- 121
1
vote
2
answers
619
views
How to exchange private keys between server and clients?
I am developing an encryption application but I do not have good ideas about how exchange the private key as securely around the internet.
I have some simple ideas like combine some data with client's ...
2
votes
1
answer
12k
views
How to find a wep key inside a pcap file with only 2 IV?
I have a pcap file that contains 3 packets. I need to find a WEP key inside these packets. These packets contains only two IV. It's not a live attack so I can't try brute force.
user163054
0
votes
1
answer
7k
views
Static Key Ciphers and key persistence
A vulnerability report states the following:
The server is configured to support ciphers known as static key ciphers. These ciphers don't support "Forward Secrecy". In the new specification for ...
- 143
2
votes
1
answer
2k
views
Will changing the TLS Diffie-Hellman key exchange bit length from 1024 to 2048 cause client/browser compatibility issues?
Recently discovered the need to upgrade our DH key exchange length (used for TLS) from 1024 bits to 2048 bits (due to Logjam exploit and other factors). The question is: How will making that change ...
- 41
1
vote
1
answer
1k
views
How to decrypt a text with substitution cipher? [closed]
I recently got a file which I had encrypted with substitution cipher a long time ago.
I went to crack down the key and almost got it.
But I encrypted it not just with alphabets but also with numbers ...
- 111
0
votes
2
answers
869
views
I need to generate a CSR on my HSM with a critical key usage of Non Repudation?
As above, we were planning to do the following:
Access our HSM (Luna SA)
Generate CSR
Send CSR to 3rd Party CA
Add critical key usage of Non Repudiation on 3rd Parties portal
Send the now signed CSR (...
- 1
0
votes
1
answer
761
views
WordPress 4.7.2 Authentication Cookie Brute-force
I recently came across a WordPress (v 4.7.2) site with an exposed wp-config.php file, within which plain text server authorisation key secrets were accessible.
Having read Mike Czumak's article on ...
- 409
1
vote
1
answer
947
views
Storing data encryption key (client side)
I have moderate knowledge of programming , and currently I am writing a client-server messaging application for windows. My project is written from scratch using sockets , and all it does is data ...
- 13
0
votes
1
answer
179
views
Encrypt content such that it can decrypted only by a specific application
Is there a key management approach for the following scenario:
Customer Alice uses an application S1 to generate a file. The contents are expected to be encrypted such that it can only be decrypted ...
- 183
5
votes
3
answers
887
views
Public part of SSH key (*.pub): Keep or destroy?
I have set up authentication with a remote system using SSH. I sent the sysadmin the public part of the SSH key (*.pub).
What are the implications of keeping this public key on my machine? Is it good ...
- 151
1
vote
2
answers
1k
views
I'm using SSH with key based authentication and I believe my server has been hacked
Today, I saw my server is heavily loaded. When I began digging I saw that someone logged in as root (despite root user not having a password), installed miner, and ran screen.
SSH listening on other ...
- 11
1
vote
1
answer
3k
views
Pre-shared key authentication between webservers for some security
I have a front-end web server that's calling an API on another web server using GET requests (both hosted by me). It's not critical that outsiders cannot use the API, but I would like to make it ...
- 111
0
votes
1
answer
633
views
Site-to-SIte OpenVPN with shared key
I have two physical sites each with edge router/firewall running pfSense they are directly connected through a WAN link. I've deployed site-to-site OpenVPN using pre-shared key to create tunnel on top ...
- 500
1
vote
1
answer
800
views
How do I securely store a API key in a PC program? [duplicate]
I have a PC program which uses a API. I have the API key stored in the code, because there is no other way I can think of. Since I have no code/string obfuscator, how do I secure the API key, so no ...
- 11
2
votes
2
answers
3k
views
How To decrypt a private key stored in PEM format file
I manage a system that stores RSA private keys.
The user can insert the keys either encrypted or clear text (it's always PEM though). the user also insert a passphrase.
using the openSSL API (and not ...
- 193
1
vote
1
answer
182
views
Is there any advantage to rebooting my computer after handling sensitive information?
A habit that I have had for a long time is rebooting my computer after handling sensitive information. My reason for doing this is to prevent attacks against my computer's memory.
An example of this ...
- 435
22
votes
1
answer
4k
views
Is assigning decrypted keys to a variable in application secure? [duplicate]
Let's say I've retrieved an encrypted secret key from the server. I decrypt it to get the actual secret key, assign the decrypted key to a variable in my app. Something along this:
const encryptedKey ...
- 367
3
votes
2
answers
238
views
is the entire cipher-text needed for decryption in asymmetric encryption?
in symetric encryption it is different. however in asymetirc encryption lets say we have a part of the cipher text only,not the entire ciphertext. you also have the private key. can you decypt that ...
user119042
0
votes
1
answer
599
views
Internal storage scheme for storing private keys inside an HSM
I am trying to understand the internal storage scheme used by HSMs to store the private keys. My question is: are keys stored in plaintext inside an HSM? Are there any variations?
- 1
0
votes
1
answer
116
views
Multiple TLS / SSL sessions originated between 2 Windows Servers (2012R2) sharing the same symmetric session keys - is this possible?
I'm testing a scenario where 2 applications residing on 2 separate windows 2012r2 servers are opening N concurrent TLS1.2 mutual authentication sessions (using different certificates for the client ...
- 123
0
votes
1
answer
398
views
How does Veracrypt proceed with small password?
Veracrypt is a tool to encrypt disk.
It uses many encrypting algorithms, including AES.
I'm wondering if someone knows how Veracrypt proceed if we choose AES encryption with a password of 3 ...
- 717
2
votes
1
answer
185
views
Keeping software signing keys secure
I am creating an application that will automatically sign code with secure keys (.key). The app will run on Windows environment developed in .NET environment (C#). Signing is simple: source code + ...
- 21
5
votes
1
answer
1k
views
Why should I hide API keys?
I need to integrate my android app with dropbox, basically all I want is for the user to choose a file from his dropbox and give it to my app. In order to do that I'm using dropboxChooserSDK, and it ...
- 151
3
votes
1
answer
4k
views
Generate and add new encryption subkey?
My encryption subkey (but not my signing or other subkeys) expired. How do I generate and add a new encryption subkey using gpg?
- 1,726
1
vote
1
answer
100
views
Is there a repository with different ssl related files for testing purpose?
I am looking for a repository with various different ssl related files like certificates (PEM, DER, p7c, ...), certificate requests, keys, ... for testing purpose.
It would also be of interest to get ...
- 207
1
vote
1
answer
770
views
Do I need to decode a base64 representation of a key?
I'm creating a JWT authentication system that needs a secret key for the digital signature. I'm using HMAC SHA256.
After reading the accepted answer here, I decided to use a 128-bit key. I would like ...
- 153
5
votes
2
answers
4k
views
How to properly protect a private key?
I'm a beginner to security, and trying to understand how best to secure a private key. I understand keys should never be stored in plaintext - however, surely encrypting them with another key provides ...
- 415
2
votes
3
answers
430
views
RSA Signature - Why Can't Eve Alter The Public Key
I understand the procedure behind RSA Signatures, so that Eve cannot make forge signatures on any message but my question is what is stopping eve from substituting everything with her own.
For ...
user133058
1
vote
1
answer
204
views
main and sub encryption key on OpenPGP smartcard
The tutorial for creating and storing keys on an OpenPGP smartcard with GPG by the Free Software Foundation (FSF) at wiki.fsfe.org recommends creating a main and sub key for encryption, where the main ...
- 113
0
votes
1
answer
259
views
Where can the Group Transient Key be found by a client after the WPA2 4-Way Handshake?
I am undertaking a project that looks into the ‘Hole 196’ exploit found in WPA2. I am attempting to uncover the current Group Transient Key that my AP is using in an attempt to use it myself to ...
- 133
5
votes
1
answer
7k
views
How to protect API Key in Android application
I was working on one Android App which was communicating with RESTFull server. We made an API Key which was inserted in header of GET and POST requests. This API Key was stored in Strings. App is no ...
- 153
2
votes
0
answers
123
views
Secure Golden Boot Key without Microsoft keys
I'm an Arch Linux user. I'd like to protect myself from the live-usb hack by using SecureBoot:
Create my own Platform Key and sign the kernel with my own key.
Delete the Microsoft PKs
Enable ...
- 141
3
votes
3
answers
218
views
Are my home keys compromised if I use a key duplication machine?
Given that if someone has physical access to your home keys for enough time to take a picture of them, you've already lost, what stops key duplication machines such as MinuteKey from taking pictures ...
- 1,965
0
votes
2
answers
135
views
Can you type your own keys?
Instead of generating keys, is it possible to type your own? For example, could all the characters be A's for example sake. Or do they have to be generated because they are based off of prime numbers ...
- 3,096
4
votes
2
answers
2k
views
Best practice for securing encrypted content on Android app
I have an Android APK which loads in locally stored content files protected by AES encryption, and I want to keep the encryption key secret from all users. Only the app itself should be able to read ...
- 41
-2
votes
1
answer
128
views
Can I show the secret key and IV key to administrators? [closed]
I'm working on a WordPress plugin. This plugin uses password encryption, and uses a secret key and IV key.
Can I show these keys to the administrator or is that insecure? What can happen when someone ...
- 1
5
votes
2
answers
132
views
is it possible to extract a "hint hash" of some kind from another hash?
I'm a web developer starting to dip into cryptography so please bare with me on this...
Let's say I have a collection of hashes that were generated from some common data i.e. changes to multiple ...
- 51
0
votes
1
answer
918
views
Should I really salt in a RSA/AES hybrid connection?
I start by saying that I'm pretty new to encryption and I'm pretty bad at finding weakness in everything.
Said so, i'd like to talk about an huge doubt I'd like to clarify before I end up doing ...
- 3
7
votes
1
answer
5k
views
Car Key Security Questions [duplicate]
I am wondering how car key security works.
Do cars keys just send a simple "lock" and "unlock" signal that works with any car from the manufacturer or any car of the same model? Or are specific keys ...
- 225
2
votes
3
answers
119
views
run through the entire space of keys
Quoting from https://en.wikipedia.org/wiki/Key_size
With a key of length n bits, there are 2n possible keys. This number grows very rapidly as n increases. The large number of operations (2128) ...
- 1,558
0
votes
1
answer
167
views
Would logging into Chase bank website be an example of Asymmetric cryptography? [closed]
Also anyone who is familiar with Outlook, is sending digital signed messages a process of Asymmetric cryptography? Since it uses a public key and requires your Smartcard PIN before you can actually ...
- 51
1
vote
4
answers
466
views
What exactly is a key in cryptography?
After researching and reading I am not sure if I completely understand it. To my knowledge, a key is a password used to decrypt a message. However, the confusion comes in when it comes to the public ...
- 51
1
vote
1
answer
2k
views
err_ssl_pinned_key_not_in_cert_chain
I have a question: how I can prevent this error from server side? We have a new cert, and it's valid, but users getting this error.
Earlier, I've added HTTP response header Public Key Pins with 1 ...
- 11
2
votes
1
answer
1k
views
Choosing Key and IV in AES-256
I am working on a real-life project for a firm. I have to encrypt data using AES 256 as per specification. I want to know how are the key and IV are really chosen in real world projects. /dev/urandom ...
- 121
2
votes
0
answers
225
views
How do I securely encrypt and store database encryption keys? [duplicate]
I have a database with encrypted information, and want to encrypt each entry with a different key. Then I want to store the encrypted keys in another database. I know I have to encrypt the keys before ...
- 21
6
votes
2
answers
972
views
Is it safe to publish something encrypted with a password if you make it insanely difficult to crack?
Let's say you have a very important private key that you don't want to lose. You think of posting it to http://pastebin.com/ but then relize that elimanates the point. So you think of encrypting with ...
- 2,937
1
vote
0
answers
182
views
TLS session refresh - DROWN attack
According to the full technical paper of DROWN attack,
A typical scenario requires the attacker to observe 1,000 TLS
handshakes, then initiate 40,000 SSLv2 connections and perform 2 50
offline ...
- 717