Questions tagged [secret-sharing]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
0 answers
48 views

Analyzing impact of leaked client_secret in Authorization Code Flow in Keycloak (CVE-2020-27838)

CVE-2020-27838 describes that Keycloak has an open endpoint where it's possible to obtain client_secret information, as shown in the example below: /auth/realms/{realm}/clients-registrations/default/{...
Marcus's user avatar
  • 21
0 votes
0 answers
70 views

Is it risky to include .env files in the .zip which is uploaded to Elastic Beanstalk for deployment? If so, what is the risk?

Is it okay to upload .env files containing client ID and client secret to elastic beanstalk? If not, what is the risk involved? How would one access those files?
BigMistake's user avatar
0 votes
1 answer
331 views

What does it mean to store secret keys as an "environment variable" as opposed to hardcoded in the source code?

I see why it is obviously bad to store a secret key and client ID in the source code for a web application. However, how do you go about the alternative? Surely, that information has to be stored ...
BigMistake's user avatar
0 votes
0 answers
77 views

How to securely pass secrets if I'm deploying my app n the old school way, rather than using Docker, Heroku, cloud etc?

Is it unsafe to use environmental variables for secret data? ^^ according to that question and answers: Environment variables are a poor (though perhaps passable, as per Forest's comment) way to ...
gaazkam's user avatar
  • 6,015
4 votes
3 answers
1k views

Best method to send credentials to clients

I'm constantly exchanging credentials with my clients for things like database servers, cloud accounts, etc. Neither I nor my clients, have time to implement a sophisticated method for secure ...
Cristobal Sarome's user avatar
0 votes
1 answer
82 views

How to store ClientID and ClientSecret in a K8 Env

I am trying integrate our service with SSO. I have generated the ClientID and ClientSecret. Is it a good security practice to store the ClientID and ClientSecret as a configmap? If not, what are the ...
warrior-oo7's user avatar
1 vote
1 answer
139 views

What Criteria Should We Use to Determine What is and isn't a Secret?

Background: We have product development teams, where each team has one or two QA engineers. They run tests from their local machines. Here is what they require: Application credentials (a clientId ...
jmort253's user avatar
  • 201
1 vote
0 answers
123 views

How does a TPM verify the identity of the calling process/service?

Any application can use a TPM chip to securely create and store cryptographic keys. For example for Digital Rights Management (DRM) or for prevention of cheating in online games. However, how can a ...
Equinox's user avatar
  • 21
0 votes
0 answers
19 views

Is it safe to share sensitive data in a Sharepoint through a public link with third parties? [duplicate]

One of the companies we're working with is sharing their user's database through a public Sharepoint link. While convenient, I'm worried that anyone on the internet can simply access the link (even ...
Nick's user avatar
  • 101
0 votes
1 answer
215 views

Is there a viable zero-knowledge approach for using oAuth to generate and manage private keys?

I've been doing a deep dive into how products like Web3Auth work under the hood and wonder if this is a viable approach to building applications where a user can have the convenience of using oAuth to ...
user3458571's user avatar
1 vote
2 answers
197 views

Encryption method for file that can only be read by program

I have a Python 3 program, and I’m having trouble finding an encryption method that will suit my needs. Suppose the program is on a thumb drive. I would give the thumb drive to someone else, and they ...
Cannabijoy's user avatar
1 vote
2 answers
205 views

API Client Secrets are Being Logged in Plaintext (PowerShell Logs)

I'm currently implementing a PowerShell script to call the Sophos API (https://developer.sophos.com/intro). Write-Output "`nEnter the Sophos API key / client secret." $ClientSecret = Read-...
TheCyberWarden's user avatar
1 vote
2 answers
270 views

Best and safest way to store secret key used for PKA on server?

I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example: Create a 0500 access directory on my server ...
DevelJoe's user avatar
  • 141
0 votes
0 answers
333 views

Best Practice for retrieving secrets securely

So a company I work with currently is using a password management system that lets us retrieve the passwords for an application by providing a secure key to an API. Currently, the key is stored in ...
SpaceCowboy74's user avatar
0 votes
0 answers
25 views

The difference between a virtual door-lock and a public key [duplicate]

The thing that helped me to understand what is a "public key" was to parallel it with a door lock: The door lock is public in the sense that anyone can try to unlock it and the door key is ...
humble-learner's user avatar
4 votes
2 answers
1k views

Web-based secret manager using CryptoJS

I'm building an application, part of which will allow businesses to store secrets. I'm looking at using CryptoJS (https://www.npmjs.com/package/crypto-js). This would encrypt everything on the client ...
vue-coder's user avatar
  • 143
1 vote
0 answers
160 views

Shamir secret sharing, is security reduced by chunking a secret into smaller blocks?

When using Shamir's secret sharing algorithm one has to define the size for the finite field over which the secret is split. I came across a few implementations, like secrets.js-lit, and as far as I ...
Gamer2015's user avatar
  • 727
0 votes
1 answer
307 views

Is there an algorithm like shamir secret sharing that allows arbitrary length inputs?

As far as I understand it, when using Shamir's secret sharing algorithm, you have to specify a finite field for your operations that is big enough to hold your data. I tried to look for secret sharing ...
Gamer2015's user avatar
  • 727
2 votes
3 answers
277 views

How can I pass secrets to a compromised container without the attacker being able to see them?

The most common method of passing secrets to a docker container is through ENVs. The problem is: Imagine that your docker container is hosting a HTTP server that can have a security exploit (like any ...
PedroD's user avatar
  • 121
3 votes
2 answers
765 views

How to securely share a secret/ password by between n individuals, so that majority consensus is required to retrieve the password / secret?

The following constraints apply cannot use physical storage medium (such as Safe/ Vault) the service used to store secret/ password should be highly available and accessible from anywhere in the ...
kaushal's user avatar
  • 167
2 votes
3 answers
232 views

How to share an emergency list with non-technical users so they can only open it in emergencies?

A lot of personal life is digital and should be protected to stay private. But in case of a medical emergency, like being unresponsive in hospital, maybe being in a coma for a few years (possibly ...
allo's user avatar
  • 3,372
2 votes
0 answers
222 views

Long-term symmetric key storage

I have some sensitive data that I need to encrypt and retain long-term (i.e., 5+ years at least). I'd ideally like to secure it using multiple hardware devices via a Shamir share. Something like: ...
Felipe's user avatar
  • 123
0 votes
1 answer
101 views

How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?

Let's say Alice has three secrets: SecretA, SecretB, SecretC Alice shows these three secrets to Bob and gets a single signature from him that signs all three secrets together. Something like Signature ...
matthias_buehlmann's user avatar
2 votes
2 answers
2k views

Environment variables vs secrets managers

I am testing an in-development app locally. Currently I use environment variables to store JWT secrets and database usernames and passwords. I am interested in further securing this, and found out ...
minseong's user avatar
  • 207
0 votes
1 answer
135 views

Cryptographic File Storage scheme

First of all,I am new to security as a whole and taking my first formal course on it.So sorry if any major errors are present. I had a scheme for remote file storage as an attempt to use my course ...
Girish Srivatsa's user avatar
1 vote
1 answer
201 views

Question regarding data encryption/decryption and sharing said keys with third party's

At work we have a pretty complex problem(for me at least) and I have no idea what a fitting solution would be. To give a bit of context, the company I work for is a data processor/provider for big ...
Devchn's user avatar
  • 11
31 votes
3 answers
11k views

Can I use WhatsApp to securely send public key, symmetric key and private key?

I am asking this because WhatsApp says it is end-to-end encrypted. Are there any problems with sending a public key through WhatsApp? There might be some objections to sending symmetric and private ...
Olle Hudga's user avatar
1 vote
1 answer
427 views

Web developer needs customer's private key

As a non security expert, I'm looking for advice from those who are. I work with company X who have hired company Y to develop their website. Company Y needs to integrate server-side online payment ...
user avatar
4 votes
1 answer
701 views

How to authenticate an Add-In on interprocess communication?

We are considering to build a Windows application that is split in 2 parts: one Windows service some Add-Ins for Microsoft Office, Microsoft Management Console (MMC) and PowerShell. Additional info: ...
MartinM's user avatar
  • 41
2 votes
0 answers
154 views

Key handling for shared-key encryption with sodium

Being not a cryptography expert, I am having some basic questions on how to manage keys wrt. sodium-plus. Let me briefly explain the context: the use case involves sending data from a web frontend to ...
schaueho's user avatar
  • 121
0 votes
2 answers
431 views

Generating QR-Code for 2fa from google maps api risky?

I am currently using 2-factor authentication to tighten security for my login system. I use Google Authenticator to scan a QR Code, which generates a key which I can use to login. What worries me ...
Asperger's user avatar
  • 145
0 votes
0 answers
315 views

Generating trusted random numbers for a group?

Alice and Bob need to share some cryptographically-secure random numbers. Alice does not trust Bob, and Bob does not trust Alice. Clearly, if Alice generates some numbers, and hands them to Bob, Bob ...
Him's user avatar
  • 130
1 vote
1 answer
334 views

Find the flaw in my architecture: Shamir's Secret implementation for data encryption and recovery

This will be a long one. Here's the thing: I want to build a privacy-preserving system where the user data is not even accessible to the database administrator. Intuitively, I immediately thought ...
Yakko Majuri's user avatar
0 votes
2 answers
205 views

Secret sharing scheme for disaster recovery with asymmetric key?

I want to backup many secrets using a secret sharing scheme, to make sure my family can access those secrets in case of my death. I need a way to keep adding secrets (without distributing new shares). ...
eloyesp's user avatar
  • 103
1 vote
0 answers
124 views

Is there a secure way to share a secret key to another entity without a use of PKI

My concern is with resource constrained devices with limited resources to perform verification of signatures e.g. RSA signature. What I know is that the asymmetric keys are use to determine that the ...
Njabulo's user avatar
  • 11
1 vote
1 answer
241 views

How can I securely generate secret-sharing/multisig keys on a p2p network?

I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key. ...
36bitavi's user avatar
1 vote
1 answer
110 views

How to facilitate the export of secret strings from an offline system?

I want to use Shamir's Secret Sharing algorithm to store a randomly generated passphrase securely by spreading the secret shares on paper for example. The passphrase is generated on an offline system....
dblouis's user avatar
  • 493
0 votes
0 answers
136 views

How TLS symmetric encryption works?

After the secret symmetric key is exchanged, how does it look like? What length (in a production use) is it and what can influence it? How the key is used to encrypt / decrypt a piece of data? I ...
uIM7AI9S's user avatar
  • 101
0 votes
1 answer
612 views

How can user-less servers be authenticated without sharing secret data?

Background: This is the architecture of the platform I'm working on: The API has several secured endpoints for accessing the database. Users login on the Front End with their credentials, and if ...
schil227's user avatar
  • 113
0 votes
0 answers
115 views

How secure is this scheme?

Introduction of the cryptosystem Let's say we have a system with a central server SRV that is considered secure (communication with this server is secured too with TLS). Then let's say we have many ...
xryl669's user avatar
  • 119
2 votes
1 answer
1k views

Does TLS protect against a man-in-the-middle masquerading as the client?

A message authorization code is used in TLS to prevent man-in-the-middle-attacks that involve tampering with the contents of the packet in-flight. However, there is one specific attack which I don't ...
Aleksey Bilogur's user avatar
2 votes
2 answers
1k views

Securely provide AWS user with keys?

When creating a new user in AWS IAM, an admin sets the user's name and permissions for that user. The user's password and programmatic access keys (if programmatic access is granted) are then ...
octothorpe_not_hashtag's user avatar
0 votes
1 answer
2k views

Is it safe to upload videos in cloud tools like video editors? [closed]

What I have is a video file(with delicate pieces of frames in it) that I want to be edited using cloud apps, without looking further in site maps and that's not always possible too, if you have to ...
user avatar
3 votes
2 answers
257 views

"Family" apps use shared passwords for different usernames. How bad is it?

There exist several "family" apps available for mobile devices that allow family things to be shared: shopping lists, calendars, occasionally device locations, that kind of thing. At least two of ...
michaelb958--GoFundMonica's user avatar
2 votes
1 answer
282 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
Vasu Deo.S's user avatar
1 vote
3 answers
189 views

Security concerns around sharing secret on a website

I need to share credentials with users. These credentials are created when the user wants them, but cannot be chosen by the user specifically (AAD credentials). I want to share the same with the user ...
goluhaque's user avatar
  • 131
1 vote
1 answer
1k views

OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key?

I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its ...
Elmy's user avatar
  • 113
0 votes
0 answers
129 views

Share generated private/public pair among instances of same application

I've been working on a login system which works with JWT. Nothing fancy, you send a valid pair user+password and then you get a signed token to identify yourself on further requests. It is build on ...
coya's user avatar
  • 1
2 votes
2 answers
4k views

Could someone recommend me a citable definition of honest but curious/semi-trusted?

As far as I know honest but curious or also called semi-trusted means that a client follows protocol but will try to learn as much information as possible, without actively “cheating”. Does anyone ...
User12547645's user avatar
36 votes
2 answers
24k views

Is it unsafe to use environmental variables for secret data?

After reading this blog post in which the author lays out arguments against using environmental variables for storing secrets, I am unsure how to proceed with deploying my application. His primary ...
temporary_user_name's user avatar