Questions tagged [secret-sharing]
The secret-sharing tag has no usage guidance.
104
questions
1
vote
1
answer
34
views
Best and safest way to store secret key used for PKA on server?
I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example:
Create a 0500 access directory on my server
...
- 115
0
votes
0
answers
54
views
Best Practice for retrieving secrets securely
So a company I work with currently is using a password management system that lets us retrieve the passwords for an application by providing a secure key to an API. Currently, the key is stored in ...
- 111
0
votes
0
answers
25
views
The difference between a virtual door-lock and a public key [duplicate]
The thing that helped me to understand what is a "public key" was to parallel it with a door lock:
The door lock is public in the sense that anyone can try to unlock it and the door key is ...
4
votes
2
answers
700
views
Web-based secret manager using CryptoJS
I'm building an application, part of which will allow businesses to store secrets.
I'm looking at using CryptoJS (https://www.npmjs.com/package/crypto-js). This would encrypt everything on the client ...
- 43
1
vote
0
answers
87
views
Shamir secret sharing, is security reduced by chunking a secret into smaller blocks?
When using Shamir's secret sharing algorithm one has to define the size for the finite field over which the secret is split. I came across a few implementations, like secrets.js-lit, and as far as I ...
- 695
0
votes
1
answer
152
views
Is there an algorithm like shamir secret sharing that allows arbitrary length inputs?
As far as I understand it, when using Shamir's secret sharing algorithm, you have to specify a finite field for your operations that is big enough to hold your data.
I tried to look for secret sharing ...
- 695
2
votes
3
answers
144
views
How can I pass secrets to a compromised container without the attacker being able to see them?
The most common method of passing secrets to a docker container is through ENVs.
The problem is:
Imagine that your docker container is hosting a HTTP server that can have a security exploit (like any ...
- 121
2
votes
2
answers
297
views
How to securely share a secret/ password by between n individuals, so that majority consensus is required to retrieve the password / secret?
The following constraints apply
cannot use physical storage medium (such as Safe/ Vault)
the service used to store secret/ password should be highly available and accessible from anywhere in the ...
- 167
2
votes
3
answers
188
views
How to share an emergency list with non-technical users so they can only open it in emergencies?
A lot of personal life is digital and should be protected to stay private.
But in case of a medical emergency, like being unresponsive in hospital, maybe being in a coma for a few years (possibly ...
- 3,128
2
votes
0
answers
163
views
Long-term symmetric key storage
I have some sensitive data that I need to encrypt and retain long-term (i.e., 5+ years at least). I'd ideally like to secure it using multiple hardware devices via a Shamir share. Something like:
...
- 123
0
votes
1
answer
72
views
How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?
Let's say Alice has three secrets: SecretA, SecretB, SecretC
Alice shows these three secrets to Bob and gets a single signature from him that signs all three secrets together. Something like
Signature ...
2
votes
2
answers
582
views
Environment variables vs secrets managers
I am testing an in-development app locally.
Currently I use environment variables to store JWT secrets and database usernames and passwords.
I am interested in further securing this, and found out ...
- 197
0
votes
1
answer
101
views
Cryptographic File Storage scheme
First of all,I am new to security as a whole and taking my first formal course on it.So sorry if any major errors are present.
I had a scheme for remote file storage as an attempt to use my course ...
- 103
1
vote
1
answer
123
views
Question regarding data encryption/decryption and sharing said keys with third party's
At work we have a pretty complex problem(for me at least) and I have no idea what a fitting solution would be. To give a bit of context, the company I work for is a data processor/provider for big ...
- 11
31
votes
3
answers
10k
views
Can I use WhatsApp to securely send public key, symmetric key and private key?
I am asking this because WhatsApp says it is end-to-end encrypted.
Are there any problems with sending a public key through WhatsApp?
There might be some objections to sending symmetric and private ...
- 417
1
vote
1
answer
203
views
Web developer needs customer's private key
As a non security expert, I'm looking for advice from those who are.
I work with company X who have hired company Y to develop their website. Company Y needs to integrate server-side online payment ...
- 13
3
votes
1
answer
329
views
How to authenticate an Add-In on interprocess communication?
We are considering to build a Windows application that is split in 2 parts:
one Windows service
some Add-Ins for Microsoft Office, Microsoft Management Console (MMC) and PowerShell.
Additional info:
...
- 31
2
votes
0
answers
109
views
Key handling for shared-key encryption with sodium
Being not a cryptography expert, I am having some basic questions on how to manage keys wrt. sodium-plus. Let me briefly explain the context: the use case involves sending data from a web frontend to ...
- 121
0
votes
2
answers
170
views
Generating QR-Code for 2fa from google maps api risky?
I am currently using 2-factor authentication to tighten security for my login system. I use Google Authenticator to scan a QR Code, which generates a key which I can use to login.
What worries me ...
- 135
0
votes
0
answers
126
views
Generating trusted random numbers for a group?
Alice and Bob need to share some cryptographically-secure random numbers. Alice does not trust Bob, and Bob does not trust Alice. Clearly, if Alice generates some numbers, and hands them to Bob, Bob ...
- 130
1
vote
1
answer
234
views
Find the flaw in my architecture: Shamir's Secret implementation for data encryption and recovery
This will be a long one.
Here's the thing: I want to build a privacy-preserving system where the user data is not even accessible to the database administrator.
Intuitively, I immediately thought ...
- 163
0
votes
2
answers
141
views
Secret sharing scheme for disaster recovery with asymmetric key?
I want to backup many secrets using a secret sharing scheme, to make sure my family can access those secrets in case of my death. I need a way to keep adding secrets (without distributing new shares).
...
- 103
1
vote
0
answers
99
views
Is there a secure way to share a secret key to another entity without a use of PKI
My concern is with resource constrained devices with limited resources to perform verification of signatures e.g. RSA signature. What I know is that the asymmetric keys are use to determine that the ...
- 11
0
votes
1
answer
136
views
How can I securely generate secret-sharing/multisig keys on a p2p network?
I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key.
...
- 1
1
vote
1
answer
84
views
How to facilitate the export of secret strings from an offline system?
I want to use Shamir's Secret Sharing algorithm to store a randomly generated passphrase securely by spreading the secret shares on paper for example.
The passphrase is generated on an offline system....
- 493
0
votes
0
answers
103
views
How TLS symmetric encryption works?
After the secret symmetric key is exchanged, how does it look like?
What length (in a production use) is it and what can influence it?
How the key is used to encrypt / decrypt a piece of data? I ...
- 101
0
votes
1
answer
426
views
How can user-less servers be authenticated without sharing secret data?
Background:
This is the architecture of the platform I'm working on:
The API has several secured endpoints for accessing the database. Users login on the Front End with their credentials, and if ...
- 113
0
votes
0
answers
90
views
How secure is this scheme?
Introduction of the cryptosystem
Let's say we have a system with a central server SRV that is considered secure (communication with this server is secured too with TLS).
Then let's say we have many ...
- 119
1
vote
1
answer
399
views
Does TLS protect against a man-in-the-middle masquerading as the client?
A message authorization code is used in TLS to prevent man-in-the-middle-attacks that involve tampering with the contents of the packet in-flight. However, there is one specific attack which I don't ...
- 113
2
votes
2
answers
491
views
Securely provide AWS user with keys?
When creating a new user in AWS IAM, an admin sets the user's name and permissions for that user. The user's password and programmatic access keys (if programmatic access is granted) are then ...
0
votes
1
answer
2k
views
Is it safe to upload videos in cloud tools like video editors? [closed]
What I have is a video file(with delicate pieces of frames in it) that I want to be edited using cloud apps, without looking further in site maps and that's not always possible too, if you have to ...
user211258
3
votes
2
answers
233
views
"Family" apps use shared passwords for different usernames. How bad is it?
There exist several "family" apps available for mobile devices that allow family things to be shared: shopping lists, calendars, occasionally device locations, that kind of thing. At least two of ...
1
vote
1
answer
182
views
what is the scope of google drive's OAuth credentials?
I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
- 175
1
vote
3
answers
165
views
Security concerns around sharing secret on a website
I need to share credentials with users. These credentials are created when the user wants them, but cannot be chosen by the user specifically (AAD credentials). I want to share the same with the user ...
- 131
1
vote
1
answer
563
views
OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key?
I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its ...
- 113
0
votes
0
answers
90
views
Share generated private/public pair among instances of same application
I've been working on a login system which works with JWT. Nothing fancy, you send a valid pair user+password and then you get a signed token to identify yourself on further requests. It is build on ...
- 1
2
votes
2
answers
2k
views
Could someone recommend me a citable definition of honest but curious/semi-trusted?
As far as I know honest but curious or also called semi-trusted means that a client follows protocol but will try to learn as much information as possible, without actively “cheating”. Does anyone ...
- 173
22
votes
1
answer
13k
views
Is it unsafe to use environmental variables for secret data?
After reading this blog post in which the author lays out arguments against using environmental variables for storing secrets, I am unsure how to proceed with deploying my application.
His primary ...
1
vote
1
answer
1k
views
GPG: Is 'pubring.kbx' safe to share?
This public keyring pubring.kbx (as I merely guess from the name) must be safe to share publicly or is it not? Does it contain any sensitive information with respect to private keys?
I want to back ...
1
vote
2
answers
338
views
What is Byzantine password system?
How safe are password managers like LastPass?
One comment there asks:
Does anyone know of any Byzantine password systems? E.g. 3 or 5 online
systems, where breaking any single system would not ...
- 139
1
vote
1
answer
596
views
Is there any mechanism that using multiple keys encrypt and decrypt a shared document?
I wanted to achieve the following mechanism to encrypt a document
each person in a group of N (user a, b, c...)has her own key;
user a and user b somehow decided to encrypt document M, and they can ...
- 111
5
votes
2
answers
1k
views
Is there a secure way to share a PGP key for use with security.txt?
One of the options for security.txt is to include a reference to a PGP key for use when reporting vulnerabilities in a private, secure way. It makes perfect sense to me for a researcher to use PGP to ...
10
votes
2
answers
2k
views
Is it a bad idea to have the user choose the TOTP secret instead of generating it automatically?
Reading about TOTP-based authentication systems that use smartphones as one-time code generators, I seem to understand that typically the shared secret is generated automatically by the "server" (the ...
- 391
1
vote
0
answers
203
views
Password protected secrets on Vault
We're currently improving our custom secrets management system and I'm looking into different solutions such as Hashicorp Vault or AWS KMS.
So far Vault seems to meet most of our current requirements,...
- 11
-3
votes
1
answer
132
views
How Secret is splitted in Shamir Algorithm [closed]
I have been reading about the Shamir Secret Sharing algorithm. While researching I am still not sure how a secret is split.
So let's suppose we follow example given here.
The secret is 1234 and we ...
- 115
3
votes
1
answer
3k
views
Can I use HashiCorp Vault to restrict access to credentials based on CIDR ranges?
This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet:
A python script gets populated by configuration management ...
- 640
3
votes
0
answers
350
views
Shamir's Secret Sharing for Windows? [closed]
Is there a good implementation of Shamir's Secret Sharing for Windows? I would like to securely transfer files over multiple channels and ensure that only the recipient receiving ALL (and possibly ...
- 131
-1
votes
1
answer
1k
views
Passing a secret in url: as a part of the url or query string? [duplicate]
If I need to make get request to an html page and thus pass a secret via the url using https, is it true that I'd need to pass it in a query string versus a part of a path url?
my_domain.com/some_url/...
- 365
3
votes
1
answer
118
views
Hiring a Third Party Developer, what config files & certificates are ok to share?
So my cofounder and I hired a developer through Guru to build our native iOS and Android MVP's. Long story short, he agreed to integrate Firebase and BrainTree, and originally asked for our account ...
- 31
1
vote
2
answers
2k
views
Store a secret on a Windows computer so that even an administrator cannot access it
I am looking for a way to store a secret on a Windows computer so that even the administrator cannot access it.
But executables that are signed with a specific code signing certificate should be able ...
- 121