Questions tagged [secret-sharing]
The secret-sharing tag has no usage guidance.
88
questions
0
votes
2answers
56 views
Generating QR-Code for 2fa from google maps api risky?
I am currently using 2-factor authentication to tighten security for my login system. I use Google Authenticator to scan a QR Code, which generates a key which I can use to login.
What worries me ...
0
votes
0answers
46 views
Generating trusted random numbers for a group?
Alice and Bob need to share some cryptographically-secure random numbers. Alice does not trust Bob, and Bob does not trust Alice. Clearly, if Alice generates some numbers, and hands them to Bob, Bob ...
1
vote
1answer
110 views
Find the flaw in my architecture: Shamir's Secret implementation for data encryption and recovery
This will be a long one.
Here's the thing: I want to build a privacy-preserving system where the user data is not even accessible to the database administrator.
Intuitively, I immediately thought ...
0
votes
0answers
40 views
Is it better to mask an encryption key or share it directly?
Given a system that shares files for client-side decryption where the server does not know the encryption keys (just stores them in an encrypted form), is it - when sharing a file with a non-user - ...
0
votes
2answers
71 views
Secret sharing scheme for disaster recovery with asymmetric key?
I want to backup many secrets using a secret sharing scheme, to make sure my family can access those secrets in case of my death. I need a way to keep adding secrets (without distributing new shares).
...
1
vote
0answers
56 views
Is there a secure way to share a secret key to another entity without a use of PKI
My concern is with resource constrained devices with limited resources to perform verification of signatures e.g. RSA signature. What I know is that the asymmetric keys are use to determine that the ...
0
votes
1answer
56 views
How can I securely generate secret-sharing/multisig keys on a p2p network?
I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key.
...
1
vote
1answer
45 views
How to facilitate the export of secret strings from an offline system?
I want to use Shamir's Secret Sharing algorithm to store a randomly generated passphrase securely by spreading the secret shares on paper for example.
The passphrase is generated on an offline system....
0
votes
0answers
216 views
GPG — Synchronisation between machine and “No secret key” problem
I am running "pass: the standard unix password manager" v1.7.3 on Fedora 31.
I create a password for "mysite" via
$ pass generate mysite
It creates an entry in my .password-store folder: mysite....
0
votes
0answers
63 views
How TLS symmetric encryption works?
After the secret symmetric key is exchanged, how does it look like?
What length (in a production use) is it and what can influence it?
How the key is used to encrypt / decrypt a piece of data? I ...
0
votes
1answer
138 views
How can user-less servers be authenticated without sharing secret data?
Background:
This is the architecture of the platform I'm working on:
The API has several secured endpoints for accessing the database. Users login on the Front End with their credentials, and if ...
0
votes
0answers
51 views
How secure is this scheme?
Introduction of the cryptosystem
Let's say we have a system with a central server SRV that is considered secure (communication with this server is secured too with TLS).
Then let's say we have many ...
0
votes
1answer
106 views
Does TLS protect against a man-in-the-middle masquerading as the client?
A message authorization code is used in TLS to prevent man-in-the-middle-attacks that involve tampering with the contents of the packet in-flight. However, there is one specific attack which I don't ...
1
vote
2answers
157 views
Securely provide AWS user with keys?
When creating a new user in AWS IAM, an admin sets the user's name and permissions for that user. The user's password and programmatic access keys (if programmatic access is granted) are then ...
0
votes
1answer
924 views
Is it safe to upload videos in cloud tools like video editors? [closed]
What i have is a video file(with delicate pieces of frames in it) that i want to be edited using cloud apps, without looking further in site maps and thats not always possible too, if you have to ...
3
votes
2answers
191 views
“Family” apps use shared passwords for different usernames. How bad is it?
There exist several "family" apps available for mobile devices that allow family things to be shared: shopping lists, calendars, occasionally device locations, that kind of thing. At least two of ...
1
vote
1answer
96 views
what is the scope of google drive's OAuth credentials?
I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
1
vote
3answers
126 views
Security concerns around sharing secret on a website
I need to share credentials with users. These credentials are created when the user wants them, but cannot be chosen by the user specifically (AAD credentials). I want to share the same with the user ...
1
vote
1answer
320 views
OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key?
I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its ...
0
votes
0answers
52 views
Share generated private/public pair among instances of same application
I've been working on a login system which works with JWT. Nothing fancy, you send a valid pair user+password and then you get a signed token to identify yourself on further requests. It is build on ...
0
votes
2answers
751 views
Could someone recommend me a citable definition of honest but curious/semi-trusted?
As far as I know honest but curious or also called semi-trusted means that a client follows protocol but will try to learn as much information as possible, without actively “cheating”. Does anyone ...
9
votes
1answer
2k views
Is it unsafe to use environmental variables for secret data?
After reading this blog post in which the author lays out arguments against using environmental variables for storing secrets, I am unsure how to proceed with deploying my application.
His primary ...
1
vote
1answer
634 views
GPG: Is 'pubring.kbx' safe to share?
This public keyring pubring.kbx (as I merely guess from the name) must be safe to share publicly or is it not? Does it contain any sensitive information with respect to private keys?
I want to back ...
1
vote
2answers
269 views
What is Byzantine password system?
How safe are password managers like LastPass?
One comment there asks:
Does anyone know of any Byzantine password systems? E.g. 3 or 5 online
systems, where breaking any single system would not ...
1
vote
1answer
383 views
Is there any mechanism that using multiple keys encrypt and decrypt a shared document?
I wanted to achieve the following mechanism to encrypt a document
each person in a group of N (user a, b, c...)has her own key;
user a and user b somehow decided to encrypt document M, and they can ...
5
votes
2answers
647 views
Is there a secure way to share a PGP key for use with security.txt?
One of the options for security.txt is to include a reference to a PGP key for use when reporting vulnerabilities in a private, secure way. It makes perfect sense to me for a researcher to use PGP to ...
10
votes
2answers
2k views
Is it a bad idea to have the user choose the TOTP secret instead of generating it automatically?
Reading about TOTP-based authentication systems that use smartphones as one-time code generators, I seem to understand that typically the shared secret is generated automatically by the "server" (the ...
1
vote
0answers
131 views
Password protected secrets on Vault
We're currently improving our custom secrets management system and I'm looking into different solutions such as Hashicorp Vault or AWS KMS.
So far Vault seems to meet most of our current requirements,...
-3
votes
1answer
87 views
How Secret is splitted in Shamir Algorithm [closed]
I have been reading about the Shamir Secret Sharing algorithm. While researching I am still not sure how a secret is split.
So let's suppose we follow example given here.
The secret is 1234 and we ...
3
votes
1answer
996 views
Can I use HashiCorp Vault to restrict access to credentials based on CIDR ranges?
This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet:
A python script gets populated by configuration management ...
3
votes
0answers
237 views
Shamir's Secret Sharing for Windows? [closed]
Is there a good implementation of Shamir's Secret Sharing for Windows? I would like to securely transfer files over multiple channels and ensure that only the recipient receiving ALL (and possibly ...
-1
votes
1answer
259 views
Passing a secret in url: as a part of the url or query string? [duplicate]
If I need to make get request to an html page and thus pass a secret via the url using https, is it true that I'd need to pass it in a query string versus a part of a path url?
my_domain.com/some_url/...
3
votes
1answer
81 views
Hiring a Third Party Developer, what config files & certificates are ok to share?
So my cofounder and I hired a developer through Guru to build our native iOS and Android MVP's. Long story short, he agreed to integrate Firebase and BrainTree, and originally asked for our account ...
1
vote
2answers
985 views
Store a secret on a Windows computer so that even an administrator cannot access it
I am looking for a way to store a secret on a Windows computer so that even the administrator cannot access it.
But executables that are signed with a specific code signing certificate should be able ...
1
vote
1answer
643 views
Is it secure to store encryption key (encrypted with master key) with the data it was used to encrypt?
I am working on a password sharing web site. I would like users to be able to enter their credentials and share them with other users. I am thinking about using KMS service to store master key (just ...
1
vote
2answers
203 views
Is it safe to hide secrets this way?
I have n secrets to hide, my goal is to remember only a seed and derive them from the seed. Is this a safe aproach?
Calculate n keys:
k(1) = seed XOR secret(1)
...
k(n) = seed XOR secret(n)
Store ...
3
votes
4answers
2k views
What is the most secure way of transferring a secret between 2 processes running on the same system?
As a part of my system, I have many processes, each of them created through a script. One of the processes can be considered as a "Master Process" in the sense that this process communicates with the ...
2
votes
1answer
455 views
Is it safe to store secrets in LDAP?
Many systems store secret or sensitive information in LDAP attributes. For example, IEC/TS 62351-8 prescribes storage of user tokens in LDAP.
Is it safe to store secret or sensitive information as an ...
3
votes
0answers
94 views
Credential leaking while unconscious [closed]
Bear with me here, because this admittedly sounds nutty, but I had a dream last night in which I distinctly recall (accurately) typing the master password for my password manager into a (dream) ...
1
vote
1answer
101 views
Sharing credentials based on the network profile
Is there a way to share logins/passwords with a number of individuals, basing on their public network profile?
Example: a number of people working together in the office should have access ...
2
votes
0answers
93 views
Node.js ENV VAR Security
Recently I had a debate with a fellow dev about where to store Node.js env vars.
I always use .env files and load these as proper ENV VARs at runtime, however my fellow dev uses JSON config files and ...
3
votes
1answer
105 views
Which is the most recommended way to expose a file to a computer in an external network in a secure way?
I have two machines in an internal network. One is a development server, which is isolated from external communications (neither through HTTP, HTTPS, SSH, etc). The last one is a production server (...
0
votes
1answer
99 views
Can a secret, S, be efficiently recovered from a list of usernames and SHA256(S + username)s?
Given a set of usernames and their corresponding proofs of knowledge of a shared secret: SHA256($SECRET + username), can an attacker recover $SECRET more efficiently than by brute force?
(This is ...
3
votes
2answers
98 views
Spam email with my address details
I have registered domain under .xyz 123reg domain registration company. Recently I got an email from ummed.org company informing me that my SEO engine will be going to expire soon and I need to make ...
15
votes
1answer
6k views
What security advantages does Hashicorp Vault have over storing secrets (passwords, API keys) in environment variables?
There seems to be a general recommendation to store secrets in the Hashicorp Vault instance (or similar key-management software) and avoid passing secrets via environment variables.
In what particular ...
0
votes
1answer
46 views
Secure message transportation [duplicate]
It is secure to use the shared secret as the key for a HMAC? is it better to derive one key for all of the messages that are going to be HMACed or a key for each message?
Is it safe to use the shared ...
1
vote
0answers
76 views
Detecting cloaking at the client side
According to this paper(reference: section IX), it may be possible for clients to detect cloaking. It basically says, whenever you fetch a page from a url(assumed to clicked from the search results),...
1
vote
0answers
123 views
pass secret key over tls\ssl [closed]
Let's say that I have a client and server connected over SSL\TLS.
Once the handshake is done, both sides have a shared secret key that they will use to encrypt\decrypt the data.
Can I use this ...
6
votes
2answers
4k views
How to securely store secrets in Docker container?
The application I'm working on has more than a dozen of secrets, SSL certificates and API keys. Currently I have a file that's added into .gitignore and it contains all my secrets. How to securely ...
0
votes
1answer
7k views
RADIUS Authentication and Shared Secret, is secure?
I am considering the implementation of a 2 Factor Authentication server and I am concerned that the RADIUS authentication via Shared Secret is not secure enough as for example an attacker could at ...
