229
Serious certification authorities use heavy procedures. At the core, the CA key will be stored in a Hardware Security Module; but that's only part of the thing. The CA itself must be physically protected, which includes proactive and retrospective measures.
Proactive measures are about preventing attacks from succeeding. For instance, the CA will be stored ...
178
A private key corresponds to a single "identity" for a given user, whatever that means to you. If, to you, an "identity" is a single person, or a single person on a single machine, or perhaps a single instance of an application running on a single machine. The level of granularity is up to you.
As far as security is concerned, you don't ...
129
In practice, a RSA key will work everywhere. ECDSA support is newer, so some old client or server may have trouble with ECDSA keys. A DSA key used to work everywhere, as per the SSH standard (RFC 4251 and subsequent), but this changed recently: OpenSSH 7.0 and higher no longer accept DSA keys by default.
ECDSA is computationally lighter, but you'll need a ...
60
You can use Match in sshd_config to select individual users to alter the PasswordAuthentication directive for. Enter these Match rules at the bottom of sshd_config file ( generally /etc/ssh/sshd_config )
Match User root,foo,bar
PasswordAuthentication no
Match User Rishee
PasswordAuthentication yes
This would give root, foo and bar key ...
40
I've added my answer here as I feel the existing ones don't directly address your question enough for my liking.
Let's look at RFC 4868 (regarding IPSec, however it covers the HMAC-SHA256 function you intend to use - em mine):
Block size: the size of the data block the underlying hash algorithm
operates upon. For SHA-256, this is 512 bits, for ...
38
OK, as you say, you have a private/public pair key so I can send you encrypted e-mail, because I know your public key.
But how do I know your public key? Obviously, because you told me what it was, and if you told me over a secure channel - for example you wrote it on a piece of paper and handed it to me in private - then that's fine.
But if you emailed ...
35
On the physical side they first keep the root CA completely offline. Typically what happens is that they set up the root CA, make subordinates, then take the root CA completely offline and take the hard drives and HSMs (sometimes even the whole server) and essentially lock them in a safe.
Next, they segment the network to keep those subordinate/issuing ...
34
The reality is if other processes can access your process memory or features of your
virtual machine, the game is probably over as you're already compromised. If a process
has access at this level, it can probably gain other information, such as the initial
credentials used to authenticate before obtaining the token or just modifying
results to make token ...
25
As gilles says DSA is risky because if you make signatures (and using your key with a ssh client to log in is effectively making signatures) on a box with a bad RNG your key can be compromised. AIUI this made Debian basically abandon DSA for keys used on their infrastructure in light of the Debian OpenSSL random number generator fiasco.
http://meyering.net/...
25
I think this question can be considered from two different angles: security and convenience.
When we create a SSH key pair, we are asked for providing a passphrase to add a more layer to protect the private-key, as following:
$ ssh-keygen -t rsa -b 4096 -C 'With_OR_Without_Passwd'
Generating public/private rsa key pair.
Enter file in which to save the key (...
24
It depends on how much you want to separate roles.
Basic system: your "signature" is a MAC. The "API key" is a secret value with is shared between the server and the user. Normal MAC algorithms like HMAC can use arbitrary sequences of bits as key, so a key is easily generated by using /dev/urandom (Linux, *BSD, MacOS X), calling CryptGenRandom() (Win32) or ...
20
The point of hashing passwords is that if the attacker can gain access to your password file (by breaking into your server, stealing backup media, hacking your hosting provider, etc.) he/she still can't recover the password from the hash and log in as the user.
19
Reading bytes from a device can be troublesome (you have to account for syscall specificities, e.g. interrupted system calls) and can potentially be inefficient if reading many small chunks (a syscall has a non-negligible overhead). A custom software PRNG, seeded with bytes from /dev/urandom, gives more control over performance.
(Also, there might be a bit ...
19
According to RFC 7518 - JSON Web Algorithms (JWA):
A key of the same size as the hash output (for instance, 256 bits for
"HS256") or larger MUST be used with this algorithm. (This
requirement is based on Section 5.3.4 (Security Effect of the HMAC
Key) of NIST SP 800-117 (sic) [NIST.800-107], which states that the
effective security strength is ...
19
$ man ssh-keygen
[...]
It is possible to specify a passphrase when generating the
key; that passphrase will be used to encrypt the private
part of this file using 128-bit AES.
So this passphrase just encrypts the key locally. An attacker with access to your system will not be able to read the private key, because it's encrypted. (They could install a ...
17
There is an experimental API for this: window.crypto.getRandomValues.
It's supported in
Chrome 11.0
Firefox 21
Internet Explore 11.0
Chrome with Opera skin 15.0
Opera 12 does not support this API, but its Math.Random is secure.
Opera has not yet implemented window.crypto.getRandomValues(). However,
our Math.Random() is using a cryptographically ...
17
Each bit of a key increases the difficulty of a brute-force attack exponentially but there is a trade-off. Adding more bits to the key will negatively effect the speed of encryption/decryption. The actual amount of this speed loss depends on the algorithm, for example in RSA (in theory) for a n-bit key, computational effort for encryption is proportional to ...
17
One of my favourite gems on encryption is from Bruce Schneier in his book Applied Cryptography.
One of the consequences of the second law of thermodynamics is that a
certain amount of energy is necessary to represent information. To
record a single bit by changing the state of a system requires an
amount of energy no less than kT, where T is the ...
17
128 bits of entropy are enough. The whole and only point of considering entropy is to make sure that the system can resist brute force attacks: the space of possible values must be so large that any attacker could only try a negligible proportion of the values in non-ludicrous time. There are strong reasons why 128 bits are highly sufficient for that. ...
15
HKDF is a key derivation function: it turns a symmetric key (a bunch of bytes) into another symmetric key, which can be longer (that's the point of the exercise).
Doing multiple inner iterations, to make the function slow, is a defence mechanism which makes sense when the input key is of inherently low entropy -- e.g. when it is a password (that's an ...
14
A salt is not a secret, it is meant to make the Hash/PBKDF2 result unique to each used instance. As far as a know, the very definition of salt requires it to be random for each computed hash. If it was password derived, two users with the same password could end up with the same verifier -> Bad.
14
Not every CA (government, commercial, or private) stores private keys the same way. Most legitimate operators use a HSM. It's possible that the vendor publishes CRL revocation lists using a one way link from the root to the SubCa. (Transmit-only serial cables, audio cables, QR codes, Ethernet with only a few pins connected.... etc.)
To get specific then ...
13
If you're asking why openssl rand or RAND_bytes() do not simply regurgitate /dev/random or /dev/urandom, it's because their function is to serve only as a PRNG, and they do exactly that:
The rand command outputs num pseudo-random bytes after seeding the random number generator once.
A correctly compiled and operating OpenSSL will read 32 bytes from /dev/...
13
I would not recommend combining random number generators in this way without having some underlying theory to support your case.
A simple way to illustrate the issues is to consider the behavior of low-end LCG algorithms, the popular "one-liner" schemes for generating random numbers.
These can be made to produce sequences that will pass certain statistical ...
12
Whilst I agree with @Thomas's very thorough response above, I'd like to add that I installed the root CA system for a UK banks' own debit card system (each wee chip on the card is actually a certificate).
We used Thales HSM devices (6 figure £ costs) that had proper tamper proof systems for tilt, temperature, physical attack and so on.
In terms of the key ...
12
Loosely-speaking, you can treat the Keyfile as something you have. You can store it on a USB stick for that sole purpose. Whenever you want to decrypt your secret file, you plug that stick and decrypt.
You can add an extra layer of security by making that USB stick a TrueCrypt volume, thus protecting your Keyfile with a password.
Of course, you can hide ...
12
First, my apologies for the math, and for overly simplifying the math!
The difference between DHE and ECDH in two bullet points:
DHE uses modular arithmetic to compute the shared secret.
ECDH is like DHE but in addition, uses algebraic curves to generate keys (An elliptic curve is a type of algebraic curve).
The overall method in both cases is still ...
12
Well, using simple math: If checking one key takes 1000 clock cycles, and the computer has 2,000,000,000 cycles per second, it checks 2 million keys per second. The best case is that the first key you try is correct: total time is half a microsecond. The worst case is that the last key you try is correct: you have 2256 keys divided by around 221 checked a ...
11
It is called threshold encryption (or, here, decryption).
A well-known scheme is Shamir's Secret Sharing. It allows splitting a secret value into n shares, such that any t shares are sufficient to rebuild the secret. n and t can be chosen at will (although you will want to have n greater than t in practice). For the threshold encryption problem, you apply ...
11
An elliptic curve is defined over a finite field of size q for some integer q. Each curve element is a point and has two coordinates X and Y, which are curve elements.
The "size" of the curve, which is the important parameter for its cryptographic strength, is close to q. It can be shown that the total curve size n is such that |n - (q + 1)| ≤ 2*sqrt(q) (...
Only top voted, non community-wiki answers of a minimum length are eligible
