287 votes
Accepted

What are ssh-keygen best practices?

I recommend the Secure Secure Shell article, which suggests: ssh-keygen -t ed25519 -a 100 Ed25519 is an EdDSA scheme with very small (fixed size) keys, introduced in OpenSSH 6.5 (2014-01-30) and made ...
Adam Katz's user avatar
  • 11.2k
44 votes

Best Practice: ”separate ssh-key per host and user“ vs. ”one ssh-key for all hosts“

I think this question can be considered from two different angles: security and convenience. When we create a SSH key pair, we are asked for providing a passphrase to add a more layer to protect the ...
YaOzI's user avatar
  • 541
32 votes
Accepted

ssh-keygen: What is the passphrase for?

$ man ssh-keygen [...] It is possible to specify a passphrase when generating the key; that passphrase will be used to encrypt the private part of this file using 128-bit AES. So this passphrase just ...
Luc's user avatar
  • 32.9k
30 votes

What are ssh-keygen best practices?

Most users would simply type ssh-keygen and accept what they're given by default. Yes. To do a security for people, it needs to be simple. Therefore the default option should be safe, compatible and ...
Jakuje's user avatar
  • 5,739
29 votes
Accepted

What exactly is a subkey?

This post by user rjh from 2008 in the enigmail forum answers it well: Originally in PGP 2.6, back in the early 90s, you had just one keypair and it was used for both encryption and signing. The ...
Geremia's user avatar
  • 1,736
28 votes
Accepted

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

See MDN: Crypto.getRandomValues(), where it reads: The Crypto.getRandomValues() method lets you get cryptographically strong random values. (emphasis mine) In contrast, see MDN: Math.random(), where ...
mti2935's user avatar
  • 23.4k
27 votes
Accepted

Why does an encryption key derived from your lock screen password give you stronger protection (in Android 11)?

In all cases, the encryption key is chosen at random by the device (your mobile phone). When biometrics are used to unlock the phone, they are checked by a mostly secure module (a TEE, in your case ...
A. Hersean's user avatar
  • 10.6k
24 votes
Accepted

TPM or OpenSSL for key generation?

The difference between using some hardware backed key store (i.e. TPM, HSM, smartcard ...) and a "pure software" solution like openssl genrsa is not so much about the security of the key ...
Steffen Ullrich's user avatar
22 votes

What are requirements for HMAC secret key?

According to RFC 7518 - JSON Web Algorithms (JWA): A key of the same size as the hash output (for instance, 256 bits for "HS256") or larger MUST be used with this algorithm. (This ...
jordanbtucker's user avatar
16 votes

What are ssh-keygen best practices?

Here's a one liner for Ed25519 based on recommended values: (without passphrase) ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519 -q -N '' Another one for RSA: ssh-keygen -t rsa -b 4096 -o -a 100 -f ...
Yassine ElBadaoui's user avatar
14 votes

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

Your friend is correct; always use Crypto.getRandomValues instead of Math.random for anything related to security. Math.random is designed for statistical simulations; and the numbers it produces ...
John Deters's user avatar
  • 34.2k
12 votes

Connection between PIN/password and encryption keys in Android

File Based Encryption (FBE) keys are cryptographically bound to lock screen authentication. Without lock screen credentials, keys that decrypt FBE keys cannot be derived. Lock screen authentication ...
defalt's user avatar
  • 6,841
12 votes
Accepted

Rotating encryption keys - how does it work?

In layman's terms, rotating an encryption key implies: Generate new key(s) Re-encrypt all data that was encrypted using the old key, using new key(s) Delete old encrypted data and old encrypted key ...
gowenfawr's user avatar
  • 72.9k
11 votes

SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when?

Use RSA. Not for security reasons, but for compatibility reasons. I don't recommend using DSA keys. As of OpenSSH 7.0, SSH no longer supports DSA keys by default. As the release notes for OpenSSH ...
D.W.'s user avatar
  • 99.5k
10 votes

Best Practice: ”separate ssh-key per host and user“ vs. ”one ssh-key for all hosts“

As a rule of thumb, I agree with the other answers - a single key per user is often the most practical way to go. It is not, however, good as a one-size-fits-all approach. Here are a few additional ...
Kevin Keane's user avatar
  • 1,097
10 votes
Accepted

What's the best length for randomly generated passwords? (Security vs. compatibility)

If your passwords are n characters randomly drawn, with equal probability, from a set of 95 characters (which is about all the ASCII printable characters minus space), then each character gives you ...
Luis Casillas's user avatar
10 votes

Rotating encryption keys - how does it work?

The meaning of rotate is going to depend on your data owner’s security policy. It may help to understand how keys are often managed in a key-management system using a key lifecycle state chart. A ...
John Deters's user avatar
  • 34.2k
10 votes

What research suggests that user's mouse movements are (not) sufficiently unpredictable for secret key generation?

I do not believe there are any research papers that describe the unpredictability of the neuromuscular system in the context of computer security and at the sample rates that are relevant, so I can't ...
forest's user avatar
  • 66.6k
10 votes
Accepted

Preparing to change over to new GPG-key - what to do with my old ones?

Thanks for the comment response, that helped a little bit. These are general recommendations, YMMV and you can always tweak them to your own needs. This is just a good place to start and things to ...
Ruscal's user avatar
  • 851
9 votes
Accepted

What is the exact meaning of "Keying material"?

What is the exact meaning of “Keying material”? Keying material is a more general and fancy term for "secret keys of (unspecified) format, length and amount", where the "unspecified&...
SEJPM's user avatar
  • 9,760
8 votes

Which ECC to choose with GPG?

First, the options for generating a key with gpg provide you an option for creating your Master (certify) key at the same time as an encryption subkey. These are the options for (1), (2), and (9). ...
Jared's user avatar
  • 182
8 votes
Accepted

Should the client or the server generate the client's public-private key pair?

My question is, in short, should the client or the server generate the public-private key pair? In theory, the client should generate their own key pair. That way the private key: is known only ...
gowenfawr's user avatar
  • 72.9k
8 votes

Derive a key (and not store it) from a passphrase, to be used with AES

Your approach is fine, but you are missing one thing: changing passwords. I would recommend changing PBKDF2 with a more modern KDF, like Argon2. With your approach, you will need to decrypt and ...
ThoriumBR's user avatar
  • 53.9k
7 votes
Accepted

Why is the Key Derivation Function important?

"the only thing that is important to get in order to decrypt an encrypted file": I think this is where you go wrong in your reflection, if I can say so. The only thing which is important is not for ...
WhiteWinterWolf's user avatar
7 votes

Generating a secure AES key?

No What you're doing, is asking the user to enter a 16-character string or, in other words, a password. It's true that 16 bytes can fit 128 bits, but that only holds for data where all possible byte ...
ilkkachu's user avatar
  • 2,165
7 votes

Generating temporary passwords/tokens using RNG

Since it looks like you are using Ruby's default RNG, the Mersenne Twister, it is possible for an attacker to obtain the seed of the RNG, and therefore compromise all past, present, and future numbers ...
LamerZ's user avatar
  • 79
7 votes
Accepted

Details of a good WPA2 pre-shared key (password)?

Contrary to the originally accepted answer, a random multiword passphrase is not subject to what we usually mean when we say "dictionary attack" (that's when you just throw a large wordlist at a hash, ...
Royce Williams's user avatar
6 votes

How AWS access key id and secret access key are generated internally

From the documentation [0][1], we see that you prove to AWS that you know the Secret Access Key using HMAC, not using Digital Signatures. This means that when verifying the authentication, AWS must be ...
Z.T.'s user avatar
  • 8,494
6 votes

Why does an encryption key derived from your lock screen password give you stronger protection (in Android 11)?

By design, File Based Encryption (FBE) keys are cryptographically bound to Lock Screen Knowledge Factor (LSKF). This prevents an adversary to decrypt Credential Encrypted storage by extracting FBE ...
defalt's user avatar
  • 6,841

Only top scored, non community-wiki answers of a minimum length are eligible