174
votes
Accepted
How can I export my private key from a Java Keytool keystore?
Use Java keytool to convert from JKS to P12...
Export from keytool's proprietary format (called "JKS") to standardized format PKCS #12:
keytool -importkeystore \
-srckeystore keystore.jks \
-...
- 2,578
118
votes
Is it completely safe to publish an ssh public key?
Public Keys are designed for sharing, read access to and or publishing a public key is fine
Private Keys are secret, they should only be accessible to the owner of said private key.
To drive this ...
- 7,453
98
votes
Does OpenPGP key expiration add to security?
tl;dr: the expiry date is no reasonable mechanism to protect the primary key, and you should have a revocation certificate at hand.
The slightly longer version is, that the effect of the expiration ...
- 23.2k
82
votes
Accepted
How are private keys kept private?
Firstly, often encryption is terminated at the perimeter by infrastructure which is dedicated to offloading SSL decryption. It makes it much easier to manage when you only have maintain a high degree ...
- 8,434
79
votes
Accepted
How great is the risk in publicly sharing part of a private key?
Providing any part of the private key makes it less secure, at least marginally, simply because it provides an attacker with a smaller potential key space to explore.
I fail to understand what you ...
- 18.5k
75
votes
Accepted
Why shouldn't I bring a computer to a key-signing party?
Quote from Wikipedia:
Although PGP keys are generally used with personal computers for
Internet-related applications, key signing parties themselves
generally do not involve computers, since ...
- 1,032
64
votes
Accepted
Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?
How the Fingerprint and Long and Short Key IDs are Related
Each OpenPGP key has a fingerprint attached, calculated mainly from its public key packet which also contains the creation time. The ...
- 23.2k
61
votes
Is it completely safe to publish an ssh public key?
Is it completely safe to publish an ssh public key?
No, but you can do it anyway without worries (lots of people do, just look at https://sks-keyservers.net/i/ or https://pgp.mit.edu/)
The reason why ...
- 9,115
55
votes
How great is the risk in publicly sharing part of a private key?
Revealing part of the private key can be catastrophic, for some asymmetric (public-key) cryptosystems. The exact level of risk depends on exactly which cryptosystem you are using. Some examples:
If ...
- 98.3k
54
votes
Accepted
Protecting a private key by spreading it over multiple places
Just splitting the file up will not have the desired effect (as A.Hersean explains in their answer).
I think what you're looking for is "Secret Sharing" algorithms, most notably Shamir's Secret ...
- 57.4k
53
votes
How are ProtonMail keys distributed?
I am Jason, one of the ProtonMail developers.
Decryption uses a combination of asymmetric (RSA) and symmetric (AES) encryption.
For PM to PM emails, we use an implementation of PGP where we handle ...
- 556
47
votes
Compute the AES-encryption key given the plaintext and its ciphertext?
I am adding an answer as a community wiki because I believe that the accepted answer is dangerously misleading. Here's my reasoning:
The question is asking about being able to derive the AES keys. In ...
47
votes
Accepted
I accidentally published my SSH key passphrase, what to do?
Technically, changing your passphrase is sufficient if you don't also believe that your (password-protected) private key has also been leaked.
Realistically, you might just want to replace your SSH ...
- 71.7k
47
votes
Accepted
Not understanding why I should use public/private key encryption over password?
The two options are intended for different use cases.
Option 1 is intended for your use case. It encrypts the file with a key derived from a password, so that only the person who knows the password (i....
- 10.8k
46
votes
What is a YubiKey and how does it work?
As I understand it, Yubikey acts like a USB keyboard. You plug it in your computer, place the cursor in a form field, press the button on the Yubikey, and it sends out a text string of 44 characters ...
- 7,349
42
votes
Accepted
Is it dangerous to publicly share ciphertext?
That is exactly what encryption is designed to safely enable. If Bob and Alice could safely share the message without allowing attackers and eavesdroppers access to it, they would not, in fact, need ...
- 35.5k
41
votes
Migrating GPG master keys as subkeys to new master key
It can actually be done.
The instructions at atom.smasher.org/gpg/gpg-migrate.txt are now out of date.
Try this. As always, make backups, because it's really easy to mess it up.
So these are your '...
- 511
39
votes
Where do you store your personal private GPG key?
This is not what I currently use, but I am thinking about it:
Encrypt the private key with very long symmetric encryption key
Use Shamir's Secret Sharing to split the symmetric encryption key to 7 ...
- 31k
39
votes
Protecting a private key by spreading it over multiple places
A private or secret key is not meant to be cut. For example, if someone get hold of half of a symmetric key of 128 bits, the strength of the key would not be divided per 2, but it would be reduced by ...
- 9,966
37
votes
Best Practice: ”separate ssh-key per host and user“ vs. ”one ssh-key for all hosts“
I think this question can be considered from two different angles: security and convenience.
When we create a SSH key pair, we are asked for providing a passphrase to add a more layer to protect the ...
- 471
37
votes
Is it completely safe to publish an ssh public key?
Nothing is "completely safe"; the question is whether it adds any additional risks.
The SSH protocol sends the client's public key encrypted, only after it has negotiated a symmetric session ...
- 10.1k
36
votes
Accepted
JSON Web Tokens - How to securely store the key?
The reality is if other processes can access your process memory or features of your
virtual machine, the game is probably over as you're already compromised. If a process
has access at this level, it ...
- 3,242
32
votes
Why shouldn't I bring a computer to a key-signing party?
Firstly, that statement doesn't mean "don't bring a computer"; it means " you don't need to bring a computer". Many people going to their first key signing party are likely to assume that, since the ...
- 1,736
32
votes
Accepted
Is assigning decrypted keys to a variable in application secure?
Yes, it does mean that the key will be stored in the application’s memory. Yes, there is a risk that malware (with sufficient privilege) can read it from there. This risk is hard to avoid — if you ...
- 64.2k
29
votes
Accepted
How can WhatsApp restore local or Google Drive Backups?
First assumption: The backup key is saved on WhatsApp servers too. Otherwise a local phone to phone backup would not work?
TL;DR: Yes, after some investigation, this seems to be the case.
Secondary ...
- 3,316
26
votes
Accepted
What to do when you can’t protect mobile app secret keys?
I think I can help resolve your concerns.
So what are we trying to protect? We're trying to protect ourselves from
an attacker breaking into user accounts via our web services. Specifically, how ...
- 14.6k
26
votes
Accepted
GnuPG asks for a key ID when sharing my public key, what is that?
OpenPGP User IDs
User IDs in OpenPGP are used to connect keys to entities like names and e-mail addresses. These are used to search for keys on key servers, and matching them to users/e-mail addresses....
- 23.2k
26
votes
Is it completely safe to publish an ssh public key?
No, unless you use a unique one per service. It lets attackers identify you.
If you use the same public key for service A and service B, and your public key gets leaked for both of them, this will ...
- 2,492
24
votes
Accepted
Are SSH keys and PGP keys the same thing?
Yes, the same RSA key pair can be used for both (Open)SSL and OpenPGP/GnuPG.
The monkeysphere project contains a tool to convert RSA keys in PEM format to the one defined by OpenPGP, pem2openpgp. For ...
- 23.2k
24
votes
Accepted
TPM or OpenSSL for key generation?
The difference between using some hardware backed key store (i.e. TPM, HSM, smartcard ...) and a "pure software" solution like openssl genrsa is not so much about the security of the key ...
- 181k
Only top scored, non community-wiki answers of a minimum length are eligible