174 votes
Accepted

How can I export my private key from a Java Keytool keystore?

Use Java keytool to convert from JKS to P12... Export from keytool's proprietary format (called "JKS") to standardized format PKCS #12: keytool -importkeystore \ -srckeystore keystore.jks \ -...
user avatar
118 votes

Is it completely safe to publish an ssh public key?

Public Keys are designed for sharing, read access to and or publishing a public key is fine Private Keys are secret, they should only be accessible to the owner of said private key. To drive this ...
user avatar
98 votes

Does OpenPGP key expiration add to security?

tl;dr: the expiry date is no reasonable mechanism to protect the primary key, and you should have a revocation certificate at hand. The slightly longer version is, that the effect of the expiration ...
user avatar
  • 23.2k
82 votes
Accepted

How are private keys kept private?

Firstly, often encryption is terminated at the perimeter by infrastructure which is dedicated to offloading SSL decryption. It makes it much easier to manage when you only have maintain a high degree ...
user avatar
  • 8,434
79 votes
Accepted

How great is the risk in publicly sharing part of a private key?

Providing any part of the private key makes it less secure, at least marginally, simply because it provides an attacker with a smaller potential key space to explore. I fail to understand what you ...
user avatar
  • 18.5k
75 votes
Accepted

Why shouldn't I bring a computer to a key-signing party?

Quote from Wikipedia: Although PGP keys are generally used with personal computers for Internet-related applications, key signing parties themselves generally do not involve computers, since ...
user avatar
  • 1,032
64 votes
Accepted

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

How the Fingerprint and Long and Short Key IDs are Related Each OpenPGP key has a fingerprint attached, calculated mainly from its public key packet which also contains the creation time. The ...
user avatar
  • 23.2k
61 votes

Is it completely safe to publish an ssh public key?

Is it completely safe to publish an ssh public key? No, but you can do it anyway without worries (lots of people do, just look at https://sks-keyservers.net/i/ or https://pgp.mit.edu/) The reason why ...
user avatar
  • 9,115
55 votes

How great is the risk in publicly sharing part of a private key?

Revealing part of the private key can be catastrophic, for some asymmetric (public-key) cryptosystems. The exact level of risk depends on exactly which cryptosystem you are using. Some examples: If ...
user avatar
  • 98.3k
54 votes
Accepted

Protecting a private key by spreading it over multiple places

Just splitting the file up will not have the desired effect (as A.Hersean explains in their answer). I think what you're looking for is "Secret Sharing" algorithms, most notably Shamir's Secret ...
user avatar
53 votes

How are ProtonMail keys distributed?

I am Jason, one of the ProtonMail developers. Decryption uses a combination of asymmetric (RSA) and symmetric (AES) encryption. For PM to PM emails, we use an implementation of PGP where we handle ...
user avatar
  • 556
47 votes

Compute the AES-encryption key given the plaintext and its ciphertext?

I am adding an answer as a community wiki because I believe that the accepted answer is dangerously misleading. Here's my reasoning: The question is asking about being able to derive the AES keys. In ...
47 votes
Accepted

I accidentally published my SSH key passphrase, what to do?

Technically, changing your passphrase is sufficient if you don't also believe that your (password-protected) private key has also been leaked. Realistically, you might just want to replace your SSH ...
user avatar
  • 71.7k
47 votes
Accepted

Not understanding why I should use public/private key encryption over password?

The two options are intended for different use cases. Option 1 is intended for your use case. It encrypts the file with a key derived from a password, so that only the person who knows the password (i....
user avatar
  • 10.8k
46 votes

What is a YubiKey and how does it work?

As I understand it, Yubikey acts like a USB keyboard. You plug it in your computer, place the cursor in a form field, press the button on the Yubikey, and it sends out a text string of 44 characters ...
user avatar
  • 7,349
42 votes
Accepted

Is it dangerous to publicly share ciphertext?

That is exactly what encryption is designed to safely enable. If Bob and Alice could safely share the message without allowing attackers and eavesdroppers access to it, they would not, in fact, need ...
user avatar
  • 35.5k
41 votes

Migrating GPG master keys as subkeys to new master key

It can actually be done. The instructions at atom.smasher.org/gpg/gpg-migrate.txt are now out of date. Try this. As always, make backups, because it's really easy to mess it up. So these are your '...
user avatar
39 votes

Where do you store your personal private GPG key?

This is not what I currently use, but I am thinking about it: Encrypt the private key with very long symmetric encryption key Use Shamir's Secret Sharing to split the symmetric encryption key to 7 ...
user avatar
  • 31k
39 votes

Protecting a private key by spreading it over multiple places

A private or secret key is not meant to be cut. For example, if someone get hold of half of a symmetric key of 128 bits, the strength of the key would not be divided per 2, but it would be reduced by ...
user avatar
  • 9,966
37 votes

Best Practice: ”separate ssh-key per host and user“ vs. ”one ssh-key for all hosts“

I think this question can be considered from two different angles: security and convenience. When we create a SSH key pair, we are asked for providing a passphrase to add a more layer to protect the ...
user avatar
  • 471
37 votes

Is it completely safe to publish an ssh public key?

Nothing is "completely safe"; the question is whether it adds any additional risks. The SSH protocol sends the client's public key encrypted, only after it has negotiated a symmetric session ...
user avatar
36 votes
Accepted

JSON Web Tokens - How to securely store the key?

The reality is if other processes can access your process memory or features of your virtual machine, the game is probably over as you're already compromised. If a process has access at this level, it ...
user avatar
  • 3,242
32 votes

Why shouldn't I bring a computer to a key-signing party?

Firstly, that statement doesn't mean "don't bring a computer"; it means " you don't need to bring a computer". Many people going to their first key signing party are likely to assume that, since the ...
user avatar
32 votes
Accepted

Is assigning decrypted keys to a variable in application secure?

Yes, it does mean that the key will be stored in the application’s memory. Yes, there is a risk that malware (with sufficient privilege) can read it from there. This risk is hard to avoid — if you ...
user avatar
  • 64.2k
29 votes
Accepted

How can WhatsApp restore local or Google Drive Backups?

First assumption: The backup key is saved on WhatsApp servers too. Otherwise a local phone to phone backup would not work? TL;DR: Yes, after some investigation, this seems to be the case. Secondary ...
user avatar
26 votes
Accepted

What to do when you can’t protect mobile app secret keys?

I think I can help resolve your concerns. So what are we trying to protect? We're trying to protect ourselves from an attacker breaking into user accounts via our web services. Specifically, how ...
user avatar
26 votes
Accepted

GnuPG asks for a key ID when sharing my public key, what is that?

OpenPGP User IDs User IDs in OpenPGP are used to connect keys to entities like names and e-mail addresses. These are used to search for keys on key servers, and matching them to users/e-mail addresses....
user avatar
  • 23.2k
26 votes

Is it completely safe to publish an ssh public key?

No, unless you use a unique one per service. It lets attackers identify you. If you use the same public key for service A and service B, and your public key gets leaked for both of them, this will ...
user avatar
  • 2,492
24 votes
Accepted

Are SSH keys and PGP keys the same thing?

Yes, the same RSA key pair can be used for both (Open)SSL and OpenPGP/GnuPG. The monkeysphere project contains a tool to convert RSA keys in PEM format to the one defined by OpenPGP, pem2openpgp. For ...
user avatar
  • 23.2k
24 votes
Accepted

TPM or OpenSSL for key generation?

The difference between using some hardware backed key store (i.e. TPM, HSM, smartcard ...) and a "pure software" solution like openssl genrsa is not so much about the security of the key ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible