Skip to main content
75 votes

Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?

Without access to the key, then the problem for attackers is the same as if there was no backdoor key: the attackers would have to break the encryption itself. But ... If we assume that the ...
schroeder's user avatar
  • 131k
41 votes
Accepted

Securing API keys for a Twitter account for a program to be run on other PC's

As specified, the problem is completely impossible. You can not, and should not attempt to, make a program - much less a script - do something its user can't see. There are many ways the attacker ...
CBHacking's user avatar
  • 49.6k
32 votes
Accepted

Is assigning decrypted keys to a variable in application secure?

Yes, it does mean that the key will be stored in the application’s memory. Yes, there is a risk that malware (with sufficient privilege) can read it from there. This risk is hard to avoid — if you ...
Anders's user avatar
  • 65.7k
27 votes

Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?

While I agree that every point of schroeder's response is true, there are two deeper issues that make it so much more dangerous than the current model of security. Right now, if you install an ...
Nosajimiki's user avatar
  • 1,857
17 votes

Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?

If there's a backdoor, it will be abused. The question is when, not if it will be abused. There are too many actors that could compromise such a system, and no easy way to plug the holes. If a ...
ThoriumBR's user avatar
  • 54.6k
12 votes

PGP public key is visible

Public keys are intended to be published. The corresponding private key is the secure part that should not be published. The purpose of a public key is twofold: It is something anyone can use to ...
Ezekiel's user avatar
  • 223
10 votes

Securing API keys for a Twitter account for a program to be run on other PC's

Obviously, I need a way to encrypt they keys so they're not accessible to the user running the program Obviously, this is impossible. Keys are just data. Software is just data. Everything is just ...
Brian Drake's user avatar
9 votes

Do I need to use salt with api key hashing?

No. You do not need to add a salt to an API key's hash. The API key should have been created from a high entropy random source, capable of resisting attacks that attempt to guess future keys based on ...
Ghedipunk's user avatar
  • 6,060
9 votes

Write a Python or C program to guess the key

I agree with multithr3at3d that this question smells like a homework problem. But, it's a fun exercise - and more importantly, it highlights the reason that strong random number generators are so ...
mti2935's user avatar
  • 23.7k
8 votes
Accepted

How to protect API Key in Android application

So, you're asking if you can store the API Key in the App, but also protect it from being stolen? This is not possible. There is a possible solution to make theft more difficult. Use OTP XOR ...
700 Software's user avatar
8 votes

Validating an Ed25519 public key

Yes. In order for the public key to be valid (i.e. not just 32 random bytes), the point must be on the curve. You can test if the point is on the curve by plugging the x and y values into the ...
mti2935's user avatar
  • 23.7k
7 votes
Accepted

Car Key Security Questions

No. Since in usual, theres single-direction communication with the car. So usually, each key has its own "encryption key" and a "counter". In the car, theres a list of valid encryption keys and a ...
sebastian nielsen's user avatar
7 votes

Why should I hide API keys?

I don't know anything about Dropbox in particular, but my understanding of API keys from other storage providers like Google Drive, Amazon S3, etc is that they allow users to log in either through ...
Mike Ounsworth's user avatar
7 votes
Accepted

AES-256 decryption after key destruction. Possible or not?

In theory, you could try to brute force the key and recover the data. In practice, that's extraordinarily unlikely to be successful as it would be expected to take a very, very long time. Per ...
Swashbuckler's user avatar
  • 2,205
7 votes
Accepted

HMAC and key size

An HMAC is a very simple construction. You could have come up with it yourself, except that HMAC is standardised which means that a lot of people looked at it and found it to be resistant against ...
Luc's user avatar
  • 33k
6 votes
Accepted

Can you type your own keys?

For RSA there are special requirements on how to formulate a key. Primarily (pun not intended) you need the p and q values, which are large primes. There are, however, schemes (see here and here) ...
Polynomial's user avatar
  • 135k
6 votes

Can secrets be made safe in memory?

While everyone else has suggested a hardware solution, I'll suggest a software solution (though I don't mean to imply that it's any better or worse than using an HSM - that you'll have to decide on ...
forest's user avatar
  • 67k
6 votes

Can secrets be made safe in memory?

I answered a similar question here. For a normal hardware solution, a hardware security module (HSM) does this. For software, .NET offers the Secure String mechanism to encrypt and protect sensitive ...
md_1976's user avatar
  • 139
6 votes

Public part of SSH key (*.pub): Keep or destroy?

The whole point of your public key is that you can share it with anyone. It doesn't matter if someone gets it, it doesn't matter if it's on your machine. It isn't a target for attackers so it would ...
Rory Alsop's user avatar
  • 61.5k
6 votes
Accepted

How often do brute force attacks find the password or key in a much shorter amount of time than the theoretical max?

What are the chances that the key is the very last key for the brute force attack to check? If there are N keys, the chance is 1/N. If you have n bits of entropy, that means the chance is 2-n. ......
Anders's user avatar
  • 65.7k
6 votes

HMAC and key size

You might want to take a look at the RFC 2104: Definition of HMAC The definition of HMAC requires a cryptographic hash function, which we denote by H, and a secret key K. We assume H to be a ...
Euphrasius von der Hummelwiese's user avatar
6 votes

Is it possible to LUKS require both password and key file?

LUKS does not support requiring both a keyfile and a passphrase to decrypt. The encrypted volume can be decrypted as long as you provide satisfactory credentials to any one of the configured keyslots. ...
forest's user avatar
  • 67k
6 votes
Accepted

Understanding AES Keys and Passphrases

This question is both too broad and too narrow, but I'll see what I can do. Your understanding about AES block and key sizes is correct. Usually, yes, you'd want to use a cryptographically secure (P)...
CBHacking's user avatar
  • 49.6k
6 votes
Accepted

Difference in ECDSA private key format

(I feel sure I've answered essentially this question before, but I can't find a dupe.) OpenSSL partly created, and supports, two (or four depending how you count) types of PEM formats for private keys....
dave_thompson_085's user avatar
6 votes
Accepted

Impact of having more X509v3 Key Usage fields than required?

Allowing extra usage types can go anywhere from not mattering to being a critical security breach, depending on what parts of your infrastructure trust certificates from that particular certificate ...
Gilles 'SO- stop being evil''s user avatar
5 votes

Is it safe to publish something encrypted with a password if you make it insanely difficult to crack?

The reason for key strengthening is that passwords don't have as much entropy as is expected for the key. The time it takes to break a key is proportional to the number of possible keys. Strengthening ...
Gilles 'SO- stop being evil''s user avatar
5 votes

Can I show the secret key and IV key to administrators?

The first question is, for the love of $DEITY, why are you using password encryption? Passwords should be passed through a secure and slow key derivation function, something like PBKDF2 or scrypt, and ...
CBHacking's user avatar
  • 49.6k
5 votes

How do I securely store a API key in a PC program?

Put simply, there is no bulletproof way of concealing a string if it is being made available on the client-side. Maybe instead of giving the user access to the API key, make the client contact your ...
Adam Lindsay's user avatar
5 votes

Pre-shared key authentication between webservers for some security

There are several ways to do this, depending upon how complex you want to get. For example, you could go all the way of implementing an OAuth2 service and having your servers authenticate with each ...
Yurelle's user avatar
  • 171
5 votes

Why are SSH host keys stored un-encrypted?

The private part of the host key is needed at sshd startup. It would be inconvenient to require a superuser to input the passphrase every time sshd is started. Obviously, storing the passphrase ...
Marc's user avatar
  • 4,301

Only top scored, non community-wiki answers of a minimum length are eligible