 |
|
|
| > |
QUESTION POSED ON: 06 December 2005
What is a keyring? If keys are stored in a file on a user's computer as keyrings, how are the keys secured? Second, crypto experts say that user-remembered keys are not secure. A weak key may even weaken the strongest algorithm, because their entropy is less. Therefore, if difficult keys are generated having good entropy, then a user cannot remember it. He needs to jot is down. However, jotting down again compromises security. What is the solution?
|
|
|
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
|
|
BROWSE BY TAG
Application Security,
Identity Management Technology and Strategy,
Enterprise User Provisioning Tools,
Enterprise Identity and Access Management,
PKI and Digital Certificates,
User Authentication Services,
Password Management and Policy,
Application and Platform Security,
Email Protection,
Email Security Guidelines, Encryption and Appliances, VIEW ALL TAGS
|
|
A keyring is the term used by PGP for a key management file. The keys are encrypted and stored in this file to protect them from unauthorized use. PGP stores keys in two files, one for public keys and another for private keys. It is important to choose a passphrase of a decent length and complexity because PGP encrypts the private keys with this passphrase. Private key encryption is completed by hashing the passphrase using SHA-1. 128 bits of this hash are also used as an encryption key. With this key, the private key is encrypted using CAST-128. The passphrase and the hash are never stored.
Remembering or storing a strong, secure password has taxed security experts. In the past, the best password practice was to pick a difficult-to-guess password, memorize it and never write it down. However, this is no longer practical as users have so many passwords to try to remember. Many users are now choosing easy-to-remember passwords that are more than likely weak and insecure. This represents a far more serious problem than a complex password that is written down and kept in a safe place. Recently, both Microsoft and security expert Bruce Schneier decided that it is better for users to choose a password too complicated to remember and write it down. Unfortunately, there is no perfect solution to this problem, but if you are not happy with this one, consider using a password database. You could use Schneier's free Password Safe utility, a smart card or token, which would give you a two-factor authentication solution when combined with a PIN -- another password to remember!
More Information
Do you have a password question of your own? If so, submit your questions here.
Learn how to create a secure password system.
|
|
|
|
|
|
|
|
Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and
answer pairs from more than 250 TechTarget industry experts.
|
|
|
|
|
|
|
|
|
|
|
|
