How Are Strong Keys Generated
Feb 04, 2006 We provide formal definitions and efficient secure techniques for - turning noisy information into keys usable for any cryptographic application, and, in particular, - reliably and securely authenticating biometric data. Our techniques apply not just to biometric information, but to any keying material that, unlike traditional cryptographic keys, is (1) not reproducible precisely and (2) not. To create a new key pair, select the type of key to generate from the bottom of the screen (using SSH-2 RSA with 2048 bit key size is good for most people; another good well-known alternative is ECDSA). Then click Generate, and start moving the mouse within the Window. Putty uses mouse movements to collect randomness. Random String Generator. This form allows you to generate random text strings. The randomness comes from atmospheric noise, which for many purposes is better than the pseudo-random number algorithms typically used in computer programs. Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data Yevgeniy Dodis1, Leonid Reyzin2, and Adam Smith3 1 New York University, dodis@cs.nyu.edu 2 Boston University, reyzin@cs.bu.edu. Jul 09, 2004 (updated 12/03/04 to point to refactored code) Generating Keys It’s been just under a month since I’ve updated the Managed StrongName API, so here’s the next set of APIs. This time, I’ve setup the APIs needed to create a new key suitable for signing. Namely, these are the StrongNameKeyGen and (for Whidbey) StrongNameKeyGenEx APIs. Or if every human on Earth generated 600,000,000 GUIDs there would only be a 50% probability of a duplicate. How are GUIDs used? GUIDs are used in enterprise software development in C#, Java, and C as database keys, component identifiers, or just about anywhere else a truly unique identifier is required. Powertech Encryption for IBM i allows the creation of strong symmetric keys using the AES and TDES encryption standards. For AES, the key length can be specified up to 256 bits to offer the highest protection. By default, keys are randomly generated by Powertech Encryption for IBM i to offer the best security.
- Strongkey
- How Are Strong Keys Generated Located
- Generate Shared Key
- How Are Strong Keys Generated Water
An SSH key is a form of authentication in the SSH protocol. It is similar to a password, but allows for authentication without entering in a password or any manual input. SSH keys generally speaking are more secure, and convenient than password authentication.
Command Line
If you currently have access to SSH on your server, you can generate SSH keys on the command line using the ssh-keygen utility which is installed by default on our servers. Run it on your server with no options, or arguments to generate a 2048-bit RSA key pair (which is plenty secure).
Strongkey
You will be prompted to select a file for the key pair. The default directory for SSH keys is ~/.ssh with the private key named id_rsa and the public key named id_rsa.pub. By using the default file names, the SSH client will be able to automatically locate the keys during authentication so it is strongly recommended to not change them. You can use the default by pressing the Enter key.
If /home/USER/.ssh/id_rsa or a key of the name you chose already exists, you will be prompted to overwrite the keys. If you do overwrite the existing keys, you will not be able to use them to authenticate anymore.
After you have selected the file for the key pair, you be will be prompted to enter a passphrase to encrypt private key file. Encrypting the private key with a passphrase is optional, but it will improve security the keys. If you enter a passphrase you will have to provide each it time you use the key. You can press the Enter key to not use a passphrase; we strongly recommend the use of a passphrase with SSH keys.
A public and private key will now be generated.
WHM
You can generate SSH key pairs for root in WHM >> Home Security Center >> Manage root's SSH Keys.
Click Generate a New Key to get started.
There are several fields on this page: Key Name, Key Password, Key Type, and Key Size.
The default Key Name is id_rsa. Keys are generated in /root/.ssh/ so the default key name would create a private key in /root/.ssh/id_rsa, and a public key in /root/.ssh/id_rsa.pub. Using the default name will allow SSH clients to automatically locate the keys so it is strongly recommend you use the default name (simply leave the field blank or fill it with id_rsa).
The Key Password encrypts the private key file using a password to add an extra layer of security. The password must be provided each time the key is used for authentication to decrypt the private key. The Password Strength field indicates how strong your password is. 0 indicates a very weak password, and 100 indicates a very strong password. Click Password Generator to have a strong password generated for you.
Key Type and Key Size are RSA and 2048 by default, and are secure enough for most purposes so these can be left alone.
Click Generate Key to generate the SSH key pair. WHM will then display the location of the key.
PuTTY
PuTTY is an open Windows SSH client. You will need to have the PuTTYgen utility installed to generate an SSH key pair. PuTTYgen is included in Windows installer on the Download PuTTY site, but you can download it separately if you installed PuTTY without its extra utilities. See Connect using Putty to a Linux Server to learn more about PuTTY.
Open PuTTYgen.
The Parameters at the bottom can be adjusted to affect how secure the key is, but the default options are plenty secure for most purposes.
If you're satisfied with the parameters, click Generate in Actions to generate the key pair.
You may be asked to 'generate some randomness by moving the mouse over the blank area' to generate the key. The randomness is used to generate your keys securely, and make it difficult to reproduce them.
Once the key is generated, you will see the public key in PuTTYgen.
The Key passphrase field sets a password used to decrypt the private the key. This field is optional, and the private key will not be encrypted if it is omitted.Using a passphrase increases the security of your SSH keys, and we strongly recommend setting one.
Be sure to save both the public and private keys on your local machine so they can be used by PuTTY for authentication in the future by clicking the Save public key and Save private key buttons.
If you don't use a passphrase, it will prompt you to confirm before allowing you to save the private key. The private key will be saved as a .ppk file. The public key isn't given an extension by default, but .pub is a common extension for public key files. It can be saved as a .txt file as well as the public key file only stores the public key in plain text.
Command Line
If you currently have access to SSH on your server, you can upload the key over the command line.
Retrieve the contents of the public key. If the key was created in the default location, this can be done by outputting the contents of ~/.ssh/id_rsa.pub.
The output will look similar to the following:
Open the (and create if it doesn't exist) ~/.ssh/authorized_keys file using a text editor such as nano, pico, or vim.
If you had to create the ~/.ssh/ directory, or the authorized_keys file, you need to verify the permissions are correct, or you won't be able to login.
Paste the public key at the bottom of the file, and then save and close the file.
How Are Strong Keys Generated Located
Alternatively, you can append the public key to ~/.ssh/authorized_keys with a single command.
You can use the cat command if the public key is stored in a file.
If the public key is not stored as a file on the server, you can use the echo command.
Be sure to include the entire public key in quotes after echo.
Once the public key is added to the authorized_keys file, you should be able to login using your SSH keys.
WHM
You can import an existing SSH key for root in WHM >> Home Security Center >> Manage root's SSH Keys.
Click Import Key.
The next page has a few fields to fill in.
You need to name the SSH key in the Choose a name for this key field. The default key name is id_rsa. Using the default name will allow SSH clients to automatically locate the keys so it is strongly recommend you use the default name (simply leave the field blank or fill it with id_rsa).
If you are importing a PPK (PuTTYgen key) file, enter its password (if applicable) in the Private key passphrase text box.
Paste the public key into the appropriate box, but do not paste the private key into the box; private keys should always remain on the servers that generated them.
Click Import.
WHM will display the name of the keys imported, and you should now be able to authenticate over SSH using the key.
The default name for SSH key pairs is id_rsa, and that name will allow an SSH client to locate the key automatically. When an SSH key pair doesn't use the default name, you will need to specify the name of key used.
| Perfect Passwords GRC's Ultra High Security Password Generator | |
| 2,618 sets of passwords generated per day 33,542,935 sets of passwords generated for our visitors | |
not simple. So here is some totally random raw material, generated just for YOU, to start with. Every time this page is displayed, our server generates a unique set of custom, high quality, cryptographic-strength password strings which are safe for you to use: |
64 random hexadecimal characters (0-9 and A-F):
|
63 random printable ASCII characters:
|
63 random alpha-numeric characters (a-z, A-Z, 0-9):
|
| Click your web browser's 'refresh' button a few times and watch the password strings change each time. What makes these perfect and safe? Also, because this page will only allow itself to be displayed over a snoop-proof and proxy-proof high-security SSL connection, and it is marked as having expired back in 1999, this page which was custom generated just now for you will not be cached or visible to anyone else. Therefore, these password strings are just for you. No one else can ever see them or get them. You may safely take these strings as they are, or use chunks from several to build your own if you prefer, or do whatever you want with them. Each set displayed are totally, uniquely yours — forever. The 'Application Notes' section below discusses various aspects of using these random passwords for locking down wireless WEP and WPA networks, for use as VPN shared secrets, as well as for other purposes. The 'Techie Details' section at the end describes exactly how these super-strong maximum-entropy passwords are generated (to satisfy the uber-geek inside you). |
Application Notes: A note about 'random' and 'pseudo-random' terminology: There are ways to generate absolutely random numbers, but computer algorithms cannot be used for that, since, by definition, no deterministic mathematical algorithm can generate a random result. Electrical and mechanical noise found in chaotic physical systems can be tapped and used as a source of true randomness, but this is much more than is needed for our purposes here. High quality algorithms are sufficient. The deterministic binary noise generated by my server, which is then converted into various displayable formats, is derived from the highest quality mathematical pseudo-random algorithms known. In other words, these password strings are as random as anything non-random can be. This page's password 'raw material': 64 hex characters = 256 binary bits: |
|
Generate Shared Key
| Each of the 64 hexadecimal characters encodes 4 bits of binary data, so the entire 64 characters is equivalent to 256 binary bits — which is the actual binary key length used by the WiFi WPA pre-shared key (PSK). Some WPA-PSK user interfaces (such as the one in Windows XP) allows the 256-bit WPA pre-shared key to be directly provided as 64 hexadecimal characters. This is a precise means for supplying the WPA keying material, but it is ONLY useful if ALL of the devices in a WPA-protected WiFi network allow the 256-bit keying material to be specified as raw hex. If any device did not support this mode of specification (and most do not) it would not be able to join the network. Using fewer hex characters for WEP encryption: WEP key strength (key length) is sometimes confusing because, although there are only two widely accepted standard lengths, 40-bit and 104-bit, those lengths are sometimes confused by adding the 24-bit IV (initialization vector) counter to the length, resulting in 64-bit and 128-bit total key lengths. However, the user only ever specifies a key of either 40 or 104 binary bits. Since WEP keys should always be specified in their hexadecimal form to guarantee device interaction, and since each hex digit represents 4 binary bits of the key, 40 and 104 bit keys are represented by 10 and 26 hex digits respectively. So you may simply snip off whatever length of random hex characters you require for your system's WEP key. Note that if all of your equipment supports the use of the new longer 256/232 bit WEP keys, you would use 232/4 or 58 hexadecimal characters for your pre-shared key.
|
|
| The more 'standard' means for specifying the 256-bits of WPA keying material is for the user to specify a string of up to 63 printable ASCII characters. This string is then 'hashed' along with the network's SSID designation to form a cryptographically strong 256-bit result which is then used by all devices within the WPA-secured WiFi network. (The ASCII character set was updated to remove SPACE characters since a number of WPA devices were not handling spaces as they should.)
|
|
How Are Strong Keys Generated Water
| If some device was not following the WiFi Alliance WPA specification by not hashing the entire printable ASCII character set correctly, it would end up with a different 256-bit hash result than devices that correctly obeyed the specification. It would then be unable to connect to any network that uses the full range of printable ASCII characters. Since we have heard unconfirmed anecdotal reports of such non-compliant WPA devices (and since you might have one), this page also offers 'junior' WPA password strings using only the 'easy' ASCII characters which even any non-fully-specification-compliant device would have to be able to properly handle. If you find that using the full random ASCII character set within your WPA-PSK protected WiFi network causes one of your devices to be unable to connect to your WPA protected access point, you can downgrade your WPA network to 'easy ASCII' by using one of these easy keys. And don't worry for a moment about using an easy ASCII key. If you still use a full-length 63 character key, your entire network will still be EXTREMELY secure. And PLEASE drop us a line to let us know that you have such a device and what it is!
When these passwords are used to generate pre-shared keys for protecting WPA WiFi and VPN networks, the only known attack is the use of 'brute force' — trying every possible password combination. Brute force attackers hope that the network's designer (you) were lazy and used a shorter password for 'convenience'. So they start by trying all one-character passwords, then two-character, then three and so on, working their way up toward longer random passwords.
Note that while this 'the longer the better' rule of thumb is always true, long passwords won't protect legacy WEP-protected networks due to well known and readily exploited weaknesses in the WEP keying system and its misuse of WEP's RC4 encryption. With WEP protection, even a highly random maximum-entropy key can be cracked in a few hours. (Listen to Security Now! episode #11 for the full story on cracking WEP security.)
|
While the diagram above might at first seem a bit confusing, it is a common and well understood configuration of standard cryptographic elements. A succinct written description of the algorithm would read: 'Rijndael (AES) block encryption of never-repeating counter values in CBC mode.' CBC stands for 'Cipher Block Chaining' and, as I describe in detail in the second half of Security Now! Episode #107, CBC provides necessary security in situations where some repetition or predictability of the 'plaintext' message is present. Since the 'plaintext' in this instance is a large 128-bit steadily-increasing (monotonic) counter value (which gives us our guaranteed never-to-repeat property, but is also extremely predictable) we need to scramble it so that the value being encrypted cannot be predicted. This is what 'CBC' does: As the diagram above shows, the output from the previous encryption operation is 'fed back' and XOR-mixed with the incrementing counter value. This prevents the possibility of determining the secret key by analysing successive counter encryption results. One last detail: Since there is no 'output from the previous encryption' to be used during the encryption of the first block, the switch shown in the diagram above is used to supply a 128-bit 'Initialization Vector' (which is just 128-bits of secret random data) for the XOR-mixing of the first counter value. Thus, the first encryption is performed on a mixture of the 128-bit counter and the 'Initialization Vector' value, and subsequent encryptions are performed on the mixture of the incrementing counter and the previous encrypted result. The result of the combination of the 256-bit Rijndael/AES secret key, the unknowable (therefore secret) present value of the 128-bit monotonically incrementing counter, and the 128-bit secret Initialization Vector (IV) is 512-bits of secret data providing extremely high security for the generation of this page's 'perfect passwords'. No one is going to figure out what passwords you have just received. How much security do 512 binary bits provide? Well, 2^512 (2 raised to the power of 512) is the total number of possible combinations of those 512 binary bits — every single bit of which actively participates in determining this page's successive password sequence. 2^512 is approximately equal to: 1.34078079 x 10^154, which is this rather amazing number:
|
Gibson Research Corporation is owned and operated by Steve Gibson. The contents of this page are Copyright (c) 2016 Gibson Research Corporation. SpinRite, ShieldsUP, NanoProbe, and any other indicated trademarks are registered trademarks of Gibson Research Corporation, Laguna Hills, CA, USA. GRC's web and customer privacy policy. |