# private key A private key is the secret part of an asymmetric key pair, typically used to digitally sign or decrypt data. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Official Support for DPoP in Keycloak 26.4 DevFeed: [Official Support for DPoP in Keycloak 26.4]() Original publisher: [Read original article]() Author: Giuseppe Graziano Published: 2025-10-09T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [OAuth 2.0](), [Security](), [private key](), [OpenID connect (OIDC)](), [Authorization](), [REST API]() Tags: [documentation](), [idm](), [kerberos](), [keycloak](), [ldap](), [oauth-2-0](), [oidc](), [openid-connect](), [private-key](), [release](), [rest-api](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.4 officially supports OAuth 2.0 Demonstrating Proof-of-Possession (DPoP), which binds access or refresh tokens to a client-controlled public/private key pair. The release adds support across bearer-token endpoints, optional refresh-token-only binding for public clients, and the dpop_jkt parameter in OIDC authorization requests. ### Source excerpt DPoP has been available in Keycloak since version 23.0.0, but only as a preview feature. With the release of Keycloak 26.4, we're happy to share that OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) is now officially supported. What is DPoP? πŸ”‘ DPoP is a Proof-of-Possession mechanism that improves OAuth token security by binding a token (access or refresh) to a public/private key pair controlled by the client. By requiring a signed DPoP proof with each request, DPoP ensures that a stolen bearer token cannot be used without possession of the associated private key. This significantly improves token security in distributed systems. What's New for DPoP in 26.4 πŸ†• DPoP is now a supported feature and includes some improvements and minor capabilities: Support for all Keycloak endpoints that accept bearer tokens, including the Admin REST API and the Account API. Option to bind only refresh tokens for public clients, while leaving access tokens as bearer if required. Ability to request the dpop_jkt parameter in OIDC authorization requests. For full details, see the official documentation. How to enable and use DPoP in Keycloak πŸš€ If you want to force a client to use DPoP, you need to enable the Require DPoP bound tokens switch in the Admin Console Settings tab under Capability config. If Require DPoP bound tokens is off, the client can still send a DPoP proof in the token request. In that case, Keycloak verifies it and adds the thumbprint to the token, but DPoP binding is not enforced. Try It Out πŸ” If you want to experiment with DPoP in practice, you can try it out using the Keycloak FAPI Playground, which includes example client configurations and test flows that demonstrate how DPoP works end-to-end. We'd love to hear what you think about this feature and how we can improve it. Feedback and contributions from the community are always welcome. ## Signature counters DevFeed: [Signature counters]() Original publisher: [Read original article]() Author: Adam Langley Published: 2023-08-05T00:00:00Z Content type: article Language: en Sources: [ImperialViolet]() Topics: [WebAuthn](), [Security](), [private key]() Tags: [account](), [private-key](), [security](), [signal]() ### AI overview The article explains WebAuthn signature counters, including their optional nature, how non-zero counters should increase for future assertions from a credential, and how counter inconsistencies might indicate a cloned security key. It argues that sites using counters should lock the account, investigate, and replace the key rather than merely reject the assertion. ### Source excerpt If you look at the structure of the signed messages in WebAuthn you'll notice that one of the fields is called the "signature counter". In the previous long post I said to ignore it, which is still correct, but here's why. Signature counters are optional for the authenticator to implement: it's valid for a security key not to have a signature counter, although the vast majority of them do. In that case, the counter value is always zero. But once a website has seen a non-zero value, then the security key has to ensure that the counter, for all future assertions from a given credential, is strictly increasing. The motivation of the signature counter is that it might allow websites to detect when a security key has been cloned. Cloning a security key is supposed to be very difficult. At the very least, you should need physical access to it, and hopefully you need to spend a substantial amount of time invasively interrogating it. But, if you assume all that happened, then one could clone a security key (probably destroying it in the process), get the private key of a credential out of it, and create a working replica which could be slipped back into the possession of the legitimate user, leaving them unaware that anything has happened. At this point, the attacker can create assertions at will because they know the credential's private key. If all that has happened, then the signature counter might uncover it. Unless the attacker can know exactly when the legitimate user has created an assertion, and thus incremented the counter, then eventually either they or the real user will create an assertion where the counter didn't increase. You might be able to tell, but I consider this a rather far-fetched scenario. Nevertheless, if a website wants to use the signature counters, then it must treat any non-incrementing counter as a signal to lock the account and trigger an investigation. At a minimum, the security key in question should be replaced. Simply rejecting the assertio ## Encrypting Arbitrary Data with Elliptic Curve ElGamal DevFeed: [Encrypting Arbitrary Data with Elliptic Curve ElGamal]() Original publisher: [Read original article]() Author: andreacorbellini Published: 2023-01-02T06:30:00Z Content type: tutorial Language: en Sources: [Andrea Corbellini]() Topics: [Cryptography](), [Encryption](), [private key](), [public key](), [Provable security]() Tags: [cryptography](), [ecc](), [elgamal](), [encryption]() ### AI overview This tutorial explains that elliptic curve keys can encrypt arbitrary data directly and introduces elliptic curve ElGamal as an example. It also notes that pure elliptic curve encryption is not widely used or standardized because key agreement is more convenient for most applications. ### Source excerpt From time to time, I hear people saying that Elliptic Curve Cryptography (ECC) cannot be used to directly encrypt data, and you can only do key agreement and digital signatures with it. This is a common misconception, but it's not actually true: you can indeed use elliptic curve keys to encrypt arbitrary data. And I'm not talking about hybrid-encryption schemes (like ECIES ... ## Why OpenSSH private key files differ after restoration DevFeed: [Why OpenSSH private key files differ after restoration]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2022-12-20T00:00:00Z Content type: tutorial Language: en Sources: [Carlos Becker]() Topics: [OpenSSH](), [private key](), [Go](), [Code](), [C]() Tags: [code](), [go](), [openssh](), [private-key](), [ssh]() ### AI overview This article investigates why restoring an SSH private key and marshaling it back to OpenSSH private-key format produces a different block. It explains that duplicated random values in the encrypted format allow successful decryption to be checked, while the restored keys can still represent the same key. ### Source excerpt Not long ago, when I was building melt, I learned something interesting. ## How to Access Infrastructure Without Usernames and Passwords DevFeed: [How to Access Infrastructure Without Usernames and Passwords]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2022-07-27T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [passwords](), [Authentication](), [Security](), [private key](), [ssh](), [public key](), [Vulnerabilities]() Tags: [authentication](), [infrastructure](), [passwords](), [private-key](), [public-key](), [security](), [ssh](), [vulnerabilities]() ### AI overview The article argues that passwords, private keys, API keys, and other secrets create risks through sharing, loss, theft, leakage, and human error. It presents identity-based access as a way to consolidate authentication for growing teams and infrastructure. ### Source excerpt Announcing the release of Teleport 10.0 which adds support for passwordless logins to infrastructure. ## How to Configure SSH Certificate-Based Authentication DevFeed: [How to Configure SSH Certificate-Based Authentication]() Original publisher: [Read original article]() Author: info@goteleport.com (Honda McLaren) Published: 2022-04-26T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Authentication](), [certificates](), [OpenSSH](), [Tutorial](), [Security](), [public key](), [private key]() Tags: [authentication](), [certificates](), [openssh](), [private-key](), [protocol](), [public-key](), [security](), [ssh](), [tutorial]() ### AI overview This tutorial explains how to configure SSH certificate-based authentication for an OpenSSH server. It contrasts static SSH keys with short-lived, CA-signed certificates that include identity, expiration, and policy controls, and outlines how servers validate certificates. ### Source excerpt Learn how to configure SSH certificate-based authentication in OpenSSH using short-lived, CA-signed certificates to replace static SSH keys and improve security. ## SSH Keys Compared: RSA, ECDSA, Ed25519 DevFeed: [SSH Keys Compared: RSA, ECDSA, Ed25519]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2022-04-07T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [OpenSSH](), [Cryptography](), [Authentication](), [public key](), [private key](), [certificates](), [Post-Quantum]() Tags: [authentication](), [certificates](), [cryptography](), [ecdsa](), [ed25519](), [openssh](), [post-quantum](), [private-key](), [public-key](), [rsa](), [ssh]() ### AI overview A guide to SSH public-key authentication that compares RSA, ECDSA, and EdDSA (Ed25519), recommends Ed25519 for most uses, and discusses older-system compatibility, key generation, fingerprints, rotation, and certificates. ### Source excerpt Comparing SSH keys: RSA, DSA, ECDSA, and Ed25519 explained, with a straight algorithm recommendation and the move from keys to certificates. Read on. ## How to Set Up SSH Keys: A Step-by-Step Guide (2026) | Teleport DevFeed: [How to Set Up SSH Keys: A Step-by-Step Guide (2026) | Teleport]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-02-03T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [ssh](), [ed25519](), [OpenSSH](), [private key](), [public key](), [GitHub](), [Server]() Tags: [ed25519](), [github](), [guide](), [how-to](), [openssh](), [private-key](), [public-key](), [ssh]() ### AI overview A step-by-step guide to setting up SSH keys with ssh-keygen and Ed25519, adding public keys to servers or GitHub, and protecting private keys with passphrases. It also explains when short-lived SSH certificates may be preferable to long-lived keys. ### Source excerpt Learn how to set up SSH keys with ssh-keygen and Ed25519, add your key to a server or GitHub, and when short-lived SSH certificates beat long-lived keys. ## 5 SSH Agent Best Practices DevFeed: [5 SSH Agent Best Practices]() Original publisher: [Read original article]() Author: info@goteleport.com (Nicole Chelly) Published: 2022-01-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [ssh](), [Security](), [private key](), [Linux](), [Server]() Tags: [article](), [best-practices](), [how-to](), [linux](), [pitfalls](), [private-key](), [security](), [server](), [ssh](), [terminal]() ### AI overview This article explains security risks associated with SSH agents, especially unattended terminals and SSH agent forwarding through bastion or jump servers. It recommends hardening practices such as setting timeouts and removing unused keys. ### Source excerpt In this article, you'll learn how to avoid potential SSH agent pitfalls and recommend best practices to keep your SSH agent secure. ## An Introduction to Hardware Security Modules (HSMs) DevFeed: [An Introduction to Hardware Security Modules (HSMs)]() Original publisher: [Read original article]() Author: info@goteleport.com (Russell Jones) Published: 2021-08-31T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Security](), [private key](), [sensitive data](), [remote access](), [certificates]() Tags: [certificates](), [private-key](), [remote-access](), [security](), [sensitive-data]() ### AI overview This article explains how hardware security modules protect sensitive data such as private keys by exposing cryptographic operations instead of allowing the data to be read. It describes Teleport 7.2 support for HSMs and how they can reduce the risk of private-key theft in remote-access clusters, while noting that HSMs do not mitigate every attack vector. ### Source excerpt In this blog post we explain how hardware security modules (HSM) help protect sensitive data and how Teleport 7.2 uses HSM to make remote access more secure. ## How to Deploy SSH Certificates Securely in Production DevFeed: [How to Deploy SSH Certificates Securely in Production]() Original publisher: [Read original article]() Author: sasha@goteleport.com (Alexander Klizhentas) Published: 2021-02-18T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [certificates](), [Security](), [ssh](), [Authentication](), [public key](), [private key](), [trust](), [Cryptography]() Tags: [authentication](), [certificates](), [hardening](), [how-to](), [private-key](), [public-key](), [security](), [ssh](), [trust]() ### AI overview This tutorial explains SSH public-key authentication, SSH certificates, and the key-management challenges involved in securely deploying certificate-based authentication in production. It emphasizes that poorly implemented certificate systems can be less secure than public-key authentication. ### Source excerpt How to deploy SSH certificates in production to make security better, not worse. ## Attacking Smart Card Based Active Directory Networks DevFeed: [Attacking Smart Card Based Active Directory Networks]() Original publisher: [Read original article]() Author: CCob Published: 2020-10-04T19:31:42Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [active directory](), [Authentication](), [certificates](), [private key](), [Cryptography](), [kerberos](), [public key]() Tags: [active-directory](), [attacks](), [authentication](), [certificates](), [cobalt-strike](), [hooking](), [kerberos](), [pin](), [pinswipe](), [pki](), [private-key](), [public-key](), [rubeus](), [smart-card](), [swipe](), [weaponize]() ### AI overview This article examines attacks against smart-card-enforced Active Directory networks. It explains that a physical smart card is not necessarily required for smart-card logon when the corresponding private key is available, describes certificate requirements and policy-related certificate abuse, and introduces PKINIT as public-key support for Kerberos pre-authentication. ### Source excerpt Introduction Recently I was involved in an engagement where I was attacking smart card based Active Directory networks. The fact is though, you don't need a physical smart card at all to authenticate to Active Directory that enforces smart card logon. The attributes of the certificate determine if it can be used for smart card [...] The post Attacking Smart Card Based Active Directory Networks appeared first on Ethical Chaos. ## How to Avoid Managing SSH Keys with Short-Lived SSH Certificates DevFeed: [How to Avoid Managing SSH Keys with Short-Lived SSH Certificates]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2018-02-02T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [OpenSSH](), [certificates](), [remote access](), [Authentication](), [private key](), [public key]() Tags: [authentication](), [certificates](), [private-key](), [public-key](), [remote-access](), [ssh]() ### AI overview This article explains why managing long-lived SSH keys can become complex and difficult to scale, and presents short-lived SSH certificates as an alternative for remote access. ### Source excerpt How to avoid managing SSH keys and switch to short-lived SSH certificates. ## JWT Authentication DevFeed: [JWT Authentication]() Original publisher: [Read original article]() Author: Zoli Kahan Published: 2016-09-26T05:00:00Z Content type: tutorial Language: en Sources: [Zolmeister]() Topics: [JSON Web Tokens](), [Authentication](), [API](), [middleware](), [private key](), [public key](), [Security](), [Express]() Tags: [api](), [authentication](), [hosting](), [jwt](), [middleware](), [oauth](), [private-key](), [public-key](), [security]() ### AI overview The article explains an authentication approach for hosting platforms that need to support third-party application access and verify local native API calls. It uses JSON Web Tokens with ES256 and a public/private key pair, followed by a sample authentication strategy and Express middleware implementation. ### Source excerpt JWT Authentication Authentication models for hosting platforms require more considerations due to 3rd party api access. We wanted to be able to issue user auth tokens for 3rd party apps (think OAuth), as well as be able to verify authentication of local native api calls (through our iframe native app hooks). ## Signing git commits using Keybase DevFeed: [Signing git commits using Keybase]() Original publisher: [Read original article]() Author: hi@meedamian.com (Damian Mee) Published: 2016-04-14T00:00:00Z Content type: tutorial Language: en Sources: [Damian Mee | Blog | Portfolio | About]() Topics: [Git](), [GitHub](), [account](), [private key](), [Command-line interface](), [public key]() Tags: [command-line](), [git](), [github](), [private-key](), [public-key](), [signing]() ### AI overview A historical guide explains how to use Keybase keys to sign Git commits and have GitHub display a Verified badge. The post warns that some of its advice is terrible and is preserved for historical reasons. ### Source excerpt ⚠ WARNING: This post contains some terrible advice, and is preserved here only for historical reasons. Signing git commits has been a great idea since forever. A great unpopular idea. Luckily, that changes with the recent Github announcement. This is a quick guide on how to set it up with your keybase.io account. Keybase Jump to the git stuff, I already have Keybase. Create keybase.io account Keybase is still not publicly available, but you can ask me or anyone on Keybase for an invite. ## Generate ECDSA key with OpenSSL DevFeed: [Generate ECDSA key with OpenSSL]() Original publisher: [Read original article]() Author: Tom Published: 2013-12-17T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz GΔ…gor]() Topics: [ECDSA](), [openssl](), [private key]() Tags: [ecdsa](), [generate](), [linux](), [openssl](), [private-key](), [security]() ### AI overview This tutorial explains how to generate an ECDSA private key with OpenSSL, including selecting a curve and using a 256-bit key, followed by creating a self-signed certificate. ### Source excerpt After the last NSA scandal I've found some time to read some texts about PFS and ECDSA keys lately. I always used RSA keys but wanted to give a try to ECDSA so I wanted to give it a try (test performance, etc). Here is how I've done it. Firstly find your favorite curve. A short tip about bit length and complexity could be found here. From it you will now that using 256 bit ECDSA key should be enough for next 10-20 years. ## How GPG works: Encrypt DevFeed: [How GPG works: Encrypt]() Original publisher: [Read original article]() Author: Graham King Published: 2013-07-30T21:02:43Z Content type: tutorial Language: en Sources: [Graham King]() Topics: [Encryption](), [Cryptography](), [public key](), [private key](), [Command-line interface]() Tags: [command-line](), [cryptography](), [decrypt](), [encryption](), [file](), [guide](), [private-key](), [public-key](), [rsa](), [signing](), [software]() ### AI overview A straightforward guide to how GPG encrypts messages: it generates a random session key, encrypts the file with a symmetric cipher, and encrypts the session key with each recipient's public key. It also explains that the passphrase protects the private key rather than encrypting the message itself. ### Source excerpt Demystifying GPG encryption: A straightforward guide to the process. ## Advice for Android Developers: Prepare for App Acquisition DevFeed: [Advice for Android Developers: Prepare for App Acquisition]() Original publisher: [Read original article]() Author: Chris Hager Published: 2010-12-20T00:00:00Z Content type: tutorial Language: en Sources: [Chris Hager]() Topics: [Android](), [android-apps](), [certificates](), [private key](), [App]() Tags: [advice](), [android](), [app](), [applications](), [certificates](), [developers](), [private-key](), [signing]() ### AI overview The article advises Android app developers to use a unique signing key for each application so that a future acquisition does not require canceling the deal or sharing a key used for other apps. It explains that Android apps must be digitally signed with certificates and that developers hold the certificates' private keys. ### Source excerpt Here's a brief but important advice for Android app developers: starting with your first app, prepare for the situation where a company wants to acquire one of your applications. Use a unique signing key (alias) for each app! Else you'll be forced to either cancel the acquisition or hand out the key you use for other apps as well. http://developer.android.com/guide/publishing/app-signing.html: Android requires that all apps be digitally signed with a certificate before they can be installed.