Abstract: Technologies described herein provide enhanced security for storing and updating secret data, such as a password. Based on one or more conditions, an existing encryption key or a new encryption key may be used to generate encrypted data at a client computing device. The encrypted data may be communicated from the client computing device to a secret store managed by a first entity for storage of the encrypted data in the secret store. Based on one or more conditions, the new encryption key may be communicated from the client computing device to a key store managed by a second entity for storage of the new encryption key in the key store.

Abstract: Technologies described herein provide enhanced security for storing and updating secret data, such as a password. Based on one or more conditions, an existing encryption key or a new encryption key may be used to generate encrypted data at a client computing device. The encrypted data may be communicated from the client computing device to a secret store managed by a first entity for storage of the encrypted data in the secret store. Based on one or more conditions, the new encryption key may be communicated from the client computing device to a key store managed by a second entity for storage of the new encryption key in the key store.

Abstract: Technologies described herein provide enhanced security for encrypted data. In some configurations, encrypted data may be generated at a client computing device by encrypting data with an encryption key. The encrypted data may be communicated from the client computing device to a secret store managed by a first entity for storage of the encrypted data in the secret store. The encryption key may be communicated from the client computing device to a key store managed by a second entity for storage of the encryption key in the key store. The secret store may be managed by a first set of administrative access control rights that are exclusive to the secret store. The key store may be managed by a second set of administrative access control rights that are exclusive to the key store.

Abstract: Technologies are described herein for generating uniformly random passwords by the use of regular expressions. One or more regular expressions are used to define a constraint on a string or password. The regular expressions are processed into one or more symbolic finite automata (SFA). The one or more SFAs are exposed to a combination of operations to produce a determinized, minimized SFA. Provided techniques generate probability data associated with individual state transitions of the SFA, and optionally, probability data is generated for one or more binary decision diagrams (BDD). Passwords or strings can be generated by traversing the SFA using the probability data. In some embodiments, the process for selecting characters at each state transition of the determinized, minimized SFA may utilize a binary decision diagram (BDD). Techniques disclosed herein also minimize SFAs by use of an over-approximation method.