Tagged Questions
1
vote
1answer
65 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
0
votes
1answer
64 views
Determine the Identity of Caller
Let me explain my situation.
I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
2
votes
1answer
40 views
Sending Digital Certificates
I used the makecert tool in order to create:
a self-signed certificate
a server certificate using the self-signed certificate
a client certificate using the self-signed certificate
I then ...
2
votes
1answer
61 views
Security Certificates - Tools to Generate Security Certificates
I want to create a self-signed certificate that will be installed as a trusted certificate authority.
I then want to create another two certificates which are signed using the private key of the ...
1
vote
1answer
83 views
The request was aborted: Could not create SSL/TLS secure channel Exception
Let me explain my situation.
I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC.
I then created two certificates using the self-signed ...
8
votes
2answers
593 views
Are there really functioning quantum computers?
I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
2
votes
2answers
254 views
Revoked certificate validation using past times
I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past.
Unfortunately I have problems verifying revoked ...
4
votes
1answer
56 views
Standards for CA cert revocation and time-constrained cryptographic algorithm parameters
I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
3
votes
1answer
60 views
CMC (RFC 5272) compatible CA server
I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
4
votes
2answers
185 views
Is it possible to modify a CA without having to reissue all of the derived certificates?
Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I ...
-1
votes
2answers
224 views
Request/Creating a Code Signing Certificate
I have need for a code signing certificate which is trusted by a CA in the windows domain. How do I request/create this certificate?
Do I have to request a code signing certificate on the ...
1
vote
2answers
158 views
Using digital signatures to identify users
Consider the following requirement:
Bob should be able to verify that a payment request came from Alice.
The above is in simple terms the basic idea, however, in reality Alice would be user A of ...
1
vote
1answer
317 views
Best Practices for Storing Digital Certificate
I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
6
votes
1answer
2k views
What is the actual value of a certificate fingerprint?
In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
4
votes
4answers
318 views
Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was:
CA with RSA keys capable of signing RSA and EC CSRs
CA with ...
1
vote
3answers
3k views
What does these warnings mean on an SSL connection by firefox (only)
I am connecting to a secure site and firefox mentions about identity:
Owner: This website does not supply ownership information
Verified by: Not specified
Technical Details:
Connection ...
4
votes
1answer
427 views
How secure is TOTP key on phones?
Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
1
vote
1answer
84 views
valid intermediate certs not in browser
Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
2
votes
1answer
85 views
self-signed certs that aren't the final certificates in the path
The X.509 spec makes frequent statements like this:
(b) If certificate i is self-issued and it is not the final
certificate in the path, skip this step for certificate i.
How can you have ...
7
votes
2answers
281 views
X.509 certificate policies question
I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies.
To quote from the X.509 RFC:
In an end entity certificate, these ...
1
vote
1answer
205 views
X.509 certificate policy mapping question
So I'm a little confused how X.509 certificate policy mappings work. So let's say the following depicts my cert chain:
root CA ---> intermediary CA ---> client cert
Would the root CA have a ...
2
votes
1answer
215 views
How long shall a certificate be valid?
See title. Are there any sources where there are recommended validity times of certificates (based on length, algo, etc)?
I'm particularly interested in validity of RSA certificates...
0
votes
1answer
202 views
id-ce-cRLDistributionPoints ASN.1 / DER encoding question
I have a file - test.pem - with the following contents:
-----BEGIN CERTIFICATE-----
MBIwEKAOoAwwCqMIMAZhBEFCQ0Q=
-----END CERTIFICATE-----
openssl asn1parse -inform PEM -in test.pem -i returns the ...
0
votes
1answer
236 views
question about implicitly tags in ASN.1
From the X.509 RFC, in the "Implicitly Tagged Module" section:
CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
DistributionPoint ::= SEQUENCE {
distributionPoint [0] ...
4
votes
1answer
415 views
X.509 algorithm identifier parameters vs. extension values
From the X.509 specs:
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
...
2
votes
1answer
415 views
Why doesn't asn1parse parse all DER encoding strings?
I have a file - crl.txt - that contains the following:
MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw=
It's from one of the extensions in a particular X.509 cert. Why ...
3
votes
1answer
444 views
parsing the id-ce-keyUsage extension in X.509 certs
I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows:
...
8
votes
3answers
2k views
What are the risks of self signing a certificate for SSL
Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
2
votes
1answer
254 views
Inspecting a TLS Certificate to determine RSA Key Usage restrictions
With regard to this answer, I have a question about Key Usage in an SSL certificate.
Most SSL server certificates have a RSA key which is not restricted
through a Key Usage extension, so you can ...
11
votes
4answers
6k views
What ciphers should I use in my web server after I configure my SSL certificate?
There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list.
...
5
votes
4answers
4k views
Recommendations for a Certificate Management tool for Linux
A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients.
This creates a new challenge to manage all these certificates and ...
6
votes
3answers
314 views
Why are CA's signing keys available on the internet
I am not very knowledgeable about CA certificates, but I thought these things mainly said
"The public key for bank X is Y, and this is verified by CA Z".
Once you've bought this certificate, there is ...
9
votes
3answers
399 views
Multiple CAs signing a single Cert/CSR?
Just saw this suggested on Slashdot
So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
3
votes
1answer
338 views
What kind of certificate do I need to be able to make and sign my own digital signing certicates?
At build time for a program, I would like to generate a new key pair, and create a certificate that will be embedded (securely) into the program. The purpose of the key pair is to digitally sign an ...
12
votes
3answers
1k views
What happens when an Intermediate CA is revoked?
Currently I'm working on a certificate manager that allows our product to securely (over TLS/SSL) connect to remote webservices.
For security, we use CRL-checking to find out if a certain certificate ...
10
votes
4answers
648 views
Why isn't OCSP required by default in browsers?
According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers.
Can someone please explain why this isn't ...
8
votes
3answers
24k views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
6
votes
1answer
417 views
How do I learn Cryptographic/Mathematical notation
I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation.
How do I learn this notation and how to convey my approach?
How can I annotate this ...
6
votes
2answers
371 views
security of PKI, Certificates, certificate authorities, forward secrecy
I want to understand how certificates add to the security of information exchange.
Suppose i have a encrypted bidirectional connection between Alice and Bob, using a public key/private key pair. As ...
41
votes
5answers
10k views
Certificate based authentication vs Username and Password authentication
What are the advantages and drawbacks of the certificate based authentication over username and password authentication?
I know some, but I would appreciate a structured and detailed answer.
UPDATE
...
12
votes
2answers
357 views
Encryption and the “security time decay” of prior encrypted data
This question is on the assumption that any data once encrypted, may (eventually) be decrypted through
Brute force (compute power/time)
Exploits in the cryptography used
Theft of private keys
...
5
votes
6answers
704 views
Should the bit-strength selection of a child certificate be influenced by the CA or the chain?
All things being equal; suppose I have a CA chain that has 1024 bits of RSA encryption. Does this mean that my selection of a child CA or WebServer certificate gains no benefit from a higher level of ...
5
votes
3answers
3k views
What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?
I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider.
Question 1 Why ...
8
votes
3answers
340 views
Are there any smartcard/hardware-tokens for certificate-based authentication which are easily destroyed?
It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can ...
6
votes
3answers
188 views
Renew digital certificate
If I have deployed a digital certificate on a webserver and if it needs to be renewed then what steps do I need to follow? Will I need to generate a new longer public key private key pair? Why do ...
6
votes
3answers
423 views
Personal digital certificate how to verify
A server certificate would have its domain name at its subject field. A personal certificate would have your name as the subject field. How can you be sure that there are no two certificates with the ...
6
votes
3answers
922 views
Certificate chain
For my computer to verify the identity of a certain certificate should it have all the certificates up to the root certificate?
8
votes
2answers
2k views
SSL Certificate revocation check
In the SSL protocol I don't see where the certificate is checked for revocation status.
https://developer.mozilla.org/en/Introduction_to_SSL
Is the Certificate Revocation and Status Checking not ...
20
votes
7answers
3k views
Where to get an SSL certificate for personal website?
I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
