A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

0
votes
2answers
19 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
0
votes
0answers
13 views

What is the minimum acceptable time for “Freshest CRL” to be updated?

I'm working with MSFT CA, and not sure if this behavior is the same across all CAs, but when I run certutil -CRL, the base revocation cert is updated weekly, and the Freshest CRL (the differential) ...
1
vote
1answer
15 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strenght ? (PBKDF2 as both ...
3
votes
2answers
89 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...
0
votes
0answers
9 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
0
votes
0answers
21 views

Distribution of key by server

I have read that in asymmetric cryptography, a system admin can generate key pairs on the server. After that, the users will be given the generated key pairs and this is an efficient way of doing this ...
1
vote
2answers
53 views

multiple private keys for single public key

I am currently working in security in mobile ad-hoc networks I have several clusters, and I want from the cluster head to send some data encrypted with its public key ,to the cluster members. I assume ...
3
votes
1answer
69 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
2
votes
1answer
43 views

How do Client-specific keys and Certificates work?

I have clients that communicates with my server. Clients sends it unique id (guid) to server with its request over a secure https channel. Also to increase security I use my own private-public key ...
0
votes
1answer
35 views

public key formats [on hold]

I have the following PEM format public key: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDguwHaldTclMAFg1BQ45Q8DPIc ...
2
votes
2answers
49 views

Does an alternative approach to PKI technology exist?

Currently all of the network is using PKI standards and we are facing many problems. I don't mean every time and if new technologies arise we will also have to face the same, but for my curiosity. ...
1
vote
1answer
100 views

How do PGP keyservers synchronize the keys?

I want to know technical details about how public PGP keyservers synchronize the keys. If I send my key to one keyserver, how exactly does it "travel" to all the other ones? Who sends it to who and ...
4
votes
2answers
83 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
0
votes
1answer
42 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
1
vote
1answer
50 views

Why should I have my GPG key expire? [duplicate]

When creating a key pair using gpg it asks me for an expiration date: $ gpg --gen-key Please specify how long the key should be valid. 0 = key does not expire <n> = key expires ...
0
votes
0answers
42 views

Hard vs Soft Digital Certificates [closed]

A few question related to digital certificates. Can someone please explain: What are the differences between "hard certificates" and "soft certificates"? Why are "hard" certificates considered more ...
0
votes
0answers
33 views

How can I send an email using a GPG public key? [migrated]

I would like to send an email (on Windows), which I would like to encrypt using a GPG public key. I tried to use a Thunderbird plugin, but it requires both the public and the private key. But I have ...
1
vote
3answers
57 views

Secure tunnel set up in an office environment

Suppose I am a rogue employee and I want to syphon some sensitive data out of the office and I only have office internet access for this. My office internet access needs to go through a proxy server, ...
0
votes
2answers
62 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
2
votes
2answers
69 views

How can I create my own public certificate using openssl?

I have a public key/private key pair i generated using two primes p and q. I now need to use openssl to sign and create the certificate. I heard req utility and wrote this from the man pages. openssl ...
0
votes
0answers
13 views

why DH is unbreakable and what are the facts that leads to strong DH? [duplicate]

I am new to DH and learned the basic about DH working and suspecting it can be breakable by normal MIM , then how we can use DH in plain http for sharing secret. correct me if i am wrong.
0
votes
1answer
28 views

PKCS#12 File - security impacts when imported in Web Browser or Windows Store?

When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password. How does the browser or operating system manage this password? Is it secure?
4
votes
1answer
34 views

Mail Signing Certificate – What are the impacts when revocated?

Suppose I open a signed mail on 1st January 2000, signature is OK. What about this two cases : 1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
12
votes
1answer
703 views

Relationship between RSA, Diffie-Hellman Key Exchange, PKI and X.509?

I am getting confused with RSA, Diffie-Hellman Key Exchange, PKI and X.509v3. I took a look of RSA's mathematics algorithm, it seems like a encryption algorithm, right? Generating public key and ...
0
votes
0answers
14 views

Certificate Validation [migrated]

I need to encrypt some data using the public key certificate available from one of my client's website. My question is aroung certificate validation? How can I validate this online certificate? I ...
0
votes
1answer
67 views

Sign PKCS#7 and verify PKCS#7 signature with OpenSSL

If someone have to transfer X.509 certificates in a single bundle, usually, it is recommended to pack them into PKCS#7. And content of PKCS#7 can be signed. OpenSSL allows to pack certificates into ...
4
votes
2answers
71 views

Verify digital signature without key public key in signature

When receiving emails, I sometimes see the following: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I found an integer overflow in PHP, in the conversation of dates to "Julian Day Count" function. ...
1
vote
1answer
38 views

Does SSL/TLS have the feasibility of detecting malicious things during transmission? [closed]

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly ...
1
vote
1answer
25 views

Can a PKCS12 file be distributed over insecure channel?

Is the PKCS12 only as secure as the password protecting private keys ? Can I distribute the p12 file over an insecure channel ?
4
votes
3answers
101 views

How can I create a unique identifier that can not easily be reversed?

I've been working on the design of a longitudinal study and one requirement is: all participants will have a unique identifier that is not reversible from the data storage/analyst side of the study ...
0
votes
1answer
64 views

PGP Key publishing on MIT PGP Public Key Server [duplicate]

I have a public pgp key, so that users can send me an encrypted message. Ofcourse, any user that wants to send me a message, wants to verify that the public key (s)he has, really belongs to me. From ...
0
votes
1answer
84 views

Two-factor encryption model [closed]

Please some on help me to understand this "Are you ready for this? With the two-factor encryption model your data is protected two-fold. First, a unique key is generated, encrypted, and turned into ...
2
votes
1answer
175 views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...
0
votes
1answer
79 views

Compromised submarine cables and the consequences to internet?

I recently read an article that Google wants to build a submarine cable connecting to my country supposedly to increase overall speed and while I hope my government will never allow this kind of thing ...
0
votes
0answers
32 views

Security schemes regularly in use on cloud

I've been looking into how connections are managed in the cloud, in order to better understand the threats users and their deployments may face. The most important and common ones in use seem to be ...
-1
votes
1answer
56 views

How do openvpn/easy-rsa generated keys map to RSA algorithm variables?

I was reading up a little on openvpn and pki infra and am confused by some of the questions posed by my colleague. :) This answer did help me understand more: ...
0
votes
1answer
12 views

Web of Trust: What is “signatory trust”?

I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust. What is an easily understandable definition of signatory trust? An ...
4
votes
1answer
112 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of ...
2
votes
1answer
22 views

Is there a way of achieving perfect forward security with one directional messages?

Using for example ECDH and ephimeral keys, it is possible for two parties to establish a shared key with perfect forward security, i.e. even if the long term keys are lost, it will not be possible to ...
3
votes
1answer
49 views

Installing a CA only for specific domains

For many reasons, it's often convenient for organizations to have their own CA (self-signed or otherwise). As I understand it, adding the CA certificate to a OS or browser will make it trust the ...
3
votes
1answer
51 views

What encryption and signature systems (don't?) allow for plausible deniability of the OP's key being used?

I need to prevent Mallory from blindly matching encryption and signing keys to messages Hypothetical scenario: A user creates a public key An encrypted or signed payload exists. With only public ...
1
vote
0answers
44 views

Distribute S/MIME public keys and CA cert for email security

I have my own CA. I want to distribute S/MIME certificates for 10 different users. I saw S/MIME keyservers from http://wiki.cacert.org/KeyServers, but I don't want to use public servers. What is the ...
2
votes
1answer
44 views

Smartcard - main differences between .NET and Java smartcard?

My question focuses on the differences regarding PKCS11 implementation between a .Net and a Java smartcard. More generally, do smartcard use a specific "OS" (or firmware) and only differ in the ...
1
vote
1answer
34 views

Banking card certificate

Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ? Perhaps a standard exists or a de-facto ...
3
votes
1answer
59 views

PKI - Why Root CA is in intermediate CA section?

I can't understand why, when I accept to "install" a custom self signed Root CA on IE browser, the root certificate ends up in the "intermediate CA" section, rather than in "Root CA" section in the ...
5
votes
1answer
103 views

PKI Installation

I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a ...
1
vote
3answers
72 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
48
votes
1answer
3k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
11
votes
1answer
185 views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
1
vote
0answers
31 views

Use of RSA in Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...