A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

4
votes
2answers
57 views

Understanding Digital Certification as as a whole starting from a normal http request

I am very new to security and i do not come from an IT background. Please pardon me if i ask some very simple and questions that don't make sense. I am trying to understand the difference between ...
4
votes
1answer
76 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
20
votes
4answers
2k views

Cloudflare's free SSL options require trusting them; what could they do to change that?

Cloudflare offers 3 free SSL options: Flexible SSL, Full SSL, and Full Strict SSL. The article “CloudFlare’s great new features and why I won’t use them” explores the shortcomings of the Flexible and ...
3
votes
0answers
35 views

A potential possibility of improvement of PKI for personal communications

In countries like Germany each citizen has an identity card that is issued by the registration authority. Since the identity of a citizen is, in a sense, created by that authority via assigning him ...
1
vote
1answer
44 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how to deal with the ...
1
vote
0answers
33 views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: ...
1
vote
0answers
21 views

Relationship between the validity of license of an accredited CA (certificate authority and the validity of it's certificate? [duplicate]

To more clear, let's see my example: As I know, in Korea, the validity of a CA's license is only 2 years, but the validity of this CA's certificate is 10 years. Why is the valid time of the license ...
2
votes
2answers
438 views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
1
vote
2answers
46 views

PKI cards - PIN and certificates

My company has introduced a PKI some months ago. We are now able to login in our laptops either with our Windows credentials or with a PKI smart card plus a 6 digits numeric PIN. A part from that we ...
1
vote
1answer
26 views

Generating shared secret key using existing receivers public key and senders private key

I have the public key of the receiver, and the private key of the sender. I want to generate a new key by using the receivers public key and senders private key (also known as the signing key) to ...
3
votes
1answer
55 views

How to verify an OpenPGP key's ownership?

I've added the public key of Diceware creator (please use it as a practical example), I've added it by downloading diceware.wordlist.asc, and I didn't have his key and couldn't immediately find it to ...
1
vote
1answer
118 views

What is the most secure way to digitally communicate between the U.S. and China?

What is the most secure way for two people to communicate digitally when one person is in the U.S. and the other is in China (likely being monitored)? Updated: Here's some additional info: The ...
4
votes
2answers
39 views

What do the terms used in OpenPGP keyserver SKS mean? (sig, sbind, sig3, exp2, Policy, …)

When viewing a key record in a public key server, such as this one, there are lots of keywords used: sig, sig3, exp3, Policy, sbind…). I understand that "sig" probably means a signature, but what's ...
0
votes
1answer
35 views

Confused about RFC 4492: difference between “ECDH-capable public key” and “ECDSA-capable public key”

As per section 5.3 of RFC 4492, I'm confused with the following table: Key Exchange Algorithm Server Certificate Type ---------------------- ----------------------- ...
0
votes
0answers
46 views

How to add a certificate chain to a JKS

I want to setup a KeyStore which contains certificate-chains only. This is required by a PKE system which uses the PublicKey of the desired certificate for encryption an then sends the cipher to the ...
3
votes
2answers
89 views

Internet Explorer - Advanced Properties for Trusted Root Certificates

If you go to IE -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities. Now Click on some CA certificates and click on Advanced You can add properties to the ...
1
vote
1answer
74 views

Is it complicated to deploy my own CA?

We want to implement a free solution to sign digitally internal documents. No legal value of this sign are requested. We want to consider to deploy an internal CA. Why is it always said that keeping ...
3
votes
2answers
58 views

Using Different Algorithms in Single PKI

Assume the following Public Key Infrastructure: |Root CA (RSA) |-Sub CA (RSA) |-Sub CA (ECC) Is there any rational that explains why this would not be an acceptable implementation? Is the ...
1
vote
2answers
138 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: I have been researching how trusted root authorities (such as GlobalSign or Verisign) are used ...
8
votes
2answers
106 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
5
votes
2answers
91 views

How do I prepare for Certificate Authority end of business?

We are deploying a security solution which uses certificates to validate documents. These certificates are issued by our government-authorized CA. What if in a distant future, the CA who provided us ...
1
vote
1answer
85 views

Should self signed wildcard certs be used?

I think this is more urban legend around where I work than anything. I do not see anything in RFC 2459 that specifically says whether or not they should be used or if there are any known problems with ...
3
votes
1answer
33 views

Extend hierarchical PKI

The figure below shows four simple hierarchical PKIs. A, R, H and N are trust anchors of their PKI. I am supposed to add exactly one certificate so that T trusts G, but not D. Furthermore R must ...
5
votes
2answers
65 views

Understanding digitial certifications

q1) Does that mean that every time information is exchanged, both the original data + digital certification is sent? Meaning data + signature for each and every exchange. q2) Can any kind soul here ...
6
votes
2answers
80 views

Issuing certificates to two departments from same ROOT CA so one does not trust the other

Scenario: We have two departments within IT; Say Department-OLD and Department-NEW. A single internal PKI environment exists and a root CA (singular) is trusted by All endpoints. Problem: ...
20
votes
8answers
2k views

Is there such a thing as public key steganography

One of the drawbacks of traditional steganography is that both parties need to exchange a secret key. Encryption had this problem too but circumvented this with public key cryptography. Are there ...
0
votes
4answers
56 views

Generating SSH keys and sending the private key

I've been looking up on how to set up public key authentication between two hosts on my LAN. I am going to be using a pass phrase with my key pair. A lot of tutorials instruct me to generate the key ...
8
votes
3answers
889 views

Can I expose a passphrase-protected private OpenPGP key? [duplicate]

I have created a 4096-bit key-pair using GnuPG. Can I expose the passphrase-protected private key to an untrusted system? E.g. can I put that key in my Dropbox account or send it to myself as an ...
3
votes
2answers
280 views

Should I be concerned at the lack for transparency by Microsoft which quietly added 17 root certs?

This week it was noticed that Microsoft apparently very quietly pushed out 17 new trusted root certificates (Infoworld Article). The lack of public announcement seems a bit strange. Is anyone aware ...
1
vote
1answer
102 views

EC private key, RSA certificate. Is this realisable?

I was wondering if is it possible to generate EC private key: openssl ecparam -name sect571r1 -out ecparam.pem openssl ecparam -in ecparam.pem -genkey -noout -out eckey.pem then generate ...
3
votes
1answer
48 views

Verifying cryptographically signed files when the key has been revoked

This is mostly a question out of idle curiousity. If I use my private key to sign a file today, forming a signature, and distribute that signature with the document to someone they can then use my ...
2
votes
4answers
289 views

Is it neccessary that website certificate must have site URL?

While working on a scenario, I got the error message "Server's certificates doesn't match the url". Is it necessary that the certificate given from the website must have its URL? Is it necessary that ...
2
votes
0answers
37 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
2
votes
1answer
95 views

SSH like promiscuity for HTTPS

I want to build something, but I haven't seen it before. Maybe you have? I'd like to build a HTML5 app, served to modern browsers and phones from a microcomputer (e.g. BBB). The microcomputer would ...
1
vote
4answers
260 views

HTTPS: is the data downloaded when loading a page encrypted?

So as far as I know, when you go to a https enabled website, all the data you send to that server will be encrypted with their public key, and only the server holding the private key will be able to ...
2
votes
1answer
24 views

Is there an implementation of a trust on software on a host?

What I'm after is a trust that is established between the hardware and the software intended to use that hardware. This may require a certificate "burned in" to a specialized chip. The open SSL may ...
2
votes
1answer
106 views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...
1
vote
1answer
36 views

What does the letter in an OpenPGP key's bits definition (like 4096D) denote?

I noticed that when looking at OpenPGP keys on a key server, the key's bits definition is usually followed by a letter, as in "4096D" for example. However, there are also keys with other letters than ...
2
votes
1answer
120 views

Is it possible to do Public Private Key Encryption on a chip (hardware)?

Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely? The ultimate goal ...
1
vote
0answers
82 views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
3
votes
1answer
57 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...
2
votes
1answer
48 views

Personal cipher/digest preferences ignored when generating a new key pair in GnuPG

I have specified personal digest preferences in my ~/.gnupg/gpg.conf: personal-digest-preferences SHA512 SHA256 SHA384 SHA224 SHA1 then, I have generated a new key pair. But when I check the ...
2
votes
3answers
47 views

PKI usage in a cluster; per application instance or per application?

I'm having a cluster with nodes (let's call them A and B for the sake of example) running identical micro services (1, 2 and 3 - so the application 2 running on node A is called A2). The applications ...
2
votes
1answer
41 views

Cross-certification between worlds like X.509 and PGP?

Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
3
votes
1answer
74 views

Will Let's Encrypt allow a custom workflow? [closed]

The Let’s Encrypt management software will: Automatically prove to the Let’s Encrypt CA that you control the website Obtain a browser-trusted certificate and set it up on your web server ...
1
vote
0answers
75 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
1
vote
0answers
21 views

Why do DNSKEY have a RRSIG for themselves?

Looking at all examlpes of DNSSEC, you see that the zone includes not only the DNSKEY , but also a RRSIG of the DNSKEY created with that same DNSKEY? Why is this? Why publish a self-signed RRSIG? What ...
0
votes
1answer
19 views

Validating the ROA certificate

Suppose I have a system, where the server requires the clients to attach their ROA certificate to prove that they have the right to that IP Prefix. Now if the client attaches the ROA certificate ( ...
0
votes
2answers
52 views

Signing an OpenPGP public key that is not uploaded to a key server

Is there any point in signing an OpenPGP public key that has not been uploaded to a key server? In other words: does anyone except person A who signs person B's public key notice that the signing has ...
2
votes
1answer
49 views

Best practice of deprecating old OpenPGP subkeys when migrating to a new subkey pair?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The ...