A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

3
votes
2answers
68 views

Internet Explorer - Advanced Properties for Trusted Root Certificates

If you go to IE -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities. Now Click on some CA certificates and click on Advanced You can add properties to the ...
1
vote
1answer
67 views

Is it complicated to deploy my own CA?

We want to implement a free solution to sign digitally internal documents. No legal value of this sign are requested. We want to consider to deploy an internal CA. Why is it always said that keeping ...
3
votes
2answers
41 views

Using Different Algorithms in Single PKI

Assume the following Public Key Infrastructure: |Root CA (RSA) |-Sub CA (RSA) |-Sub CA (ECC) Is there any rational that explains why this would not be an acceptable implementation? Is the ...
1
vote
2answers
124 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: I have been researching how trusted root authorities (such as GlobalSign or Verisign) are used ...
6
votes
2answers
75 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
5
votes
2answers
83 views

How do I prepare for Certificate Authority end of business?

We are deploying a security solution which uses certificates to validate documents. These certificates are issued by our government-authorized CA. What if in a distant future, the CA who provided us ...
1
vote
1answer
76 views

Should self signed wildcard certs be used?

I think this is more urban legend around where I work than anything. I do not see anything in RFC 2459 that specifically says whether or not they should be used or if there are any known problems with ...
1
vote
0answers
58 views

How can I distribute decryption keys to servers? [migrated]

I'm trying to implement user-folder encryption (as opposed to full-disk encryption) on some Linux servers in a data center. I don't want to store the decryption key in plain text on the servers ...
3
votes
1answer
28 views

Extend hierarchical PKI

The figure below shows four simple hierarchical PKIs. A, R, H and N are trust anchors of their PKI. I am supposed to add exactly one certificate so that T trusts G, but not D. Furthermore R must ...
5
votes
2answers
59 views

Understanding digitial certifications

q1) Does that mean that every time information is exchanged, both the original data + digital certification is sent? Meaning data + signature for each and every exchange. q2) Can any kind soul here ...
6
votes
2answers
77 views

Issuing certificates to two departments from same ROOT CA so one does not trust the other

Scenario: We have two departments within IT; Say Department-OLD and Department-NEW. A single internal PKI environment exists and a root CA (singular) is trusted by All endpoints. Problem: ...
19
votes
8answers
2k views

Is there such a thing as public key steganography

One of the drawbacks of traditional steganography is that both parties need to exchange a secret key. Encryption had this problem too but circumvented this with public key cryptography. Are there ...
0
votes
4answers
47 views

Generating SSH keys and sending the private key

I've been looking up on how to set up public key authentication between two hosts on my LAN. I am going to be using a pass phrase with my key pair. A lot of tutorials instruct me to generate the key ...
8
votes
3answers
876 views

Can I expose a passphrase-protected private OpenPGP key? [duplicate]

I have created a 4096-bit key-pair using GnuPG. Can I expose the passphrase-protected private key to an untrusted system? E.g. can I put that key in my Dropbox account or send it to myself as an ...
3
votes
2answers
259 views

Should I be concerned at the lack for transparency by Microsoft which quietly added 17 root certs?

This week it was noticed that Microsoft apparently very quietly pushed out 17 new trusted root certificates (Infoworld Article). The lack of public announcement seems a bit strange. Is anyone aware ...
2
votes
1answer
53 views

EC private key, RSA certificate. Is this realisable?

I was wondering if is it possible to generate EC private key: openssl ecparam -name sect571r1 -out ecparam.pem openssl ecparam -in ecparam.pem -genkey -noout -out eckey.pem then generate ...
3
votes
1answer
46 views

Verifying cryptographically signed files when the key has been revoked

This is mostly a question out of idle curiousity. If I use my private key to sign a file today, forming a signature, and distribute that signature with the document to someone they can then use my ...
2
votes
4answers
262 views

Is it neccessary that website certificate must have site URL?

While working on a scenario, I got the error message "Server's certificates doesn't match the url". Is it necessary that the certificate given from the website must have its URL? Is it necessary that ...
2
votes
0answers
20 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
2
votes
1answer
95 views

SSH like promiscuity for HTTPS

I want to build something, but I haven't seen it before. Maybe you have? I'd like to build a HTML5 app, served to modern browsers and phones from a microcomputer (e.g. BBB). The microcomputer would ...
1
vote
4answers
253 views

HTTPS: is the data downloaded when loading a page encrypted?

So as far as I know, when you go to a https enabled website, all the data you send to that server will be encrypted with their public key, and only the server holding the private key will be able to ...
2
votes
1answer
24 views

Is there an implementation of a trust on software on a host?

What I'm after is a trust that is established between the hardware and the software intended to use that hardware. This may require a certificate "burned in" to a specialized chip. The open SSL may ...
2
votes
1answer
83 views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...
0
votes
1answer
27 views

What does the letter in an OpenPGP key's bits definition (like 4096D) denote?

I noticed that when looking at OpenPGP keys on a key server, the key's bits definition is usually followed by a letter, as in "4096D" for example. However, there are also keys with other letters than ...
2
votes
1answer
91 views

Is it possible to do Public Private Key Encryption on a chip (hardware)?

Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely? The ultimate goal ...
1
vote
0answers
63 views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
3
votes
1answer
47 views

How to trust a CA to sign a CRL but not a cert?

In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs. How do I mark a CA to be trusted only for CRLs, and not for ...
2
votes
1answer
40 views

Personal cipher/digest preferences ignored when generating a new key pair in GnuPG

I have specified personal digest preferences in my ~/.gnupg/gpg.conf: personal-digest-preferences SHA512 SHA256 SHA384 SHA224 SHA1 then, I have generated a new key pair. But when I check the ...
2
votes
3answers
40 views

PKI usage in a cluster; per application instance or per application?

I'm having a cluster with nodes (let's call them A and B for the sake of example) running identical micro services (1, 2 and 3 - so the application 2 running on node A is called A2). The applications ...
2
votes
1answer
29 views

Cross-certification between worlds like X.509 and PGP?

Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
3
votes
1answer
63 views

Will Let's Encrypt allow a custom workflow? [closed]

The Let’s Encrypt management software will: Automatically prove to the Let’s Encrypt CA that you control the website Obtain a browser-trusted certificate and set it up on your web server ...
1
vote
0answers
64 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
1
vote
0answers
19 views

Why do DNSKEY have a RRSIG for themselves?

Looking at all examlpes of DNSSEC, you see that the zone includes not only the DNSKEY , but also a RRSIG of the DNSKEY created with that same DNSKEY? Why is this? Why publish a self-signed RRSIG? What ...
0
votes
1answer
16 views

Validating the ROA certificate

Suppose I have a system, where the server requires the clients to attach their ROA certificate to prove that they have the right to that IP Prefix. Now if the client attaches the ROA certificate ( ...
0
votes
2answers
44 views

Signing an OpenPGP public key that is not uploaded to a key server

Is there any point in signing an OpenPGP public key that has not been uploaded to a key server? In other words: does anyone except person A who signs person B's public key notice that the signing has ...
2
votes
1answer
41 views

Best practice of deprecating old OpenPGP subkeys when migrating to a new subkey pair?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The ...
3
votes
1answer
67 views

RemoveFromCRL and DeltaCRL

I have a question about DeltaCRL with an entry which contains RemoveFromCRL reason. At the start, PKI has revoked the certificate with certificateHold reason. And create next CRL: Last Update: May ...
5
votes
1answer
142 views

SSL certificates and cipher suites correspondence

I have been learning about the SSL/TLS protocol (from https://tools.ietf.org/html/rfc5246) and have a few conceptual questions about the protocol. The client and server exchange "hello" messages ...
4
votes
2answers
102 views

Can a RootCA be revoked?

I have created a New Trusted certification authority which issues certificate to the end entity and the end entity will use this certificate as trusted one for all their PKI operations. Some how the ...
6
votes
3answers
799 views

What if someone steals a Certificate authority's private key? [duplicate]

What if someone could steal a Certificate authority's private key? I know this will (probably) never happen, but what would happen to the certificates that were already signed with this private key? ...
1
vote
2answers
66 views

Man in the middle attack on browser downloads

I'm writing this post from chrome. If I go to a HTTPS site after this, the public keys built into the version of chrome I'm using will be used to verify the site's signature (unless I misunderstand). ...
0
votes
2answers
51 views

Generic term for certificates and keys

Is there a generic term to designate both public and private keys, certificates and maybe even passwords?
4
votes
2answers
94 views

Can the intended recipient be derived from a public-key encrypted ciphertext?

Assuming you have a list of possible recipients' public keys, and a ciphertext encrypted with one of those public keys, would it be possible to determine which public key?
2
votes
0answers
32 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
14
votes
5answers
802 views

Creating my own CA for an intranet

I need to create my own CA for an intranet and unfortunately it seems there's no good answer about this on Security.SE. There are many resources online about this, but all of them are different and ...
7
votes
2answers
152 views

Can symmetric key cryptography provide identification?

I understand that PKI uses digital certificates to link a public key to an entity, but is there anything similar for symmetric cryptography. If, theoretically, PKI didn't exist, how do you know you ...
1
vote
3answers
65 views

What type of hashing method is used for the private key to encrypt for signing messages?

To use RSA for signing, Alice takes a hash of the message, encrypts the hash using her own private key, and appends the result (this is the signature) to the message. Eve can of course still ...
0
votes
2answers
56 views

Hierarchical PKI trust model

Suppose we have the hierarchical trust model as seen below. Alice will trust Doris' public key iff there is a Certifcation Path from her to Doris. Alice thus pocesses a valid certificate of A. ...
3
votes
1answer
164 views

HSM maintenance

I have a HSM that is an asset within a information security management system and the help desk team tells me that the device is displaying a critical failure alert. So my questions are: Must I ...
1
vote
1answer
73 views

Determine private key size using public certificate [duplicate]

I have a public certificate in a PEM (.pem) file -----BEGIN CERTIFICATE----- MIICsjCCAZqgAwIBAgIJAMA1YIQ2JLXDMA0GCSqGSIb3DQEBBQUAMBExDzANBgNV ... 29V/R9RZOoSBHDzGPL84wm4qojMuwQ== ...