0
votes
1answer
57 views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
1
vote
0answers
21 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
0
votes
1answer
124 views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
2answers
56 views

Typical mistakes when implementing digital signatures?

I am looking for a list of typical mistakes someone can make when implementing digital signatures for a software. And of course why they are mistakes and how an attacker could take advantage of them. ...
0
votes
0answers
47 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
0
votes
4answers
100 views

Using a Public-Key-Encryption browser side to avoid PCI compliance

We're developing a web application in which certain not logged users (clients) need to send their credit card details to other users (merchants) - which, we'll assume, are PCI compliant. We are ...
3
votes
1answer
52 views

What crypto prevents & detects “invisible” CAs? (e.g. in X509v4)

For this question, I'm calling an "invisible CA" one that Is signed by a root ca and exists as a 2nd or 3rd tier Is valid, not expired or revoked Has a different Public key than one that is ...
2
votes
1answer
100 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
2
votes
1answer
216 views

adding certificate that resides on smartcard to the microsoft store with private key ownership

how can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? in an enrollment system where users generate smartcard certificate ...
0
votes
0answers
24 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
5
votes
1answer
625 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
3
votes
1answer
264 views

Open source solution to capture and decrypt SSH traffic (with private key)?

I am looking for a free open source solution that is able to capture and decrypt SSH traffic given the fact that I can provide the server's RSA private key (something like SSH CryptoAuditor). Please ...
0
votes
1answer
80 views

Public Key Authentication

Is there another way to verify someones public key without a CA signing it? A challenge-response authentication including some sort of UID of the smartphone? Smartphone A generates asymmetric key ...
2
votes
1answer
60 views

X509Certificate - How to set validation Policies?

I have an X509Certificate (say Certificate-A) for signing purpose. While validating this certificate, I have to check its path with Intermediate & Root certificate which I have implemented fully. ...
1
vote
3answers
321 views

How does encryption/decryption work when one generate random key?

I am new to this and want to ask a basic question. Suppose I used my password (say "ABC123") to generate a key using the PBKDF2 algorithm (or any such algorithm). For encrypting a file I'll input my ...
0
votes
1answer
82 views

Public Key Cryptography : Key length

While symm. crypt. has around 256 bits of a key, why does public key crypt have a key that is much longer (1000's) ???
0
votes
2answers
945 views

Cryptography behind chip based credit cards (smart cards)?

Why are chips safer than magnetic stripes? The answers to the above question explain that the chip based cards can not be cloned as the "secret number" is embedded in the chip and protected by the ...
3
votes
2answers
283 views

Totally secure public key distrubition

Public-key cryptography secures communications provided that you use pre-shared public-keys. The problem is how to share these public-keys while maintaining authenticity? How can we be sure that ...
0
votes
0answers
12 views

Oracle service public key [duplicate]

What is an oracle service(encryption and decryption?) For public key algorithm, does an attacker need an oracle service?
23
votes
5answers
3k views

Why is Bruce Schneier recommending symmetric crypto over public key crypto

I just read the article written by Bruce Schneier, the crypto guru. In the article, he says : Prefer symmetric cryptography over public-key cryptography. But, he doesn't shed any light as to ...
-2
votes
1answer
143 views

Posting public key [closed]

Should I put my public key on my website so that people can securely contact me. I have seen personal sites where there public key is at the bottom of the page such as this site by the computer ...
3
votes
1answer
526 views

Can you make a digital signature using the receiver's public key?

My question is, can you make a digital signature using the receiver's public key and then have the receiver verify the signature using his private key? I always thought that in order to create a ...
3
votes
1answer
142 views

Clarification on Digital Certificates

I used the makecert tool to create: self-signed certificate client certificate These are the commands I used: makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
6
votes
2answers
2k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
4
votes
3answers
2k views

Is a 512 bit RSA key secure when used temporary?

Is a 512 bit RSA key secure when a new key gets generated and used approximately once a week? The key is only used for signing messages, not for encrypting sensitive data. This is for a system where ...
3
votes
2answers
866 views

What hardware technology (GPU, FPGA) is fastest at generating RSA keys?

I'm interested in generating RSA keys in rapid succession and am looking for the correct hardware to so. I think what I'm looking for is very similar to a brute force attack on RSA keys, but my ...
1
vote
4answers
376 views

RSA and encrypted authentication

Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication ...
2
votes
3answers
180 views

Given a large enough sampling of public keys could one begin to identify a private key?

For example, an ISP or government capable of tracking millions of keys being exchanged. Would that provide a sample large enough to be able to identify the private key on either end?
3
votes
1answer
159 views

Can we use a public key scheme for performing cryptographic commitment

Is it possible to use a public key scheme such as DSA as a commitment scheme? Are there any problems with doing this?
4
votes
4answers
629 views

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
2
votes
2answers
895 views

Key Exchange using PKI

I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl openssl req -x509 -nodes ...
10
votes
2answers
1k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
2
votes
2answers
705 views

Revoked certificate validation using past times

I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past. Unfortunately I have problems verifying revoked ...
1
vote
0answers
192 views

Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]

I have installed openssl and now the rsa_test.c is running fine. What I want to do is: Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey. The public key contains the ...
5
votes
1answer
232 views

security issue on storing keys and certificate on token

I'm creating a sample USB token with Atmega64. As I have to store both the public and private key and the certificate on my token is there any important security issue that I should worry about, ...
3
votes
2answers
454 views

Distributed XAdES-X and XAdES-A signatures over multiple documents

As the standard is not completely clear in this matter, I'm trying to found out if the XAdES standard (ETSI TS 101 903 v1.4.2) describes distributed case in which the SigAndRefsTimeStamp element or ...
4
votes
1answer
74 views

Standards for CA cert revocation and time-constrained cryptographic algorithm parameters

I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
3
votes
1answer
143 views

CMC (RFC 5272) compatible CA server

I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
2
votes
1answer
3k views

Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?

If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data? If the latter, then if someone had access ...
3
votes
1answer
1k views

how do extended validation X.509 certs work?

https://www.forumatic.com/ uses an extended validation cert. wikipedia.org's entry on extended validation certs says that a cert is known to be an extended validation cert if the OID in the ...
1
vote
1answer
107 views

valid intermediate certs not in browser

Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
8
votes
2answers
557 views

X.509 certificate policies question

I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies. To quote from the X.509 RFC: In an end entity certificate, these ...
2
votes
1answer
483 views

X.509 certificate policy mapping question

So I'm a little confused how X.509 certificate policy mappings work. So let's say the following depicts my cert chain: root CA ---> intermediary CA ---> client cert Would the root CA have a ...
7
votes
3answers
2k views

Why does OpenVPN require securely sharing certs with clients?

The ubuntu docs on OpenVPN have this part in the instructions: Copy the following files to the client: /etc/openvpn/ca.crt /etc/openvpn/easy-rsa/keys/hostname.crt ...
3
votes
3answers
394 views

Public key system confusion

I read the following about PKI: Using a public key system, a user may encrypt a portion of a document using his or her private key. This message will later be decrypted by the recipient using ...
0
votes
1answer
328 views

Enterprise Encryption Considerations

What are the different aspects to consider for Enterprise Encryption policy? So far the resources I have are: https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet ...
17
votes
3answers
8k views

What are the risks of self signing a certificate for SSL

Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
14
votes
4answers
12k views

how digital signature verification process works

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
26
votes
4answers
14k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
5
votes
3answers
158 views

Guarding against rogue certificates

There has been a lot of news recently about certificates being falsely issued (due to the issuing authority having poor system security!). Apparently the targeted users were mostly Iranians, but it's ...