A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

8
votes
2answers
511 views

Is there a way to negotiate a secret between 2 parties with no prior knowledge?

Is there a way for 2 parties to negotiate a shared secret (for example, a session key) without having a pre-shared knowledge? SSL does this by using asymmetric encryption. Is there any other way to ...
10
votes
3answers
5k views

How does an SSL server prove its identity?

This document says that a challenge response authentication proves the servers identity. But is a man in the middle attack still possible if the client does not verify domain name ? Please help me ...
29
votes
4answers
25k views

How to achieve non-repudiation?

If I have a message that I need to send to another person, how do I achieve non repudiation ? Is digitally signing the message sufficient ?
4
votes
1answer
129 views

What is the meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC from ETSI TS 102 231 V3.1.2

From Technical Spec http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC a Root Certification Authority from which a certification path can be established down to ...
38
votes
4answers
7k views

What alternatives are there to the existing Certificate Authority system for SSL?

Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
7
votes
4answers
5k views

Can an intermediate CA be trusted like a self-signed root CA?

Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
4
votes
1answer
4k views

How do I share my S/MIME public key?

I have setup S/MIME encryption for my email address, and I'd like to allow people to download the public key from my website, rather than having to first receive an email from me. I want the public ...
5
votes
1answer
1k views

What are the alternative to PKI certificates in mesh networks?

My particular problem has to do with secure communications over a mesh network (http://en.wikipedia.org/wiki/Mesh_network), in particular man-in-the-middle (MITM) attacks. The difficulty is that mesh ...
13
votes
2answers
806 views

Is PGP secure against a rogue keyserver?

Imagine Eve taking over the keyserver both Alica and Bob are using. By replacing Alices and Bobs public keys with her own, she can do a man-in-the-middle attack decrypting messages and relaying them ...
14
votes
3answers
23k views

Is it possible to use wildcard certificates on multiple devices?

I have a server that I want to use a wildcard cert on. It runs multiple services. I purchase a wildcard cert so that I can protect mail.something.dom, www.something.dom, im.something.dom, ...
7
votes
2answers
1k views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
4
votes
3answers
1k views

How are possible uses for X.509 (SSL) certificates denoted?

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it ...
3
votes
2answers
168 views

Deciding whether to sign someones key

How do i decide whether to sign someones PGP public key? I was looking at some contact pages and they have a request for people to sign their public key. How serious of a commitment is it to sign ...
2
votes
1answer
355 views

What is the optimal result for the elliptic curve patent issue?

I saw an article this morning, discussing the fact that RSA and DH may be significantly less secure in the upcoming five years. Although the chance that this will materialize is small, I immediately ...
-1
votes
1answer
345 views

Posting public key [closed]

Should I put my public key on my website so that people can securely contact me. I have seen personal sites where there public key is at the bottom of the page such as this site by the computer ...
0
votes
1answer
733 views

Splitting up symmetric key to be able to encrypt using 1024 bit RSA public key

The application which I am writing generates a 256 bit symmetric key everytime it wants to communicate with the server and encrypts the data and sends it to the server. This is to avoid storing the ...
6
votes
2answers
1k views

Root SSL certificates and browser support

I have given three certs to be install on nginx AddTrustExternalCARoot.crt PositiveSSLCA2.crt www_example_com.crt So I concat them into a chained cert cat www_example_com.crt PositiveSSLCA2.crt ...
5
votes
1answer
237 views

Password strengthening for PGP

I'm wondering about some of the semantics and security implications of using something like scrypt or bcrypt to "enhance" a password protecting a PGP private key. Essentially, I'm asking about the ...
5
votes
2answers
788 views

How to implement a Web of Trust?

How to implement a Web of Trust, or something similar? Alice get a public and a private key from the RSA guy. Bob need to send to Alice a nuclear secret code (or his babysiter's phone number). Bob ...
7
votes
2answers
2k views

Why do embedded systems store server's public certificate in ROM?

In the home automation scenario, smart gateway can bridge the many smart devices with Internet. In many cases, a server's public certificate is stored in the embedded system's ROM during ...
1
vote
1answer
402 views

Generate Keytool Object from CSR

I have to develop an application which uses another application for generating a CSR. After generating the CSR I have to provide this CSR along with a SHA256 hash of the public key to a CA. The ...
5
votes
1answer
983 views

Thunderbird - what happens if Gmail SSL cert gets spoofed?

I use a good MUA: Thunderbird [to read/reply to my emails on Gmail]. So: what happens, if i go to a place, where is public wifi, and someone tryes to sniff my password/username/emails? Questions: ...
13
votes
1answer
3k views

Renewing Microsoft Certificate Services Root Certificate

We currently have Microsoft Enterprise Certificate Server installed on a domain member machine which issues 1 year certificates to users for authenticating to VPN. We'd like to start issuing web ...
8
votes
1answer
2k views

Moving from a one tier to a two tier Microsoft Certificate Authority hierachy

Right now we have a single Microsoft Enterprise Root CA which issues certificates to our VPN users for two factor authentication. We're planning to extend use of the CA to issue certificates for RDP ...
7
votes
2answers
5k views
5
votes
1answer
5k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
5
votes
2answers
201 views

How can a certificate be valid in the Hybrid Model but not in the Chain Model?

All dates in European format! I am learning about validity models, but the solution for this assignment confuses me. Translation: The relevant data for the applicable certificates are shown ...
179
votes
7answers
23k views

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
4
votes
1answer
604 views

generating RSA keys through the browser

HTML5 has the element that sends an SPKAC to the server (as I understand it). But how do you do it in IE? One CA's websites gives me the following prompt: This Web site is attempting to perform a ...
2
votes
1answer
3k views

Does Java's implementation of OCSP and CRL checking handle intermediate CAs?

I've read that Java provides OCSP and CRL checking for CertPaths via: Security.setProperty("ocsp.enable", "true"); System.setProperty("com.sun.security.enableCRLDP", "true"); Do these implementations ...
3
votes
1answer
622 views

signatureAlgorithm vs. tbsCertificate -> signature

From the X.509 RFC: Certificate ::= SEQUENCE { tbsCertificate TBSCertificate, signatureAlgorithm AlgorithmIdentifier, signature BIT STRING } TBSCertificate ::= ...
10
votes
2answers
3k views

OCSP and CRLs: Specified in CA or client certificate?

Here's an example PKI setup: * Root CA (offline) * Issuing CA * Client 1 * Client 2 I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
3
votes
1answer
612 views

Internal CA for Digital Signature Solution - PKI Based

I'm trying to set up a digital signature solution which would work with a internal PKI. We have considered Microsoft Certificate Services, but we don't want to rule out any other option to set up a ...
-1
votes
1answer
157 views

XER encoded X.509 certs [closed]

Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it? Thanks!
2
votes
3answers
2k views

Public key Infrastructure

Here the MD5 hash is being encrypted with the private key of the sender. But I read in a paper that private key is only used for signing and not encrypting. Is the image wrong or can private key ...
1
vote
1answer
935 views

are organizations that receive certificates considered “end entities” in a PKI?

I am trying to understand the term end-entity. Does this term just mean anybody that plays a role in a PKI system that is not a CA? So if I request a certificate from A who is a CRL issuer for ...
5
votes
2answers
154 views

Is there a reason to encrypt an encryption key with a certificate before storing it?

Suppose my .Net application which is installed in the client encrypts a data. I want to use a different key generated randomly for each client so each client doesn't know the key of the other. Someone ...
3
votes
1answer
1k views

Can you make a digital signature using the receiver's public key?

My question is, can you make a digital signature using the receiver's public key and then have the receiver verify the signature using his private key? I always thought that in order to create a ...
3
votes
3answers
554 views

Two-way secure communication using two pairs of public/private keys?

Let's say I want to create a protocol to securely communicate between two endpoints - each of the two endpoints know the other's public key and all data exchanged is encryted using one's public key ...
6
votes
3answers
1k views

Safe implementation of sharing encryption secrets (username, password) in the cloud

I'm building a multi-tenant (cloud) environment that needs to push out (or make available for download) configuration files for agents (background services) that receive this information. One of the ...
3
votes
2answers
849 views

How safe is a PGP private key that has “escaped”, but without its password?

Assuming your PGP private key is protected with a password, and it "escapes", but the password does not, how worried should you be? Obviously in the real world, you would immediately revoke the key ...
6
votes
1answer
204 views

public key distribution from a central server

I'm trying to code up a encrypted communication program. Originally I was thinking that I would use public key cryptography and then I would keep the public keys in a database where users could query ...
2
votes
1answer
2k views

Are very short messages secure using Public Key Encryption? [duplicate]

Say Alice publishes her public key and then disappears from public view. Bob then needs to send a message to her that's either "OK" or ":(" so he takes her public key, encrypts his message and then ...
12
votes
2answers
2k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
3
votes
2answers
496 views

Verifying the authenticity of a public key without manual intervention?

In RSA encryption it is said that ensuring the authenticity of the public key can be as important as the protection of the private key. An effective way of doing this is to have key custodians ...
5
votes
1answer
240 views

Design of system based on HTTPS, Client Certificates and custom CA

I have the following system: 2 application servers. At the beginning is installed the first server and later is installed the second one. A client access from a browser to both servers Application ...
2
votes
1answer
80 views

Remote network security option

I'm a bit confused with some different network security techniques. Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be ...
4
votes
1answer
425 views

PKI integration in MAC OS

I have setup an ejbca pki and integrated certificates in MAC OS for S/MIME signing and encrypting. I have also set up a CRL distribution point and put the CRL online available on an HTTP server. ...
16
votes
3answers
3k views

What happens when an Intermediate CA is revoked?

Currently I'm working on a certificate manager that allows our product to securely connect to remote webservices (over TLS/SSL). For security, we use Certificate Revocation List checking (or ...
5
votes
1answer
6k views

What is the difference between Key Escrow and a Recovery Agent?

From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later. But in the context of PKI, a Recovery Agent can also recover private keys. How ...