A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

4
votes
3answers
897 views

How to secure a truecrypt container allowing access with multiple SSH public keys?

I would like to create a TrueCrypt container which can be accessed by multiple people. The container itself can be stored anywhere, e.g. in a shared folder in Dropbox or Google Drive, ... I would ...
2
votes
1answer
64 views

Correct way of signing and verifying a message

I have an object which I need to transmit to clients and I need the clients to know that I actually created the object. Obviously, this process involves in me signing the object with my private key, ...
1
vote
2answers
42 views

What exactly does `ssh -T user@domain verify` do?

The example I'm specifically thinking of is: ssh -T git@github.com verify Looking at the docs (man ssh) I can see that -T is the flag to "Disable pseudo-terminal allocation", but what implications ...
2
votes
2answers
154 views

Is there any mechanism to audit which signed certificates are unrevoked?

We are currently using EasyRSA and OpenSSL to manage our user VPN certificates for OpenVPN. The process we have in place currently is: User generates a CSR on their laptop and sends it to us to sign ...
1
vote
1answer
64 views

How does letsencrypt's ACME work?

I found the technical paper on ACME's inner workings, but I still feel a bit confused about the ways Let's encrypt's Domain Validation works. From what I already know, verification can be performed ...
0
votes
0answers
27 views

PKI, one sub CA for each certificate type VS one for all the certificates type

I'm trying to set a PKI where I can find 3 types of certificates: A client certificate to use in HTTPS communications A web server certificate to use in HTTPS communication A VPN certificate to use ...
607
votes
3answers
315k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the ...
1
vote
2answers
48 views

PGP Key Signing Robot DKIM Verified Emails

It occurred to me that DKIM verified emails, from major players (e.g., GMail), could open the door to more modern OpenPGP robot key signing authorities. The idea would be to ask people to send a key ...
1
vote
1answer
21 views

Prevent credential roaming for certain accounts/certificates?

I want to use credential roaming in Windows 7, 8 and 10 for EFS certificates, so users can access their encrypted files from any computer they login to. However, some of these users will also have ...
12
votes
1answer
449 views

How secure is “Let's Encrypt”?

I just configured and installed a free SSL certificate from Let's Encrypt. It's great, and very easy to set up. However in this post-Snowden era, I was wondering how secure this really is. For ...
1
vote
1answer
25 views

Certificate binary matching

Is it an industry practice to do a binary matching of client public certificate when doing SSL with client authentication? I was thinking that if the client can successfully do the SSL handshake, ...
5
votes
3answers
6k views

Extracting the PGP keyid from the public key file

Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block? I found the hexa value of the key in the binary file, but I guess the position is based on ...
5
votes
1answer
771 views

What is the “PGP Global Directory Verification Key”?

In the server keys of the MIT, there is several signatures from "PGP Global Directory Verification Key". Example (from http://pgp.mit.edu/pks/lookup?op=vindex&search=0xB63024F96C73DA99): sig ...
1
vote
2answers
53 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
2
votes
1answer
285 views

Do SSH private keys always contain enough information to derive a public key?

I am working on a persistence model for SSH Private keys. The technology used is Java. Since the persistence structure of the public and private keys is pretty similar and using some of the Java APIs ...
2
votes
0answers
120 views

What are the use-cases for Hashicorp Vault PKI?

Hashicorp Vault has facility to auto generate server/client cert for authentication. https://vaultproject.io/docs/secrets/pki/index.html While it makes sense from certificate management point of ...
1
vote
1answer
65 views

Is it safe to publish my development private key?

For my development environment, the following three SSL files allow me to access my application from https://localhost on my local machine. Private key: server.key Certificate signing request: ...
0
votes
1answer
67 views

Generate RSA2 key in OpenSSH format in windows

I have to generate a key, RSA v2 in OpenSSH format. I am a bit confused. I am trying to generate it using Putty key generator. There I see an option SSH2-RSA and SSH1-RSA. So is SSH2-RSA the RSA2 key ...
20
votes
5answers
5k views

When can I commit a Private Key to source control?

That is to say, in what cases does it make sense to commit an unencrypted keypair to internal source control like SVN or Git? Related question that discusses an encrypted private key: Is it bad ...
0
votes
0answers
43 views

Mysql SSL handshake: symmetric key exchange with CA or server key?

I have my MySQL database set up to require server and client identify verification, with both presenting their certificates signed by the same CA (mysql user was set up with 'require X509'). ...
2
votes
2answers
654 views

OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys

The company I work for has a few OpenVPN servers used by over 200 employees. The servers were deployed a few years ago using the default easyrsa settings and now we want to upgrade to stronger ...
2
votes
3answers
304 views

Should I use more than 2048 bits in my SSH-2 RSA Key?

I've been asked to generate a public key with PuTTY key generator. The default is 2048 bits, should I add additional bits to the generated key? Or is it unnecessary?
1
vote
1answer
80 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
1
vote
3answers
238 views

Using a stolen certificate on a server

Yesterday I asked the following question regarding what would happen if you placed a stolen certificate on your own server and edited the 'host' file so that the DNS name matched: Could a stolen ...
6
votes
2answers
545 views

Could a stolen certificate show as trusted?

I have recently started learning about PKI and have the following question/s. As far as I know a signed certificate contains the domain name of the server that the certificate will be placed upon. ...
0
votes
2answers
61 views

Public key - private key question

I have a query about public/private key encryption that I hope someone can answer. So as I understand it: Client connects to server and server responds with certificate Client pulls the public key ...
9
votes
3answers
1k views

Why is the subject's public key not used for encryption in SSL? [duplicate]

As far as I understand the workings of SSL - the client generates the pre-master secret and sends it to the server encrypted using the server's public key. Now, both parties perform some steps to ...
-2
votes
3answers
36 views

Changing public key of someone to read and change messages that are encrypted to him

If I am able to change someone's public key, is it possible to alter the key to later read and change his encrypted messages in an easy way? Just remember I don't have his private key.
5
votes
1answer
105 views

SSL certification path building

Background Some SSL certificates have two certification paths. In other words: the trust-chain can take two paths. I installed all the certificates for one path but that gave an HTTPS error on some ...
0
votes
3answers
171 views

Transmitting private keys between devices? [duplicate]

I have an app where a users' device create a public/private key and all communication to this user is done by encrypting against their public key, which is stored on a server and sent to other clients ...
3
votes
1answer
37 views

Two-tier PKI without OCSP?

I am currently in the planning phase of a two tier Windows PKI using this deployment guide, and I am stuck concerning the use of OCSP and the online responder role of ADCS. The guide mandates that ...
9
votes
2answers
349 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
1
vote
0answers
14 views

Partially Valid PKI certificate--But still we are able to login to our Application [closed]

User having a PKI card with an invalid PKI certificate (Among the two PKI certificates – One certificate is revoked (Damaged/ officially Cancelled) and another certificate is active)and try to login ...
4
votes
1answer
81 views

My OpenPGP private keys are set up with sub-keys. What happens if I revoke a sub-key and re-issue a new one?

I have set up my OpenPGP keys with sub-keys, following the general instructions laid out in "Creating the perfect GPG keypair." The general gist is that you create a "master keypair" which is not ...
2
votes
2answers
55 views

How does Certificate Transparance detect fake or forked logs?

I am trying to understand Certificate Transparency. Let's say I want to snoop on somebody's email. So I go hack or bribe a CA, have them issue a certificate for google.com, and then I present it when ...
1
vote
3answers
136 views

Does SSL/TLS provides non-repudiation service?

I understand that SSL/TLS provides confidentiality and integrity. But does it provide non-repudiation? I read in one book it does not. But I wonder why? What does it mean? If it means Alice can ...
-1
votes
2answers
484 views

How do openvpn/easy-rsa generated keys map to RSA algorithm variables?

I was reading up a little on openvpn and pki infra and am confused by some of the questions posed by my colleague. :) This answer did help me understand more: ...
-1
votes
1answer
78 views

Why are pgp keys limited to a number of bits?

I am wondering : why does pgp keys have a fixed number of bits. They can be 2048,4096, but why not 56000 or 23 bits ? Is there a specification, or ISO, that was made to limit thoses Keys. Why? If a ...
0
votes
2answers
105 views

Where are certificates used to prove identity and why aren't DNS responsible for the job?

I've been reading about how certificates are used to verify the owner of a public key in asymmetric encryption. Right now everything seems really theoretical to me and I'd like to know how this works ...
3
votes
2answers
66 views

Is it possible to protect a DER private key with a password?

I want to write an API, based on OpenSSL, that can convert an RSA private key stored as DER to the PEM format. I'm just wondering if a DER key can be password-protected. I've searched the OpenSSL ...
4
votes
2answers
3k views

Recommended key usage for a client certificate

My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicates with the server to a path that requires a ...
50
votes
4answers
5k views

Can I sign a single character message with the RSA private key?

If I sign a very short message (0 or 1) with my private key (and the receiving side verifies the signature using public key), is this less secure than to send the sufficiently long signed message?
4
votes
0answers
120 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
5
votes
2answers
74 views

Data Integrity in PKCs

This is a simple question but one which greatly confuses me. When you have a PKC, the public key can be accessed by anyone. Therefore, doesn't this mean that anyone can encrypt data? My question is ...
2
votes
2answers
56 views

What problem does PKI fix; how would someone “lie about their identity”? [duplicate]

What does having a certificate issued by a Content Authority protect against? In everything I've red (and watched) they teach it as "you are given the public key to communicate with Alice, but how do ...
0
votes
1answer
93 views

Reliability of Certificate Authorities and Certificates in 2015

I just happened to stumble upon this Article in Netcraft. The article claims that many of the major CAs have given out hundreds of Certificates to false organizations. Are there any truth to these ...
3
votes
1answer
70 views

What would happen if a public key server is compromised?

What would happen if in someway a public key server, let's say the MIT PGP key server, was compromised and some keys would be edited to an attacker's public key? Is this even possible? Would that be ...
12
votes
4answers
27k views

how to import a private key in windows

Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys? Is the only way I can do that by converting both ...
3
votes
1answer
91 views

Understanding the signing and verification process through a CA

I have been researching on this topic and I need to understand the exact signing and verification process when made through a trusted CA. From what I understand, this is how it works at a very high ...
3
votes
0answers
111 views

What is the openssl equivalent of using java's KeyPairGenerator?

I have been using java's KeyPairGenerator in order to generate public/private keys within a program so that I can encrypt and decrypt files(also using java encrypt/decrypt methods). I want to be able ...