A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

3
votes
1answer
7k views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
1
vote
1answer
2k views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
1answer
34 views

Is there any benefit to providing multiple types of public keys?

Say I have a page on my website which lists public keys to be used in case people would either allow me access to a server, or send me encrypted information. Is there any benefit to me providing ...
0
votes
2answers
86 views

Typical mistakes when implementing digital signatures?

I am looking for a list of typical mistakes someone can make when implementing digital signatures for a software. And of course why they are mistakes and how an attacker could take advantage of them. ...
0
votes
0answers
72 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
1
vote
1answer
97 views

Self-signing client certificates and distributing them, is the following a sound procedure?

I have a case at hand as follows: There is a number of clients in Internet (i.e. untrusted channel), initially in hundreds but growing in numbers. There is a server doing processing related to these ...
0
votes
3answers
93 views

Digital Signature and man-in-the-middle

While reading this page about Public-Private key encryption, I asked myself a question about digital signature: Alice wants to sign a message for Bob; she uses her private key to sign the message. ...
1
vote
0answers
174 views

If even Apple cannot properly install certificate [closed]

I've just installed a new copy of Mozilla Firefox/29.0 SeaMonkey/2.26.1 on a new Mac with OS X 10.9.4, and I'm getting an error message in place of a webpage when trying to access ...
1
vote
1answer
197 views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
0
votes
4answers
208 views

Using a Public-Key-Encryption browser side to avoid PCI compliance

We're developing a web application in which certain not logged users (clients) need to send their credit card details to other users (merchants) - which, we'll assume, are PCI compliant. We are ...
1
vote
2answers
70 views

Is there a secret-sharing public-key-encryption-based service? [closed]

I need to share some sensitive information with someone else who can only communicate via E-mail. I don't love the idea of sharing this information freely over email in plain text, so I was ...
3
votes
2answers
322 views

Export non-extractable private key from Keychain on OS X

I have a PKI certificate in Keychain Access.app on OS X 10.9, together with the private key. The manual page for /usr/bin/security indicates that there is a -x option for security import to specify ...
0
votes
1answer
59 views

Is it possible to distinguish between a SHA256 hash and an ecc256 key?

If an attacker were just given 256 bits, and they were either a SHA256 hash or a 256 bit elliptic curve key, would they be able to tell which one it is? Just out of curiosity, would they be able to ...
7
votes
2answers
376 views

How can we revoke all ssl certificates issued for our domain?

After having the hostmaster@domain.com email compromised, we found that someone issued a Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked. Is there ...
0
votes
1answer
83 views

How can I generate some public and private keys on both sides with low overhead?

We have an Authority Center (CA) generating some public and private keys for each client (more than one pair for each client). One method for sending keys to client is sharing a secret key between CA ...
0
votes
0answers
41 views

Secure access of web application on a newly created AWS instance using the associated keypair

I create an AWS instance using a private AMI (Linux) with an embedded web application (Jetty) which is activated on instance start. As soon as the instance is launched first time, I want the ...
0
votes
2answers
78 views

Encryption mechanism

I want to send data over the Internet securely. For that, I am using an public key of the receiver to encrypt the data. In this case, if an intruder in the network modifies the data, like placing the ...
1
vote
1answer
111 views

How to safely renew user and CA certificates in a PKI

I am currently developing my own PKI where x.509-client-certificates are issued by a public server. At the moment, the CA-public key is distributed with the binary and there are no routines for ...
3
votes
0answers
48 views

What's stopping DANE? [closed]

As I understand it, DANE (RFC 6698) is a promising candidate for addressing issues with current TLS Trust Anchors (i.e. Trust Anchors). My attempt at explaining the issue: Currently, CAs are ...
2
votes
2answers
69 views

What's the mitigation strategy for when a CA's private key is stolen?

I'm new to SSL/TSL and was wondering if you could walk me through the following scenario. Scenario Let's say I am one of a thousand websites that has a certificate signed by some certificate ...
2
votes
1answer
73 views

Is there any mechanism to audit which signed certificates are unrevoked?

We are currently using EasyRSA and OpenSSL to manage our user VPN certificates for OpenVPN. The process we have in place currently is: User generates a CSR on their laptop and sends it to us to sign ...
2
votes
2answers
93 views

Client Authentication Certificate Not Expiring, but “parent” cert IS

So I have a client-authencation cert installed on client PCs, which doesn't expire for 5 more years. Unfortunately, the cert on our gateway which is used to validate the client cert, expires this ...
3
votes
3answers
115 views

Trusting SSL and the Trust Chain

As we all know, when an SSL Certificate is assigned, there is a trust chain that is created for verify everyone from the Certificate Authority to the actual website's SSL Certificate. Thanks to a ...
3
votes
2answers
146 views

How to prove flyer was (not) authored by specific person?

Let's say we create a flyer in some desktop publishing software (e.g., InDesign, Illustrator), physically print it and post it somewhere. We don't want inauthentic claims of authorship. Is there a ...
2
votes
1answer
87 views

What should a client verify after getting a client certificate?

I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String. the String is then decoded to a x509Certificate (using Bouncycastle's ...
3
votes
1answer
61 views

What crypto prevents & detects “invisible” CAs? (e.g. in X509v4)

For this question, I'm calling an "invisible CA" one that Is signed by a root ca and exists as a 2nd or 3rd tier Is valid, not expired or revoked Has a different Public key than one that is ...
1
vote
2answers
62 views

determine X.509 certificate class

I am very familiar with OpenPGP but don't even use X.509 / S/MIME. I know that there are several classes for certificates (from email check to personal ID check). I would like to know how you ...
0
votes
1answer
54 views

MITM protection, key distribution

I want to make sure each of my apps users only get their own data, and that nobody tampers with it or sniffs it in a MITM fashion. Encryption of everything should be the solution, right? But how do I ...
0
votes
2answers
65 views

How to encode a username in PKIX certificate?

I was reading through RFC 5280, PKIX Certificate and CRL Profile, Section 4.2.1.6, Subject Alternative Name: The subject alternative name extension allows identities to be bound to the subject ...
1
vote
1answer
103 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
2
votes
1answer
214 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
1
vote
4answers
85 views

Data anonymization/ encryption requirement

I did check out the previous postings and didnt find what I was looking for- apologies if this is a repetition. I am working on an analytics engagement for a customer and he needs to share access to ...
0
votes
2answers
63 views

Temporarily suspending a Certificate Authority's Certiticate

The PKI RFC talks about revoking or suspending certificates. It also talks about revoking CA certs. However, I could not find anything about whether a CA or a Sub CA's certificates can be revoked or ...
2
votes
1answer
110 views

How do I get a third-party-signed ssl client certificate?

I've been given a requirement of providing a client certificate to authenticate between two application's web services. The other application (that I don't host) is requiring an SSL client certificate ...
-1
votes
2answers
103 views

Should I use more than 2048 bits in my SSH-2 RAS Key?

I've been asked to generate a public key with PuTTY Key Generator. The default is 2048 bits, Should I add additional bits to the generated key? Or is it unnecessary?
4
votes
3answers
391 views

From a trust perspective, is renewing a CA certificate the same as trusting a sub-CA?

I'm trying to understand the validation logic that would occur in the following hypothetical scenario An unpatched XP user who trusts a list of root CAs. Those CAs in particular have been renewed ...
0
votes
3answers
70 views

Public key encryption vs Digital signatures

For same chunk of data, which one is faster? Public key encryption or digital signature? Confidentiality is not important. I am trying to achieve non-repudiation for the communication. Thanks!
0
votes
1answer
92 views

OpenTSA and PKCS11

We are planning to implement the time-stamping service(RFC 3161) using OpenTSA wanted to know If OpenTSA supports PKCS-11 (Cryptoki) to talk to HSMs? BTW: I did not find documentation or much ...
0
votes
1answer
431 views

x509 serial number - hex or decimal

When I run the openssl command openssl x509 -noout -text -in certname on different certs, on some I get a serial number which looks like this. Serial Number: 256 (0x100) On others, I get one ...
1
vote
0answers
58 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: ...
0
votes
0answers
90 views

Openssl command line: How to get “Policy: X509v3 Any Policy” in a certificate I am generating through openssl

I am trying to generate a certificate through openssl which has the following line X509v3 Certificate Policies: Policy: X509v3 Any Policy But I end up getting X509v3 Certificate Policies: ...
2
votes
1answer
656 views

adding certificate that resides on smartcard to the microsoft store with private key ownership

how can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? in an enrollment system where users generate smartcard certificate ...
1
vote
1answer
69 views

what harm can a malicious ca do?

If ca's act in the interests of an eavesdropper, what is the worst they cold do? I guess they can decrypt traffic not using perfect forward secrecy and impersonate the server. Is this the case?
1
vote
2answers
72 views

Public e-mail Encryption Certificate

I'm quite new to this, so don't be too hard on me. I'm currently using the CipherMail MTA to generate e-mail encryption certificates. I created an own CA and public and private keys for our contact ...
1
vote
2answers
71 views

Risk in connecting wrong ssh host?

I've a ssh host key login setup in a remote server, for some reason, the DNS of that host is mapped to another server. So assume the mistaken host cannot be trusted, should I change my key?
1
vote
3answers
284 views

Is storing the private key and public keys in same directory on server recommended, like OwnCloud does?

Is this recommended or a good/normal practice? I think not. Because I saw that OwnCloud stores all encryption keys in one directory on the server. One directory contains the private key(s) and one all ...
1
vote
1answer
58 views

Trust on certificate authorities

If I as layman don't err, there are in banking controls, from both internal and national oversights, of the work done by the employees. These are apparently effective, since the details of ...
2
votes
3answers
72 views

Are Extended Validation certificates any more secure than regular ones?

Or are they just an attempt to get you to pay more money to a CA because it tells your browser to show the address bar in green with your organization's name? Also, what are the technical details ...
0
votes
1answer
53 views

Is it possible to create a SMIME only PKI that *can't* be used for SSL?

Assume I have a Root CA that I want to share with hostile untrusted 3rd parties. Then constrain this root using specific EKUs at the root. OID=1.3.6.1.5.5.7.3.4 ; Secure Email Next, ...
1
vote
3answers
102 views

What is the web of trust?

I'm studying network and system security and I came across the phrase "web of trust". From Wikipedia: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other ...