A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

0
votes
1answer
41 views

public key formats [closed]

I have the following PEM format public key: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDguwHaldTclMAFg1BQ45Q8DPIc ...
2
votes
2answers
70 views

Does an alternative approach to PKI technology exist?

Currently all of the network is using PKI standards and we are facing many problems. I don't mean every time and if new technologies arise we will also have to face the same, but for my curiosity. ...
1
vote
1answer
154 views

How do PGP keyservers synchronize the keys?

I want to know technical details about how public PGP keyservers synchronize the keys. If I send my key to one keyserver, how exactly does it "travel" to all the other ones? Who sends it to who and ...
4
votes
2answers
94 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
0
votes
1answer
75 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
1
vote
1answer
67 views

Why should I have my GPG key expire? [duplicate]

When creating a key pair using gpg it asks me for an expiration date: $ gpg --gen-key Please specify how long the key should be valid. 0 = key does not expire <n> = key expires ...
1
vote
3answers
64 views

Secure tunnel set up in an office environment

Suppose I am a rogue employee and I want to syphon some sensitive data out of the office and I only have office internet access for this. My office internet access needs to go through a proxy server, ...
0
votes
2answers
195 views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
2
votes
2answers
100 views

How can I create my own public certificate using openssl?

I have a public key/private key pair i generated using two primes p and q. I now need to use openssl to sign and create the certificate. I heard req utility and wrote this from the man pages. openssl ...
0
votes
0answers
16 views

why DH is unbreakable and what are the facts that leads to strong DH? [duplicate]

I am new to DH and learned the basic about DH working and suspecting it can be breakable by normal MIM , then how we can use DH in plain http for sharing secret. correct me if i am wrong.
0
votes
1answer
38 views

PKCS#12 File - security impacts when imported in Web Browser or Windows Store?

When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password. How does the browser or operating system manage this password? Is it secure?
4
votes
1answer
37 views

Mail Signing Certificate – What are the impacts when revocated?

Suppose I open a signed mail on 1st January 2000, signature is OK. What about this two cases : 1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
12
votes
1answer
844 views

Relationship between RSA, Diffie-Hellman Key Exchange, PKI and X.509?

I am getting confused with RSA, Diffie-Hellman Key Exchange, PKI and X.509v3. I took a look of RSA's mathematics algorithm, it seems like a encryption algorithm, right? Generating public key and ...
0
votes
1answer
259 views

Sign PKCS#7 and verify PKCS#7 signature with OpenSSL

If someone have to transfer X.509 certificates in a single bundle, usually, it is recommended to pack them into PKCS#7. And content of PKCS#7 can be signed. OpenSSL allows to pack certificates into ...
4
votes
2answers
125 views

Verify digital signature without key public key in signature

When receiving emails, I sometimes see the following: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I found an integer overflow in PHP, in the conversation of dates to "Julian Day Count" function. ...
1
vote
1answer
43 views

Does SSL/TLS have the feasibility of detecting malicious things during transmission? [closed]

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly ...
1
vote
1answer
36 views

Can a PKCS12 file be distributed over insecure channel?

Is the PKCS12 only as secure as the password protecting private keys ? Can I distribute the p12 file over an insecure channel ?
4
votes
3answers
117 views

How can I create a unique identifier that can not easily be reversed?

I've been working on the design of a longitudinal study and one requirement is: all participants will have a unique identifier that is not reversible from the data storage/analyst side of the study ...
0
votes
1answer
146 views

PGP Key publishing on MIT PGP Public Key Server [duplicate]

I have a public pgp key, so that users can send me an encrypted message. Ofcourse, any user that wants to send me a message, wants to verify that the public key (s)he has, really belongs to me. From ...
0
votes
1answer
110 views

Two-factor encryption model [closed]

Please some on help me to understand this "Are you ready for this? With the two-factor encryption model your data is protected two-fold. First, a unique key is generated, encrypted, and turned into ...
2
votes
1answer
196 views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...
0
votes
1answer
90 views

Compromised submarine cables and the consequences to internet?

I recently read an article that Google wants to build a submarine cable connecting to my country supposedly to increase overall speed and while I hope my government will never allow this kind of thing ...
1
vote
0answers
32 views

Security schemes regularly in use on cloud

I've been looking into how connections are managed in the cloud, in order to better understand the threats users and their deployments may face. The most important and common ones in use seem to be ...
-1
votes
2answers
152 views

How do openvpn/easy-rsa generated keys map to RSA algorithm variables?

I was reading up a little on openvpn and pki infra and am confused by some of the questions posed by my colleague. :) This answer did help me understand more: ...
0
votes
1answer
16 views

Web of Trust: What is “signatory trust”?

I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust. What is an easily understandable definition of signatory trust? An ...
4
votes
1answer
130 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of ...
2
votes
1answer
28 views

Is there a way of achieving perfect forward security with one directional messages?

Using for example ECDH and ephimeral keys, it is possible for two parties to establish a shared key with perfect forward security, i.e. even if the long term keys are lost, it will not be possible to ...
3
votes
1answer
55 views

Installing a CA only for specific domains

For many reasons, it's often convenient for organizations to have their own CA (self-signed or otherwise). As I understand it, adding the CA certificate to a OS or browser will make it trust the ...
3
votes
1answer
65 views

What encryption and signature systems (don't?) allow for plausible deniability of the OP's key being used?

I need to prevent Mallory from blindly matching encryption and signing keys to messages Hypothetical scenario: A user creates a public key An encrypted or signed payload exists. With only public ...
1
vote
0answers
86 views

Distribute S/MIME public keys and CA cert for email security

I have my own CA. I want to distribute S/MIME certificates for 10 different users. I saw S/MIME keyservers from http://wiki.cacert.org/KeyServers, but I don't want to use public servers. What is the ...
2
votes
1answer
71 views

Smartcard - main differences between .NET and Java smartcard?

My question focuses on the differences regarding PKCS11 implementation between a .Net and a Java smartcard. More generally, do smartcard use a specific "OS" (or firmware) and only differ in the ...
1
vote
1answer
44 views

Banking card certificate

Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ? Perhaps a standard exists or a de-facto ...
3
votes
1answer
91 views

PKI - Why Root CA is in intermediate CA section?

I can't understand why, when I accept to "install" a custom self signed Root CA on IE browser, the root certificate ends up in the "intermediate CA" section, rather than in "Root CA" section in the ...
6
votes
1answer
204 views

Should I install my subordinate Certificate Authority on the domain controller? Why?

I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a ...
1
vote
3answers
94 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
49
votes
1answer
3k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
11
votes
1answer
230 views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
1
vote
0answers
42 views

Use of RSA in Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...
0
votes
2answers
92 views

SHA1 - S/MIME and CRL validity after deprecation?

In an internal PKI using SHA1 for hashing, will S/MIME signature and CRL/ARL signature be considered invalid in the next few years (SHA1 Deprecation) ? End certificates can be revoked, CA ...
0
votes
0answers
70 views

How should I organize my keys?

Suppose I have a set of computers with variegate level of trust (for example): I fully trust my own desktop pc at home I trust a bit also my smartphone, but I know it could be stolen I trust a bit ...
0
votes
0answers
56 views

Is ADCS overkill just to replace self-signed certs?

Several of our internal applications are either not using SSL certificates, or are using self-signed certificates. I wanted to utilize ADCS to create a trusted, internal-only root CA that our browsers ...
13
votes
2answers
1k views

Does it matter which key is considered private and which public?

Mathematically, is there a difference which set of characters is private_key and which one is public_key? @Edit At the moment of asking I was thinking on RSA, not asymmetric crypto in general.
0
votes
2answers
61 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
0
votes
2answers
73 views

Subordinate Certification Authorities and managed certificates

How many different certificates can a subordinate certification authority manage? Please, supply me also some reference. Thanks
0
votes
2answers
353 views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
0
votes
1answer
102 views

PKI - Security concerns when changing a certificate hash algorithm

Suppose I want to change the hash algorithm used for a certificate signature (ex: SHA1 to SHA2). Is it better to revoke the previous certificate and issue a new one with expected hash algorithm ? Or ...
2
votes
1answer
109 views

Why can't I upload a new ECC key to key servers, which is supported by GnuPG 2.1?

My OpenPGP key is soon to expire so I wanted to create a new one. GPG 2.1 came out a month ago including ECC support and I wanted to try the new key types. So I have generated a brand new ed25519 ...
3
votes
3answers
245 views

Corporate PKI - SHA1 deprecation

Here is the context. Suppose you have a corporate PKI with : AC_Root (offline in safe store - SHA1 signature) SubRootA and SubrootB (offline in safe store - SHA1 signature) SubSubRootC, SubSubRootD, ...
1
vote
1answer
52 views

Definitions of PKCS#11 abbreviations

Is there a complete definition list for all CKx abbreviations in PKCS#11? I believe I gathered most of them: CK = Cryptoki CKA = ... Attribute CKC = ... Certificate type CKD = ... Key derivation ...
2
votes
3answers
89 views

Email Encryption

I'm hoping someone can point me in the right direction. If I wanted to implement email encryption within an organisation what would be the best way? I've been searching the web tonight but all my ...