A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...
4
votes
4answers
505 views
Why would someone want to encrypt RSS feeds?
I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
3
votes
2answers
241 views
Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?
Suppose I have several independent PKIs that are used
Two internal PKIs: One with SHA1 support the other with Suite B algorithms.
A partner who I trust and have a policy map with.
Since both my ...
2
votes
1answer
241 views
What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?
I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance.
For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
24
votes
3answers
813 views
A Different Approach to PKI
After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
1
vote
2answers
193 views
Difference between Encryption and Verification certificate
What is the difference between the Encryption certificate and Verification certificate in Outlook? When exchanging certs, it just requires a digitally-signed message to be sent. It seems as though ...
1
vote
1answer
133 views
How do I verify, parse and process the results of the HTML5 keygen tag?
I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST:
...
4
votes
1answer
90 views
Share or not share public key for servers?
In order to encrypt communications from our (custom) client to our (custom) servers our current scheme is a bit like this:
Client uses the bundled public key A to encrypt some random key material.
...
3
votes
1answer
157 views
What are the best practices for RSA-based security?
I'm building a platform with a strong security. Security is based on encrypting data with AES-256 encryption. Yet the system needs to "share" these keys among the users and they need to be transferred ...
1
vote
2answers
196 views
Self-signed certificates usage for code signing purposes
if a self-signed certificate is trusted by the client's certificate store, then it should be fine to be used, since the client trusts the issuer of the certificate as it does any other trusted CA ...
2
votes
3answers
200 views
Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”
Maybe this is a superuser.com question, I don't know.
Anyway, I want my cert to show up like this when I double click on it in Windows:
If I just double click on a random cert I get this:
The ...
1
vote
5answers
711 views
how to import a private key in windows
Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys?
Is the only way I can do that by converting both ...
11
votes
2answers
471 views
Which SSH security is stronger? 2 Factor or Public key
For SSH authentication, which is more secure?
2 Factor Authentication using a USB token/Google Authenticator(time based)
OR
Public/private key with password
Or could they be both used at the same ...
-1
votes
4answers
232 views
Does a renewed certificate open old messages?
I have a digital certificate that I use to exchange messages with peers, my certificate expiration date is due next year, suppose I renew this certificate before it expires, will I be able to open the ...
3
votes
1answer
71 views
What physical, electronic, and software characteristics are important in a smart card?
I'm evaluating smart card readers to store a number of private keys, but don't know where to start.
What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
2
votes
1answer
76 views
how does OpenSSL create X.509 certs from SPKACs?
The SPKAC ASN.1 description:
PublicKeyAndChallenge ::= SEQUENCE {
spki SubjectPublicKeyInfo,
challenge IA5STRING
}
SignedPublicKeyAndChallenge ::= SEQUENCE {
publicKeyAndChallenge ...
1
vote
1answer
67 views
spkac: what is the purpose of the challenge string?
The SPKAC ASN.1 description:
PublicKeyAndChallenge ::= SEQUENCE {
spki SubjectPublicKeyInfo,
challenge IA5STRING
}
SignedPublicKeyAndChallenge ::= SEQUENCE {
publicKeyAndChallenge ...
0
votes
0answers
81 views
What McEliece key size can provide standard security today? [closed]
i don't wanna use RSA because it will be plaintext very soon but we can't stop using internet to send private data.
Does McEliece cryptosystem provide security today ?
What McEliece key size is ...
3
votes
2answers
164 views
What did the certificate authority do with my CSR?
I needed to reach a web service which is not mine.
The IT department of that web service has asked me to send them a CSR (certificate signing request).
Then, he will send me back a signed certificate ...
4
votes
3answers
273 views
What issues arise from sharing a SSL certificate's private key?
Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website.
I have ...
2
votes
2answers
277 views
What hardware technology (GPU, FPGA) is fastest at generating RSA keys?
I'm interested in generating RSA keys in rapid succession and am looking for the correct hardware to so. I think what I'm looking for is very similar to a brute force attack on RSA keys, but my ...
1
vote
4answers
169 views
RSA and encrypted authentication
Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication ...
2
votes
3answers
142 views
Given a large enough sampling of public keys could one begin to identify a private key?
For example, an ISP or government capable of tracking millions of keys being exchanged. Would that provide a sample large enough to be able to identify the private key on either end?
0
votes
0answers
32 views
Source(s) for getting listed vulnerabilities? [closed]
As I know cve.mitre.org, is one major source from which we can get to know all the listed vulnerabilities (new and old).
Are there any other such sites or databases available?
Also, if I want ...
117
votes
7answers
6k views
How do certification authorities store their private root keys?
Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
5
votes
4answers
166 views
Securely publishing GPG keys
This is probably a stupid question/vaguely defined, but I need to ask it anyway.
I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
1
vote
1answer
86 views
signatureAlgorithm vs. tbsCertificate -> signature
From the X.509 RFC:
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
TBSCertificate ::= ...
3
votes
1answer
96 views
Can we use a public key scheme for performing cryptographic commitment
Is it possible to use a public key scheme such as DSA as a commitment scheme? Are there any problems with doing this?
3
votes
3answers
173 views
Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?
It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
-1
votes
1answer
66 views
XER encoded X.509 certs [closed]
Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it?
Thanks!
2
votes
3answers
202 views
Public key Infrastructure
Here the MD5 hash is being encrypted with the private key of the sender. But I read in a paper that private key is only used for signing and not encrypting. Is the image wrong or can private key ...
5
votes
2answers
110 views
How can a certificate be valid in the Hybrid Model but not in the Chain Model?
All dates in European format!
I am learning about validity models, but the solution for this assignment confuses me.
Translation:
The relevant data for the applicable certificates are shown ...
1
vote
1answer
83 views
How are root CAs for SSL distributed?
For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser.
But what about for firefox and chrome?
...
0
votes
0answers
115 views
Encryption in Messaging/RAbbitMQ/SOA [closed]
I'm a student and now 2nd time poster, please excuse any lacking detail on my part.
For my exams I'm doing a cross-platorm application using RabbitMQ for messaging. It'll serve as POC for both SOA ...
4
votes
1answer
478 views
AIA/CRL locations for Offline Root
I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building
It's an ...
3
votes
3answers
453 views
How to distribute client certificates without exposing private key?
I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication.
I'm ...
2
votes
2answers
148 views
distribution mechanisms for CRLs
From the X.509 RFC:
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer ...
4
votes
1answer
158 views
where to download revoked certificates from
I don't want the certificate revocation lists - I want actual full on revoked certificates for test purposes.
For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and ...
2
votes
2answers
311 views
Key Exchange using PKI
I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl
openssl req -x509 -nodes ...
11
votes
4answers
403 views
What alternatives are there to the existing Certificate Authority system for SSL?
Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
-3
votes
1answer
89 views
How to distribute public keys in the network without losing its credibility? [closed]
How to solve the key distribution encrypted with the public key?
How to make public key authentication? How to distribute public keys in the network without losing its credibility?
1
vote
2answers
94 views
Certificate Security in intranet Environment?
We have this topology in our company :
A new rule says that each document being sent by outlook should be encrypted.
we decided using PGP.
We already have a certificate ( self signed).
the ...
4
votes
1answer
112 views
Is OpenPGP encryption a valid replacement for SSL when passing messages?
I am writing an application that occasionally needs to transmit larger messages to other servers on the internet without allowing people to snoop on the traffic. The normal way to handle this is to ...
8
votes
2answers
279 views
Is it okay to widely share the RSA key fingerprint for a host?
When you ssh into a remote box for the first time or if the remote host's key fingerprint has changed (from what's stored in your known_hosts file) you get a warning and you are shown the fingerprint ...
5
votes
1answer
179 views
Which attributes of a X509v3 certificate are never really used?
Are there any extensions/extended key usage attributes of a X.509Certificate that are rarely or never used in practice?
Either due to never being part of an issued certificate or because they are ...
8
votes
2answers
605 views
Are there really functioning quantum computers?
I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
3
votes
1answer
152 views
What are the Netscape Cert Type attributes? Why/when are they needed?
What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions?
Example:
There is the Client/Server Extended Key Usage (X.509) but there is ...
1
vote
1answer
240 views
Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
I'm confused by the difference in behavior of ssh clients I'm seeing on two different hosts. Just to be clear, this is the scenario:
"macbox" OS X using OpenSSH_5.2p1 ssh client
"sunbox" Solaris 10 ...
2
votes
2answers
258 views
Revoked certificate validation using past times
I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past.
Unfortunately I have problems verifying revoked ...
4
votes
3answers
90 views
Can the root of a system access to unencrypted data when using a double tunnel?
I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C).
A-->B-->C
I created a ssh tunnel from A to B and forwarding the port 22 ...
1
vote
0answers
131 views
Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]
I have installed openssl and now the rsa_test.c is running fine. What I want to do is:
Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey.
The public key contains the ...
