A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

2
votes
2answers
69 views

What's the mitigation strategy for when a CA's private key is stolen?

I'm new to SSL/TSL and was wondering if you could walk me through the following scenario. Scenario Let's say I am one of a thousand websites that has a certificate signed by some certificate ...
2
votes
1answer
69 views

X509Certificate - How to set validation Policies?

I have an X509Certificate (say Certificate-A) for signing purpose. While validating this certificate, I have to check its path with Intermediate & Root certificate which I have implemented fully. ...
3
votes
3answers
115 views

Trusting SSL and the Trust Chain

As we all know, when an SSL Certificate is assigned, there is a trust chain that is created for verify everyone from the Certificate Authority to the actual website's SSL Certificate. Thanks to a ...
2
votes
1answer
88 views

What should a client verify after getting a client certificate?

I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String. the String is then decoded to a x509Certificate (using Bouncycastle's ...
5
votes
3answers
4k views

How is an X509 certificate signer verified?

Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is, ...
0
votes
1answer
54 views

MITM protection, key distribution

I want to make sure each of my apps users only get their own data, and that nobody tampers with it or sniffs it in a MITM fashion. Encryption of everything should be the solution, right? But how do I ...
1
vote
2answers
62 views

determine X.509 certificate class

I am very familiar with OpenPGP but don't even use X.509 / S/MIME. I know that there are several classes for certificates (from email check to personal ID check). I would like to know how you ...
3
votes
1answer
61 views

What crypto prevents & detects “invisible” CAs? (e.g. in X509v4)

For this question, I'm calling an "invisible CA" one that Is signed by a root ca and exists as a 2nd or 3rd tier Is valid, not expired or revoked Has a different Public key than one that is ...
4
votes
3answers
399 views

From a trust perspective, is renewing a CA certificate the same as trusting a sub-CA?

I'm trying to understand the validation logic that would occur in the following hypothetical scenario An unpatched XP user who trusts a list of root CAs. Those CAs in particular have been renewed ...
2
votes
1answer
502 views

Using client certificates for website authentication

I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
3
votes
1answer
467 views

Open source solution to capture and decrypt SSH traffic (with private key)?

I am looking for a free open source solution that is able to capture and decrypt SSH traffic given the fact that I can provide the server's RSA private key (something like SSH CryptoAuditor). Please ...
1
vote
1answer
104 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
7
votes
4answers
3k views

What web browsers support OCSP stapling? Are the privacy and performance features the same?

OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
2
votes
1answer
110 views

How do I get a third-party-signed ssl client certificate?

I've been given a requirement of providing a client certificate to authenticate between two application's web services. The other application (that I don't host) is requiring an SSL client certificate ...
14
votes
5answers
3k views

Are self-signed certificates actually more secure than CA signed certificates now?

Are self-signed certificates actually more secure than CA signed certificates now? I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government ...
0
votes
3answers
70 views

Public key encryption vs Digital signatures

For same chunk of data, which one is faster? Public key encryption or digital signature? Confidentiality is not important. I am trying to achieve non-repudiation for the communication. Thanks!
-1
votes
2answers
103 views

Should I use more than 2048 bits in my SSH-2 RAS Key?

I've been asked to generate a public key with PuTTY Key Generator. The default is 2048 bits, Should I add additional bits to the generated key? Or is it unnecessary?
0
votes
1answer
434 views

x509 serial number - hex or decimal

When I run the openssl command openssl x509 -noout -text -in certname on different certs, on some I get a serial number which looks like this. Serial Number: 256 (0x100) On others, I get one ...
1
vote
0answers
58 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: ...
0
votes
0answers
91 views

Openssl command line: How to get “Policy: X509v3 Any Policy” in a certificate I am generating through openssl

I am trying to generate a certificate through openssl which has the following line X509v3 Certificate Policies: Policy: X509v3 Any Policy But I end up getting X509v3 Certificate Policies: ...
3
votes
2answers
119 views

What are Implicit and Explicit Certificates in Public Key Cryptography?

A Public key is certified by a Trusted Certifying authority, to ensure the integrity of the key and authenticity of the entity who claims to have the corresponding private key. In this Public Key ...
1
vote
1answer
69 views

what harm can a malicious ca do?

If ca's act in the interests of an eavesdropper, what is the worst they cold do? I guess they can decrypt traffic not using perfect forward secrecy and impersonate the server. Is this the case?
1
vote
2answers
72 views

Public e-mail Encryption Certificate

I'm quite new to this, so don't be too hard on me. I'm currently using the CipherMail MTA to generate e-mail encryption certificates. I created an own CA and public and private keys for our contact ...
1
vote
3answers
288 views

Is storing the private key and public keys in same directory on server recommended, like OwnCloud does?

Is this recommended or a good/normal practice? I think not. Because I saw that OwnCloud stores all encryption keys in one directory on the server. One directory contains the private key(s) and one all ...
1
vote
2answers
71 views

Risk in connecting wrong ssh host?

I've a ssh host key login setup in a remote server, for some reason, the DNS of that host is mapped to another server. So assume the mistaken host cannot be trusted, should I change my key?
1
vote
1answer
58 views

Trust on certificate authorities

If I as layman don't err, there are in banking controls, from both internal and national oversights, of the work done by the employees. These are apparently effective, since the details of ...
11
votes
3answers
9k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
2
votes
3answers
72 views

Are Extended Validation certificates any more secure than regular ones?

Or are they just an attempt to get you to pay more money to a CA because it tells your browser to show the address bar in green with your organization's name? Also, what are the technical details ...
0
votes
1answer
54 views

Is it possible to create a SMIME only PKI that *can't* be used for SSL?

Assume I have a Root CA that I want to share with hostile untrusted 3rd parties. Then constrain this root using specific EKUs at the root. OID=1.3.6.1.5.5.7.3.4 ; Secure Email Next, ...
1
vote
2answers
92 views

Authentication through digital certificates plus signature

While studying X.509 certificates, I've found that authentication is safer if I associate/combine one or more certificates with each signed message (certificate + signed message). The receiver of ...
15
votes
4answers
2k views

Is there any reason someone wouldn't use a longer key?

Larger key sizes are said to be more difficult to bruteforce; is there any reason someone would then decide to instead use a smaller key? Is there any negative effect in using a larger key size, such ...
1
vote
1answer
53 views

Resign root CA as SUB?

Imagine I have a Microsoft root offline ca running since half year, but suddenly I want to include it in my company hierarchy, resigning it with the company official root, But I need both continue ...
2
votes
3answers
171 views

Are there commercially available hardware encryption devices over USB? [closed]

I'm designing a system where some combination of hardware and software (lets call it an appliance...) sends asynchronous secure archival to the cloud. By secure, I mean, AES-256 encrypted, with AES ...
0
votes
1answer
265 views

ECC Public Key length differs from bit representation

A 256 Bit ECC key-pair (256 Bit is supposed to be the length of the public key) generated with OpenSSL using this command from the manual: openssl ecparam -name secp256k1 -genkey -noout -out key.pem ...
0
votes
0answers
25 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
1
vote
1answer
100 views

Certificate pinning in a browser

I am trying to understand certificate pinning. Google started adding a whitelist of CA certs that they use for their certificates and if a cert for a google service is issued outside of this list ...
2
votes
3answers
101 views

How are public key certificates updated securely?

Let's say I get a new computer that's never been connected to the internet before. The first time I connect it to the internet, is it susceptible to a mitm attack while downloading its public key ...
2
votes
2answers
215 views

Certificate authority structure - best practices

I'm working for a company that sells software products to customers some of which do not have the resources and/or know-how to build and maintain their own CA (used for the SSL communication of our ...
0
votes
2answers
93 views

Can I add a password to an existing private key?

Say I have previously created a private/public key combination, and decided at the time to not protect the private key with a password. If I later decide to "beef up" security and use a ...
6
votes
1answer
658 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
0
votes
3answers
117 views

Where do my keys come from for requests over SSL? [duplicate]

From what I understand, when you send information to a website over SSL, you encrypt the information you send with their public key. However, if you want to be able to decrypt the information they ...
3
votes
1answer
69 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
0
votes
1answer
236 views

Security weaknesses in using RSA encrypted MD5 hash of certificate content

Suppose you have an Internet banking site based on a secure web server running the HTTPS protocol via port 443. The server authenticates itself to clients through an X.509 certificate signed by a ...
1
vote
2answers
2k views

Public keys on OpenSSL vs PGP?

It is my understanding that PGP permits multiple public keys, and in SSL you can only extract one public key? Is this correct? Is there any brief high level run down between the two. I don't feel as ...
-2
votes
2answers
79 views

Could a network host and process programs while securing against piracy?

Consider an ideal service hosting network, which: Lets programmers: Publish a program in such a way that it can't be retrieved. Associate a program with a wallet. Specify a cost per request and ...
3
votes
3answers
104 views

What benefit is there to adding a password to your SSH key?

If you run the following command on a Linux/Unix machine, among other things, you get a prompt for a password: $ ssh-keygen -t dsa Enter passphrase (empty for no passphrase): What does adding a ...
3
votes
1answer
151 views

Clarification on Digital Certificates

I used the makecert tool to create: self-signed certificate client certificate These are the commands I used: makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
8
votes
2answers
329 views

Why is there no Domain CA?

I was asked to deliver a signed SSL certificate for an IIS server for a client. I have previously done this for the same client/domain before, so it start to seem like an unnecessary expense to hold ...
0
votes
0answers
35 views

Breaking public key pinning

I was reading through the IETF's Public Key Pinning Extension for HTTP (http://tools.ietf.org/html/draft-ietf-websec-key-pinning-12). The acknowledgements section has the following: Thanks to Trevor ...
0
votes
0answers
26 views

Looking for OpenSC compatibile token

I am currently proud user of Feitan ePass2003 with OpenSC, however it is not 100% reliable on Windows, on Linux it's just perfect. Anyway I started to looking and I have two candidates eToken Pro 64K ...