A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

4
votes
2answers
94 views

Why is openssl key length different from specified bytes

I realize this is rudimentary question, but I can't seem to even google diagnose it. Why is openssl key length different from specified bytes? For example when I use the command: openssl genrsa -out ...
2
votes
1answer
2k views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
4
votes
2answers
428 views

Where to download revoked certificates from?

I don't want the certificate revocation lists. I want actual full on revoked certificates for test purposes. For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and got ...
0
votes
1answer
57 views

WebCrypto, SOP and Yubikeys

I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...
0
votes
1answer
29 views

PGP Key Servers Verification Mail? [duplicate]

Why do existing PGP key servers not perform e-mail verification? Wouldn't it help the problem of authenticating of public keys? By e-mail verification/confirmation I mean a single e-mail sent to the ...
10
votes
1answer
214 views

Did D-Link's certificate revocation really only invalidate 1 day (of a six months long exposure)?

I'm trying to wrap my head around the OCSP revocationTime for D-Link's certificate. I recently answered another question and ended up drafting a timeline. That timeline is basically this: Jul 5 ...
3
votes
1answer
44 views

GPG key expired on mykeyring, but still valid on keyserver

Can someone help me in explaining this: I have an old and expired GPG key, on my keyring the key lists correctly as expired: myself@mypc:~$ gpg --list-sig --fingerprint DDF70E72 pub 1024D/DDF70E72 ...
9
votes
8answers
5k views

Is Spoofing a CA signed certificate possible?

I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway. When a communication starts with a server, during the client handshake, the ...
0
votes
1answer
69 views

Certificate - Digital fingerprint vs Signature [duplicate]

What is the purpose of the « fingerprint » section of a x509 certificate, and is there an issue using SHA1 for it ? I understand the certificate signature section, but I can’t see the point with the ...
20
votes
8answers
3k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...
0
votes
1answer
71 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. Indeed, I am wondering if the code signing certificate (the “final cert”) must already ...
17
votes
1answer
13k views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
4
votes
2answers
107 views

Should I add picture(s) to my OpenPGP key?

I'm toying with the idea of creating a pair of OpenPGP keys, and I'm wondering if I should include a picture or two. I know it will make my key a lot bigger, but is it still worth it? I'm thinking of ...
-4
votes
2answers
56 views

Does SSL doesn't work without a secondary Symmetric/Asymmetric session key?

I keep reading that Symmetric session key is used in SSL after handshake only for faster performance but isn't true a secondary session key either Symmetric or Asymmetric key generated by the client ...
1
vote
2answers
139 views

Difference between KMS and PKI

While the PKI System deal with digital certificates life cycle and Key Management System (KMS) deal with keys life cycle. What is the the fundamental difference between them? Is it possible to ...
5
votes
2answers
526 views

One website - two different SSL certificates: two different CA's

I have seen multiple questions focusing on multiple certificates for a single domain (e.g.: a.com/example and a.com/example_one). However, what stops an individual from purchasing a certificate and ...
-2
votes
1answer
75 views

how to make non HTTP Applications PK-enabled

I have a server application that is using Winsock2.0 for client communication, this application is a service. The client is also a Windows desktop application and performs few operations. For example ...
21
votes
5answers
5k views

Are self-signed certificates actually more secure than CA signed certificates now?

Are self-signed certificates actually more secure than CA signed certificates now? I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government ...
2
votes
3answers
136 views

How to deliver an encrypted message to multiple recipients without revealing keys

Let's say I have generated a private and a public key. I create a message and encrypt it with the public key. I deliver this encrypted message and a private key to multiple recipients. Why would I do ...
4
votes
1answer
66 views

Cross-certification between worlds like X.509 and PGP?

Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
0
votes
0answers
55 views

Certificate policies extension in Root CA and Issuing CA

I am building new CA chain and PKI and I actually don't fully understand how I should include certificate policies (CP) and certificate practice statements (CPS) as extensions and how to work with it ...
34
votes
3answers
21k views

What are the risks of self signing a certificate for SSL

Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
0
votes
2answers
88 views

PKCS#12 File - security impacts when imported in Web Browser or Windows Store?

When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password. How does the browser or operating system manage this password? Is it secure?
0
votes
1answer
72 views

How secure is this security protocol? [closed]

I'm developing an application that will encrypt a bunch of files the client has on their machine and then send them to a server, to back them up. I need to encrypt the files so that other ...
5
votes
1answer
89 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
21
votes
4answers
2k views

Cloudflare's free SSL options require trusting them; what could they do to change that?

Cloudflare offers 3 free SSL options: Flexible SSL, Full SSL, and Full Strict SSL. The article “CloudFlare’s great new features and why I won’t use them” explores the shortcomings of the Flexible and ...
5
votes
3answers
1k views

Digital Signature and Verification?

AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it. So public key is used to decrypt ...
7
votes
4answers
341 views

Renew digital certificate

If I have deployed a digital certificate on a webserver and if it needs to be renewed then what steps do I need to follow? Will I need to generate a new longer public key private key pair? Why do ...
6
votes
3answers
1k views

What if someone steals a Certificate authority's private key? [duplicate]

What if someone could steal a Certificate authority's private key? I know this will (probably) never happen, but what would happen to the certificates that were already signed with this private key? ...
1
vote
0answers
182 views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: ...
10
votes
6answers
2k views

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
4
votes
2answers
4k views

Checking SSL/TLS servers for NULL encryption support

I have a web server supporting SSL 3 and TLS protocols, the following are the supported cipher suites: TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can I ...
5
votes
3answers
1k views

P12 - Extract public part (certificate) without knowing the p12 password

I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ? The ...
5
votes
2answers
2k views

Why is ECC more vulnerable than RSA in a post-quantum world?

Forgive me if this should be in the crypto sub, but sometimes the answers there are very mathematical and I would rather have an answer which is a bit lighter on the math but still strong on the tech ...
1
vote
2answers
104 views

PKI cards - PIN and certificates

My company has introduced a PKI some months ago. We are now able to login in our laptops either with our Windows credentials or with a PKI smart card plus a 6 digits numeric PIN. A part from that we ...
14
votes
3answers
10k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
1
vote
0answers
21 views

Relationship between the validity of license of an accredited CA (certificate authority and the validity of it's certificate? [duplicate]

To more clear, let's see my example: As I know, in Korea, the validity of a CA's license is only 2 years, but the validity of this CA's certificate is 10 years. Why is the valid time of the license ...
2
votes
2answers
715 views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
26
votes
4answers
37k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
0
votes
1answer
141 views

What is the most secure way to digitally communicate between the U.S. and China?

What is the most secure way for two people to communicate digitally when one person is in the U.S. and the other is in China (likely being monitored)? Updated: Here's some additional info: The ...
2
votes
3answers
71 views

PKI usage in a cluster; per application instance or per application?

I'm having a cluster with nodes (let's call them A and B for the sake of example) running identical micro services (1, 2 and 3 - so the application 2 running on node A is called A2). The applications ...
3
votes
1answer
82 views

How to verify an OpenPGP key's ownership?

I've added the public key of Diceware creator (please use it as a practical example), I've added it by downloading diceware.wordlist.asc, and I didn't have his key and couldn't immediately find it to ...
4
votes
2answers
109 views

What do the terms used in OpenPGP keyserver SKS mean? (sig, sbind, sig3, exp2, Policy, …)

When viewing a key record in a public key server, such as this one, there are lots of keywords used: sig, sig3, exp3, Policy, sbind…). I understand that "sig" probably means a signature, but what's ...
0
votes
1answer
100 views

Confused about RFC 4492: difference between “ECDH-capable public key” and “ECDSA-capable public key”

As per section 5.3 of RFC 4492, I'm confused with the following table: Key Exchange Algorithm Server Certificate Type ---------------------- ----------------------- ...
1
vote
1answer
45 views

What does the letter in an OpenPGP key's bits definition (like 4096D) denote?

I noticed that when looking at OpenPGP keys on a key server, the key's bits definition is usually followed by a letter, as in "4096D" for example. However, there are also keys with other letters than ...
9
votes
2answers
298 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
0
votes
0answers
99 views

How to add a certificate chain to a JKS

I want to setup a KeyStore which contains certificate-chains only. This is required by a PKE system which uses the PublicKey of the desired certificate for encryption an then sends the cipher to the ...
2
votes
1answer
103 views

Message and Key Security

I'm reading Post-Quantum Cryptography, and in the page 106 in the beginning of the Section 3 it says: In this section we consider the message security (opposed to key security) of code-based ...
3
votes
1answer
71 views

Verifying cryptographically signed files when the key has been revoked

This is mostly a question out of idle curiousity. If I use my private key to sign a file today, forming a signature, and distribute that signature with the document to someone they can then use my ...
3
votes
2answers
127 views

Internet Explorer - Advanced Properties for Trusted Root Certificates

If you go to IE -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities. Now Click on some CA certificates and click on Advanced You can add properties to the ...