A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

3
votes
2answers
122 views

A potential possibility of improvement of PKI for personal communications

In countries like Germany each citizen has an identity card that is issued by the registration authority. Since the identity of a citizen is, in a sense, created by that authority via assigning him ...
6
votes
2answers
284 views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
4
votes
2answers
52 views

Extend hierarchical PKI

The figure below shows four simple hierarchical PKIs. A, R, H and N are trust anchors of their PKI. I am supposed to add exactly one certificate so that T trusts G, but not D. Furthermore R must ...
3
votes
1answer
61 views

Best practice to verify data against a CA

Let's say that I have signed my public key with a trusted CA and the CA provided my with a signed certificate, and I want any client applications to verify against this certificate. The general ...
1
vote
2answers
217 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: I have been researching how trusted root authorities (such as GlobalSign or Verisign) are used ...
9
votes
0answers
86 views

What LDAP schema is recommended for PKI?

In my research, I found some RFCs that have not been updated in over a decade, e.g draft-ietf-pkix-ldap-crl-schema-01. I also explored several public directories used in PKI (e.g. x500.bund.de) and ...
9
votes
1answer
541 views

Why does GoDaddy have four different certificate chain, G2, G3, G4?

I see from Godaddy they have multiple certificate chains https://certs.godaddy.com/repository GoDaddy Certificate Chain GoDaddy Certificate Chain - G2 GoDaddy Certificate Chain - G3 GoDaddy ...
3
votes
2answers
394 views

Is it possible to do Public Private Key Encryption on a chip (hardware)?

Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely? The ultimate goal ...
1
vote
2answers
133 views

Why/when would a CA make a generated public key available to the public at large?

I'm confused about this section in my CEH security exam training material: A CA is able to perform a number of roles in addition to the validation process outlined here. Some actions that a CA is ...
2
votes
2answers
61 views

Why not to use the same subordinate issuer CA for generating certificates that will be used for different things?

Microsoft has recommended my organization to use different subordinate issuer CAs in order to issue certificates that will be used for different things. For example, they recommend to use a CA for ...
6
votes
3answers
263 views

Why should my certificate signing request be signed by my private key?

Why should my certificate signing request be signed by my private key? Even if I obtain a bogus certificate out of someone else's public key, that is going to be useless, since in SSL the ...
5
votes
1answer
3k views

Adding certificate that resides on smartcard to the Microsoft store with private key ownership

How can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? In an enrollment system where users generate smartcard certificate ...
5
votes
2answers
124 views

Understanding Digital Certification as as a whole starting from a normal http request

I am trying to understand the difference between digital signature and digital certification and how they work as a whole together on a high level perspective. I hope gurus here can point to me if my ...
0
votes
1answer
67 views

OID for creation date/time (X509 certificate field)

X509 certificates used in PKI{X} have notBefore and notAfter dates. I'd like to stamp a certifcate with a creation stamp, and the stamp is distinct from notBefore and notAfter. Is there an OID for a ...
4
votes
1answer
996 views

How can a trusted intranet certificate be issued if they are being phased out?

I've just seen this article regarding the phasing out of intranet names on SSL certificates. However, CAs such as this one claim to still issue them and it will be "Trusted by all popular browsers" ...
3
votes
1answer
498 views

ECDSA/RSA certificates and cipher selection

In this image can someone tell me if a standard RSA certificate can support the EC*_RSA ciphers listed? If so do you create the typical RSA keys when you are creating the CSR? Also I am fairly ...
2
votes
1answer
44 views

Is there a way of achieving perfect forward security with one directional messages?

Using for example ECDH and ephemeral keys, it is possible for two parties to establish a shared key with perfect forward security, i.e. even if the long term keys are lost, it will not be possible to ...
3
votes
1answer
94 views

Designing a PKI environment

For our company I was given the task to design a durable, structured PKI environment for mainly client authentication purposes. We need a Root CA with a couple of Intermediate CAs, like this: ...
5
votes
2answers
161 views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
2
votes
1answer
198 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
3
votes
1answer
54 views

What happens if an OpenPGP subkey gets compromised?

In my GnuPG keyring, I have a primary key for creating keys and three subkeys: two for encryption and one for signing. All of then have the same password. If a subkey gets compromised, is it possible ...
1
vote
0answers
27 views

Can there be two certificates with a same serial number in the world? [duplicate]

Recently I came across this odd question. I hope, Serial number is unique across certificates signed by a particular CA. So is there any chance that two different CAs sign two different certificates ...
4
votes
3answers
948 views

How to secure a truecrypt container allowing access with multiple SSH public keys?

I would like to create a TrueCrypt container which can be accessed by multiple people. The container itself can be stored anywhere, e.g. in a shared folder in Dropbox or Google Drive, ... I would ...
2
votes
1answer
83 views

Correct way of signing and verifying a message

I have an object which I need to transmit to clients and I need the clients to know that I actually created the object. Obviously, this process involves in me signing the object with my private key, ...
1
vote
2answers
70 views

What exactly does `ssh -T user@domain verify` do?

The example I'm specifically thinking of is: ssh -T git@github.com verify Looking at the docs (man ssh) I can see that -T is the flag to "Disable pseudo-terminal allocation", but what implications ...
2
votes
2answers
161 views

Is there any mechanism to audit which signed certificates are unrevoked?

We are currently using EasyRSA and OpenSSL to manage our user VPN certificates for OpenVPN. The process we have in place currently is: User generates a CSR on their laptop and sends it to us to sign ...
1
vote
1answer
154 views

How does letsencrypt's ACME work?

I found the technical paper on ACME's inner workings, but I still feel a bit confused about the ways Let's encrypt's Domain Validation works. From what I already know, verification can be performed ...
0
votes
0answers
32 views

PKI, one sub CA for each certificate type VS one for all the certificates type

I'm trying to set a PKI where I can find 3 types of certificates: A client certificate to use in HTTPS communications A web server certificate to use in HTTPS communication A VPN certificate to use ...
1
vote
2answers
61 views

PGP Key Signing Robot DKIM Verified Emails

It occurred to me that DKIM verified emails, from major players (e.g., GMail), could open the door to more modern OpenPGP robot key signing authorities. The idea would be to ask people to send a key ...
1
vote
1answer
40 views

Prevent credential roaming for certain accounts/certificates?

I want to use credential roaming in Windows 7, 8 and 10 for EFS certificates, so users can access their encrypted files from any computer they login to. However, some of these users will also have ...
13
votes
1answer
902 views

How secure is “Let's Encrypt”?

I just configured and installed a free SSL certificate from Let's Encrypt. It's great, and very easy to set up. However in this post-Snowden era, I was wondering how secure this really is. For ...
1
vote
1answer
28 views

Certificate binary matching

Is it an industry practice to do a binary matching of client public certificate when doing SSL with client authentication? I was thinking that if the client can successfully do the SSL handshake, ...
6
votes
1answer
949 views

What is the “PGP Global Directory Verification Key”?

In the server keys of the MIT, there is several signatures from "PGP Global Directory Verification Key". Example (from http://pgp.mit.edu/pks/lookup?op=vindex&search=0xB63024F96C73DA99): sig ...
1
vote
2answers
61 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
2
votes
1answer
373 views

Do SSH private keys always contain enough information to derive a public key?

I am working on a persistence model for SSH Private keys. The technology used is Java. Since the persistence structure of the public and private keys is pretty similar and using some of the Java APIs ...
3
votes
0answers
233 views

What are the use-cases for Hashicorp Vault PKI?

Hashicorp Vault has facility to auto generate server/client cert for authentication. https://vaultproject.io/docs/secrets/pki/index.html While it makes sense from certificate management point of ...
1
vote
1answer
72 views

Is it safe to publish my development private key?

For my development environment, the following three SSL files allow me to access my application from https://localhost on my local machine. Private key: server.key Certificate signing request: ...
0
votes
1answer
113 views

Generate RSA2 key in OpenSSH format in windows

I have to generate a key, RSA v2 in OpenSSH format. I am a bit confused. I am trying to generate it using Putty key generator. There I see an option SSH2-RSA and SSH1-RSA. So is SSH2-RSA the RSA2 key ...
20
votes
5answers
5k views

When can I commit a Private Key to source control?

That is to say, in what cases does it make sense to commit an unencrypted keypair to internal source control like SVN or Git? Related question that discusses an encrypted private key: Is it bad ...
0
votes
0answers
53 views

Mysql SSL handshake: symmetric key exchange with CA or server key?

I have my MySQL database set up to require server and client identify verification, with both presenting their certificates signed by the same CA (mysql user was set up with 'require X509'). ...
2
votes
2answers
736 views

OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys

The company I work for has a few OpenVPN servers used by over 200 employees. The servers were deployed a few years ago using the default easyrsa settings and now we want to upgrade to stronger ...
3
votes
3answers
391 views

Should I use more than 2048 bits in my SSH-2 RSA Key?

I've been asked to generate a public key with PuTTY key generator. The default is 2048 bits, should I add additional bits to the generated key? Or is it unnecessary?
1
vote
1answer
100 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
1
vote
3answers
274 views

Using a stolen certificate on a server

Yesterday I asked the following question regarding what would happen if you placed a stolen certificate on your own server and edited the 'host' file so that the DNS name matched: Could a stolen ...
6
votes
2answers
559 views

Could a stolen certificate show as trusted?

I have recently started learning about PKI and have the following question/s. As far as I know a signed certificate contains the domain name of the server that the certificate will be placed upon. ...
0
votes
2answers
89 views

Public key - private key question

I have a query about public/private key encryption that I hope someone can answer. So as I understand it: Client connects to server and server responds with certificate Client pulls the public key ...
9
votes
3answers
1k views

Why is the subject's public key not used for encryption in SSL? [duplicate]

As far as I understand the workings of SSL - the client generates the pre-master secret and sends it to the server encrypted using the server's public key. Now, both parties perform some steps to ...
-2
votes
3answers
50 views

Changing public key of someone to read and change messages that are encrypted to him

If I am able to change someone's public key, is it possible to alter the key to later read and change his encrypted messages in an easy way? Just remember I don't have his private key.
5
votes
1answer
136 views

SSL certification path building

Background Some SSL certificates have two certification paths. In other words: the trust-chain can take two paths. I installed all the certificates for one path but that gave an HTTPS error on some ...
0
votes
3answers
253 views

Transmitting private keys between devices? [duplicate]

I have an app where a users' device create a public/private key and all communication to this user is done by encrypting against their public key, which is stored on a server and sent to other clients ...