A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

1
vote
1answer
100 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strenght ? (PBKDF2 as both ...
3
votes
1answer
101 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
1
vote
2answers
88 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
0
votes
0answers
41 views

What is the minimum acceptable time for “Freshest CRL” to be updated?

I'm working with MSFT CA, and not sure if this behavior is the same across all CAs, but when I run certutil -CRL, the base revocation cert is updated weekly, and the Freshest CRL (the differential) ...
4
votes
2answers
103 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
1
vote
0answers
26 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
0
votes
0answers
28 views

Distribution of key by server

I have read that in asymmetric cryptography, a system admin can generate key pairs on the server. After that, the users will be given the generated key pairs and this is an efficient way of doing this ...
2
votes
1answer
79 views

How do Client-specific keys and Certificates work?

I have clients that communicates with my server. Clients sends it unique id (guid) to server with its request over a secure https channel. Also to increase security I use my own private-public key ...
0
votes
1answer
41 views

public key formats [closed]

I have the following PEM format public key: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDguwHaldTclMAFg1BQ45Q8DPIc ...
2
votes
1answer
5k views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
1
vote
1answer
199 views

How do PGP keyservers synchronize the keys?

I want to know technical details about how public PGP keyservers synchronize the keys. If I send my key to one keyserver, how exactly does it "travel" to all the other ones? Who sends it to who and ...
2
votes
2answers
76 views

Does an alternative approach to PKI technology exist?

Currently all of the network is using PKI standards and we are facing many problems. I don't mean every time and if new technologies arise we will also have to face the same, but for my curiosity. ...
10
votes
1answer
7k views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
1answer
89 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
1
vote
1answer
79 views

Why should I have my GPG key expire? [duplicate]

When creating a key pair using gpg it asks me for an expiration date: $ gpg --gen-key Please specify how long the key should be valid. 0 = key does not expire <n> = key expires ...
2
votes
4answers
738 views

If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?

Firstly, let me start by saying that I am not attempting to hack anyone or anything (not that I would know how or where to begin, if I were). For illustration purposes, let's call the primary key ...
-4
votes
2answers
280 views

Is “HTTPS” ~100% secure? [duplicate]

Assuming that we have a "green bar connection" to a website, e.g.: Is an attacker still able to sniff our traffic? How secure is a user from man-in-the-middle attacks when he has established a ...
1
vote
3answers
70 views

Secure tunnel set up in an office environment

Suppose I am a rogue employee and I want to syphon some sensitive data out of the office and I only have office internet access for this. My office internet access needs to go through a proxy server, ...
0
votes
1answer
127 views

Two-factor encryption model [closed]

Please some on help me to understand this "Are you ready for this? With the two-factor encryption model your data is protected two-fold. First, a unique key is generated, encrypted, and turned into ...
2
votes
2answers
112 views

How can I create my own public certificate using openssl?

I have a public key/private key pair i generated using two primes p and q. I now need to use openssl to sign and create the certificate. I heard req utility and wrote this from the man pages. openssl ...
4
votes
1answer
39 views

Mail Signing Certificate – What are the impacts when revocated?

Suppose I open a signed mail on 1st January 2000, signature is OK. What about this two cases : 1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
0
votes
0answers
19 views

why DH is unbreakable and what are the facts that leads to strong DH? [duplicate]

I am new to DH and learned the basic about DH working and suspecting it can be breakable by normal MIM , then how we can use DH in plain http for sharing secret. correct me if i am wrong.
0
votes
1answer
41 views

PKCS#12 File - security impacts when imported in Web Browser or Windows Store?

When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password. How does the browser or operating system manage this password? Is it secure?
0
votes
1answer
358 views

Sign PKCS#7 and verify PKCS#7 signature with OpenSSL

If someone have to transfer X.509 certificates in a single bundle, usually, it is recommended to pack them into PKCS#7. And content of PKCS#7 can be signed. OpenSSL allows to pack certificates into ...
12
votes
1answer
947 views

Relationship between RSA, Diffie-Hellman Key Exchange, PKI and X.509?

I am getting confused with RSA, Diffie-Hellman Key Exchange, PKI and X.509v3. I took a look of RSA's mathematics algorithm, it seems like a encryption algorithm, right? Generating public key and ...
3
votes
3answers
307 views

Corporate PKI - SHA1 deprecation

Here is the context. Suppose you have a corporate PKI with : AC_Root (offline in safe store - SHA1 signature) SubRootA and SubrootB (offline in safe store - SHA1 signature) SubSubRootC, SubSubRootD, ...
10
votes
3answers
7k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
4
votes
2answers
159 views

Verify digital signature without key public key in signature

When receiving emails, I sometimes see the following: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I found an integer overflow in PHP, in the conversation of dates to "Julian Day Count" function. ...
1
vote
1answer
48 views

Does SSL/TLS have the feasibility of detecting malicious things during transmission? [closed]

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly ...
2
votes
1answer
482 views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
1
vote
1answer
42 views

Can a PKCS12 file be distributed over insecure channel?

Is the PKCS12 only as secure as the password protecting private keys ? Can I distribute the p12 file over an insecure channel ?
9
votes
8answers
533 views

Authencity of information displayed on an untrusted device

Suppose I have a (bluetooth/usb) device which needs to displays information on an external pc/phone. Is there a simple and effective method to garantuee that the information displayed hasn't been ...
4
votes
3answers
130 views

How can I create a unique identifier that can not easily be reversed?

I've been working on the design of a longitudinal study and one requirement is: all participants will have a unique identifier that is not reversible from the data storage/analyst side of the study ...
0
votes
1answer
178 views

PGP Key publishing on MIT PGP Public Key Server [duplicate]

I have a public pgp key, so that users can send me an encrypted message. Ofcourse, any user that wants to send me a message, wants to verify that the public key (s)he has, really belongs to me. From ...
2
votes
1answer
210 views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...
27
votes
4answers
3k views

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single ...
2
votes
1answer
298 views

Making a bitcoin-like secure mail protocol, how to tackle public keys?

I'm making a new mail protocol (probably already exists, but I've learnt a lot of things about security and privacy on the way). Here's the summary(much simpler if you know bitcoin's inner workings): ...
0
votes
1answer
108 views

Compromised submarine cables and the consequences to internet?

I recently read an article that Google wants to build a submarine cable connecting to my country supposedly to increase overall speed and while I hope my government will never allow this kind of thing ...
1
vote
0answers
35 views

Security schemes regularly in use on cloud

I've been looking into how connections are managed in the cloud, in order to better understand the threats users and their deployments may face. The most important and common ones in use seem to be ...
0
votes
1answer
18 views

Web of Trust: What is “signatory trust”?

I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust. What is an easily understandable definition of signatory trust? An ...
5
votes
1answer
142 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of ...
2
votes
1answer
28 views

Is there a way of achieving perfect forward security with one directional messages?

Using for example ECDH and ephimeral keys, it is possible for two parties to establish a shared key with perfect forward security, i.e. even if the long term keys are lost, it will not be possible to ...
3
votes
1answer
60 views

Installing a CA only for specific domains

For many reasons, it's often convenient for organizations to have their own CA (self-signed or otherwise). As I understand it, adding the CA certificate to a OS or browser will make it trust the ...
3
votes
1answer
71 views

What encryption and signature systems (don't?) allow for plausible deniability of the OP's key being used?

I need to prevent Mallory from blindly matching encryption and signing keys to messages Hypothetical scenario: A user creates a public key An encrypted or signed payload exists. With only public ...
0
votes
2answers
153 views

Typical mistakes when implementing digital signatures?

I am looking for a list of typical mistakes someone can make when implementing digital signatures for a software. And of course why they are mistakes and how an attacker could take advantage of them. ...
1
vote
1answer
45 views

Banking card certificate

Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ? Perhaps a standard exists or a de-facto ...
1
vote
0answers
100 views

Distribute S/MIME public keys and CA cert for email security

I have my own CA. I want to distribute S/MIME certificates for 10 different users. I saw S/MIME keyservers from http://wiki.cacert.org/KeyServers, but I don't want to use public servers. What is the ...
8
votes
3answers
789 views

Does the SSL encryption strength or validation level of a website really matter?

When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart. Immediately there seems to be 4 major ...
2
votes
1answer
98 views

Smartcard - main differences between .NET and Java smartcard?

My question focuses on the differences regarding PKCS11 implementation between a .Net and a Java smartcard. More generally, do smartcard use a specific "OS" (or firmware) and only differ in the ...
3
votes
1answer
101 views

PKI - Why Root CA is in intermediate CA section?

I can't understand why, when I accept to "install" a custom self signed Root CA on IE browser, the root certificate ends up in the "intermediate CA" section, rather than in "Root CA" section in the ...