A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

0
votes
1answer
112 views

How can I generate some public and private keys on both sides with low overhead?

We have an Authority Center (CA) generating some public and private keys for each client (more than one pair for each client). One method for sending keys to client is sharing a secret key between CA ...
0
votes
0answers
51 views

Is ADCS overkill just to replace self-signed certs?

Several of our internal applications are either not using SSL certificates, or are using self-signed certificates. I wanted to utilize ADCS to create a trusted, internal-only root CA that our browsers ...
0
votes
2answers
55 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
-1
votes
2answers
263 views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
0
votes
1answer
92 views

PKI - Security concerns when changing a certificate hash algorithm

Suppose I want to change the hash algorithm used for a certificate signature (ex: SHA1 to SHA2). Is it better to revoke the previous certificate and issue a new one with expected hash algorithm ? Or ...
1
vote
1answer
135 views

Automate the process of giving a user access to his encrypted messages, when the user loses his password

I'm implementing a way for users to share messages with other users. All users and admin-users have a unique key pair. A message can be sent from one user to multiple users. Admin-users, who always ...
0
votes
4answers
99 views

Temporarily suspending a Certificate Authority's Certiticate

The PKI RFC talks about revoking or suspending certificates. It also talks about revoking CA certs. However, I could not find anything about whether a CA or a Sub CA's certificates can be revoked or ...
2
votes
1answer
103 views

Why can't I upload a new ECC key to key servers, which is supported by GnuPG 2.1?

My OpenPGP key is soon to expire so I wanted to create a new one. GPG 2.1 came out a month ago including ECC support and I wanted to try the new key types. So I have generated a brand new ed25519 ...
1
vote
1answer
44 views

Definitions of PKCS#11 abbreviations

Is there a complete definition list for all CKx abbreviations in PKCS#11? I believe I gathered most of them: CK = Cryptoki CKA = ... Attribute CKC = ... Certificate type CKD = ... Key derivation ...
0
votes
0answers
99 views

Why is the public key extracted from the CSR different than the one extracted from the associated certificate?

I am playing around with pyopenssl. I am trying to extract the public key from a CSR and to check if it is the same than the one I find in the associated certificate. There is a small difference ...
1
vote
4answers
109 views

Data anonymization/ encryption requirement

I did check out the previous postings and didnt find what I was looking for- apologies if this is a repetition. I am working on an analytics engagement for a customer and he needs to share access to ...
3
votes
1answer
91 views

Must the distinguished subject name of an issued SSL Certificate match that of the generated Certificate Signing Request?

For example: from Issued SSL Certificate: CN = abc.com.my, OU = Room, O = House, C = MY from generated CSR: CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY Is it legal for a ...
1
vote
0answers
248 views

If even Apple cannot properly install certificate [closed]

I've just installed a new copy of Mozilla Firefox/29.0 SeaMonkey/2.26.1 on a new Mac with OS X 10.9.4, and I'm getting an error message in place of a webpage when trying to access ...
3
votes
3answers
2k views

Extracting the PGP keyid from the Public key file?

is there a way via an CLI tool or some kind of API to extract the PGP KEY ID from the PGP PUBLIC KEY BLOCK ? I did find the hexa value of the key in the binary file, however I guess the position is ...
1
vote
2answers
184 views

Certificate security in intranet environment?

We have this topology in our company: A new rule says that each document being sent by Outlook should be encrypted. We decided using PGP. We already have a certificate (self-signed). The problem ...
1
vote
3answers
217 views

What is the web of trust?

I'm studying network and system security and I came across the phrase "web of trust". From Wikipedia: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other ...
-2
votes
2answers
49 views

Get the Signature algorithm from a public key? [closed]

When I do PublicKey.getAlgorithm(), it only returns me RSA. Am looking for something to return Sha1RSA. Basically to identify if it is a sha1 or sha2 algorithm. Any help is appreciated. Thanks,
1
vote
1answer
219 views

Authenticated Diffie Hellman Key Exchange

It appears that the textbook version of Diffie-Hellman is susceptible to man in the middle attack and the use of digital signatures could prevent this attack from occurring. Digital signatures could ...
1
vote
1answer
67 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
4
votes
3answers
263 views

Anonymiszing sensitive data in MySQL DB while retaining searchability [closed]

I have a MySQL database that stores sensitive (personal) data about individuals; and have been tasked with ensuring that this data is encrypted in some way to protect the individuals and their data if ...
2
votes
1answer
320 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
4
votes
1answer
115 views

How long do keys stay on keyservers?

Do GPG/PGP keyservers "garbage collect" old keys which have expired, been revoked, or simply haven't been updated in a decade? Or does the server (theoretically) keep every key it has ever seen from ...
1
vote
1answer
58 views

How to understand socat certificate check limitation?

I have set up a certificate-based connection with socat using this tutorial: http://www.dest-unreach.org/socat/doc/socat-openssltunnel.html My socat connection works as following (only the relevant ...
-1
votes
1answer
93 views

How is PKI used to encrypt an e-mail for multiple recipients?

My understanding is that when an e-mail is encrypted and sent to a recipient, the recipient's public key is used to encrypt the e-mail, and then only the recipient can decrypt it with their private ...
0
votes
1answer
239 views

How can the private key be obtained in PKI without alerting a third party? [closed]

For example, I sent a message to Ardi and encrypted it with Ardi's public key. Ardi must decrypt the message with his private key. How can Ardi's private key be obtained in PKI without anyone else ...
2
votes
2answers
105 views

Distributing public keys; with or without a sub-key?

Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does ...
1
vote
1answer
181 views

Chat encryption system avoiding protocol sniffing and then key+decryption replay?

I'm working on a chat system and I want to add it some kind of security (not just HTTPS with SSL since I've read it can be sniffed and decrypted with a few tools). Now, my knowledge in cryptography is ...
0
votes
1answer
728 views

Shall I set “RSAAuthentication yes” in sshd_config if I use only ECDSA key?

In a context of proprietary client boxes and servers, I want to limit authentication to ECDSA keys. Historically, "RSAAuthentication yes" was used to enable authentication with RSA and maybe DSA keys. ...
4
votes
2answers
4k views

Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?

If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data? If the latter, then if someone had access ...
7
votes
1answer
3k views

Reset Windows trusted certificates store to its default

Over the time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, some other times for development and testing. Is there ...
1
vote
2answers
206 views

What's the benefit of hybrid cryptosystem vs asymmetric for small data blocks?

It's a common belief hybrid cryptosystems are better than asymmetric only. Is that allways like that? What's the benefit of using symmetric and asymmetric encryption for small data blocks (< 100 ...
1
vote
1answer
78 views

How long can a pkcs#8 passphrase be?

A program is using a private key to read messages. To improve security, besides randomness, I'm trying to create the longest passphrase that makes sense. How long should it be? After which amount of ...
0
votes
1answer
128 views

What would cause a server to only send over 1 SSL certificate to a client? [closed]

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
3
votes
2answers
4k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...
3
votes
3answers
238 views

Best practices for GPG user ids

What is the best practice for choosing GPG user id(s)? I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because ...
0
votes
0answers
54 views

Attack Vector for Wildcard Cert

So I am looking to the security risks of WildCard Certs, in a previous post most of the questions were answered however I have one follow up question for that. In my instance I use DigiCert, so ...
1
vote
1answer
85 views

Problem with common factor in RSA [duplicate]

In the RSA key generation steps, what if two entities select a common factor to generate n (i.e. p*q1=n1 and p*q2=n2) resulting in gcd(n1,n2) <> 1 ? This will lead to a problem that everyone ...
0
votes
2answers
154 views

With RSA, can one ensure that two entities will not have the same private key?

With the RSA encryption algorithm, is there any guarantee that two different entities will not be given the same private keys?
11
votes
4answers
1k views

Multiple CAs signing a single Cert/CSR?

Just saw this suggested on Slashdot So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
4
votes
1answer
177 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
0
votes
5answers
197 views

Are most MiTM attacks done to impersonate web sites, or simply decrypt traffic?

The more I read about impersonating web sites the more I get confused. Does an attacker need the private key of the server in order to impersonate a website or does having the private key simply give ...
1
vote
1answer
385 views

Recommended Key Usage for a client certificate

My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicate with the server to a path that requires a ...
0
votes
1answer
194 views

Why are CA's now signing root certs with SHA2?

I see that CA's are now giving the option of having the root CA cert signed with SHA2. I have been told that the hashing function in a root has no security value, and is irrelevant as far as a ...
2
votes
2answers
122 views

The reason to insert Subject Alternative Names into CA certificate

I am trying to understand meaning of the Subject Alternative Name extension. The reason of usage it in SSL X.509 certificates or other end-entities certificates is mostly clear for me. However, I ...
0
votes
2answers
214 views

What does 2^77.1 calls presented in a SHA1 attack mean?

Regarding the SHA 1 deprecation, I found this information here: http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx I know ...
2
votes
2answers
154 views

Does adding multiple recipients to an encrypted message decrease security?

Let's say you want to send the same GPG/OpenPGP encrypted message to 50+ recipients. Assuming everyone you send to is trusted, and there is no risk of any recipient leaking their secret key, is ...
1
vote
2answers
156 views

Does a smart card do encryption or does it just provide a private certificate?

I don't really understand how smart cards work. Do they sign or encrypt themselves (where the computer provides data to it to sign) or do they provide a computer with the private certificate when I ...
0
votes
2answers
199 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
2
votes
1answer
1k views

adding certificate that resides on smartcard to the microsoft store with private key ownership

how can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? in an enrollment system where users generate smartcard certificate ...