A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...
3
votes
1answer
96 views
Can we use a public key scheme for performing cryptographic commitment
Is it possible to use a public key scheme such as DSA as a commitment scheme? Are there any problems with doing this?
3
votes
3answers
172 views
Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?
It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
8
votes
3answers
322 views
Difference between Certificate Authorities
I've been wondering for a long time about is. There are many certificate authorities having different types of certificates. But even certificates of the same security level cost a lot more with one ...
-1
votes
1answer
65 views
XER encoded X.509 certs [closed]
Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it?
Thanks!
2
votes
3answers
199 views
Public key Infrastructure
Here the MD5 hash is being encrypted with the private key of the sender. But I read in a paper that private key is only used for signing and not encrypting. Is the image wrong or can private key ...
11
votes
4answers
397 views
What alternatives are there to the existing Certificate Authority system for SSL?
Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What ...
1
vote
1answer
83 views
How are root CAs for SSL distributed?
For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser.
But what about for firefox and chrome?
...
6
votes
2answers
394 views
Why would the downloaded certificate show a different end-date as compared to the same certificate when viewed online?
This is sort-of a follow-up to my previous question What fields in a suspicious certificate should I look at?
Chrome just presented the warning icon against the certificate presented by ...
0
votes
0answers
113 views
Encryption in Messaging/RAbbitMQ/SOA [closed]
I'm a student and now 2nd time poster, please excuse any lacking detail on my part.
For my exams I'm doing a cross-platorm application using RabbitMQ for messaging. It'll serve as POC for both SOA ...
4
votes
1answer
469 views
AIA/CRL locations for Offline Root
I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building
It's an ...
4
votes
1answer
156 views
where to download revoked certificates from
I don't want the certificate revocation lists - I want actual full on revoked certificates for test purposes.
For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and ...
3
votes
3answers
434 views
How to distribute client certificates without exposing private key?
I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication.
I'm ...
3
votes
1answer
55 views
Within a CSR, is there a field to have the MS PKI server change the default cert filename
I'm not intimately familiar with MS PKI, but it was a question that came up in a discussion for an issue a coworker is having. When you input the request fields manually on a PKI server, the cert ...
2
votes
2answers
304 views
Key Exchange using PKI
I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl
openssl req -x509 -nodes ...
-3
votes
1answer
88 views
How to distribute public keys in the network without losing its credibility? [closed]
How to solve the key distribution encrypted with the public key?
How to make public key authentication? How to distribute public keys in the network without losing its credibility?
3
votes
1answer
60 views
CMC (RFC 5272) compatible CA server
I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
10
votes
4answers
648 views
Why isn't OCSP required by default in browsers?
According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers.
Can someone please explain why this isn't ...
1
vote
2answers
94 views
Certificate Security in intranet Environment?
We have this topology in our company :
A new rule says that each document being sent by outlook should be encrypted.
we decided using PGP.
We already have a certificate ( self signed).
the ...
4
votes
1answer
112 views
Is OpenPGP encryption a valid replacement for SSL when passing messages?
I am writing an application that occasionally needs to transmit larger messages to other servers on the internet without allowing people to snoop on the traffic. The normal way to handle this is to ...
8
votes
2answers
598 views
Are there really functioning quantum computers?
I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
8
votes
2answers
277 views
Is it okay to widely share the RSA key fingerprint for a host?
When you ssh into a remote box for the first time or if the remote host's key fingerprint has changed (from what's stored in your known_hosts file) you get a warning and you are shown the fingerprint ...
5
votes
1answer
179 views
Which attributes of a X509v3 certificate are never really used?
Are there any extensions/extended key usage attributes of a X.509Certificate that are rarely or never used in practice?
Either due to never being part of an issued certificate or because they are ...
3
votes
1answer
150 views
What are the Netscape Cert Type attributes? Why/when are they needed?
What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions?
Example:
There is the Client/Server Extended Key Usage (X.509) but there is ...
2
votes
2answers
256 views
Revoked certificate validation using past times
I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past.
Unfortunately I have problems verifying revoked ...
1
vote
1answer
237 views
Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
I'm confused by the difference in behavior of ssh clients I'm seeing on two different hosts. Just to be clear, this is the scenario:
"macbox" OS X using OpenSSH_5.2p1 ssh client
"sunbox" Solaris 10 ...
4
votes
3answers
90 views
Can the root of a system access to unencrypted data when using a double tunnel?
I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C).
A-->B-->C
I created a ssh tunnel from A to B and forwarding the port 22 ...
1
vote
0answers
131 views
Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]
I have installed openssl and now the rsa_test.c is running fine. What I want to do is:
Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey.
The public key contains the ...
2
votes
1answer
78 views
Which .CER file format is more secure for purposes of an AIA record?
What file format is most appropriate or secure for the AIA record in a PKI certificate?
The options I'm aware of are:
DER encoded binary X.509 (.cer)
Base-64 encoded X.509 (.cer)
I also have the ...
5
votes
1answer
162 views
security issue on storing keys and certificate on token
I'm creating a sample USB token with Atmega64. As I have to store both the public and private key and the certificate on my token is there any important security issue that I should worry about, ...
3
votes
2answers
190 views
Distributed XAdES-X and XAdES-A signatures over multiple documents
As the standard is not completely clear in this matter, I'm trying to found out if the XAdES standard (ETSI TS 101 903 v1.4.2) describes distributed case in which the SigAndRefsTimeStamp element or ...
1
vote
1answer
74 views
What keys are involved in an X.509 certificate?
I'm trying to examine some instances where an X.509 certificate uses public and private keys for a paper I'm going to write. However, the only thing I have explicitly seen so far is in one of the ...
5
votes
3answers
237 views
Digital Signature and Verification?
AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it.
So public key is used to decrypt ...
6
votes
3answers
173 views
What risks would exist in transmitting an encrypted PKCS12 via Https
I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate ...
2
votes
2answers
72 views
Using a verified certificate to sign others
OK my Google Fu has failed me as I'm not exactly sure what I'm searching for. This relates to PKI ad certificates generally but websites more specifically.
Could you get a verified certificate from ...
4
votes
1answer
56 views
Standards for CA cert revocation and time-constrained cryptographic algorithm parameters
I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
5
votes
1answer
70 views
Is it possible to have multiple key lengths in PKI?
Is it possible to have multiple key lengths in a PKI? For example, use a 1024-bit key for the issued certificate, a 2048-bit key for the intermediate certificate, and 4096-bit key for the root ...
6
votes
4answers
414 views
Alternative to “web of trust”
Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
8
votes
3answers
560 views
Is it safe to store a single symmetric key encrypted with several different RSA public keys?
For the field-based encryption of a database containing sensitive information, I was thinking of the following design:
Every user has a smartcard used for client certificate login.
After login the ...
2
votes
4answers
921 views
What web browsers support OCSP stapling? Are the privacy and performance features the same?
OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session ...
4
votes
5answers
431 views
Is Spoofing a CA signed certificate possible?
I had never thought about this situation before, I may be completely wrong but I am going to have to clarify it anyway.
When a communication starts with a server, during the client handshake, the ...
11
votes
2answers
2k views
How does RSA encryption compare to PGP?
On this answer ck says
RSA and PGP are different.
What you are essentially asking is how
do I run my petrol car on diesel? The
answer is you can't.
I would be interested in a more ...
2
votes
1answer
97 views
Curious about best start for autoresponding Certificate Authority (CA)
I am just getting started trying to implement some internal PKI ideas, where my app would need a cert to 'sign' messages. Since this is all completly internal, we have some degree of trust, and I ...
6
votes
4answers
685 views
What kinds of SSL certificates are usable for encryption?
I know that Verizon SSL certificates cost close to $600.
There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
6
votes
3answers
666 views
Safe implementation of sharing encryption secrets (username, password) in the cloud
I'm building a multi-tenant (cloud) environment that needs to push out (or make available for download) configuration files for agents (background services) that receive this information. One of the ...
1
vote
3answers
502 views
RSA encryption : How to create “.arm” certificate file for Public key?
I am required to store a certificate as ".arm" file only for a public key that is intended for use in RSA Encryption.
I am currently able to generate the public key as ".key" file.
P.S I am new to ...
4
votes
4answers
739 views
Can an intermediate CA be trusted like a self-signed root CA?
Is it possible within the limits of the X.509 specification to mark an intermediate CA as trusted for a specific purpose, e.g. to verify a VPN, HTTPS etc. server key, just like it would work with a ...
2
votes
3answers
137 views
Transfer Client Certificate
What, if anything, could or would be embedded into a client-side certificate that would prevent it from "working" when transferred to a new client machine on a new network?
Being unfamiliar with the ...
19
votes
11answers
2k views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
2
votes
2answers
80 views
Does it make sense that OCSP returns state for the signer CA itself
I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...
0
votes
1answer
96 views
Can I export my digital certificate to this emtec usb
It is said here
http://www.emtec-international.com/sites/default/files/s530_aes_en_0.pdf
2048 bit RSA module: ready for PKI application
SHA256 data hashing: ready for digital signature
Does it ...
