Tagged Questions

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

1
vote
1answer
52 views

Resign root CA as SUB?

Imagine I have a Microsoft root offline ca running since half year, but suddenly I want to include it in my company hierarchy, resigning it with the company official root, But I need both continue ...
15
votes
4answers
2k views

Is there any reason someone wouldn't use a longer key?

Larger key sizes are said to be more difficult to bruteforce; is there any reason someone would then decide to instead use a smaller key? Is there any negative effect in using a larger key size, such ...
0
votes
1answer
257 views

ECC Public Key length differs from bit representation

A 256 Bit ECC key-pair (256 Bit is supposed to be the length of the public key) generated with OpenSSL using this command from the manual: openssl ecparam -name secp256k1 -genkey -noout -out key.pem ...
0
votes
0answers
25 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
1
vote
1answer
97 views

Certificate pinning in a browser

I am trying to understand certificate pinning. Google started adding a whitelist of CA certs that they use for their certificates and if a cert for a google service is issued outside of this list ...
2
votes
3answers
101 views

How are public key certificates updated securely?

Let's say I get a new computer that's never been connected to the internet before. The first time I connect it to the internet, is it susceptible to a mitm attack while downloading its public key ...
2
votes
2answers
213 views

Certificate authority structure - best practices

I'm working for a company that sells software products to customers some of which do not have the resources and/or know-how to build and maintain their own CA (used for the SSL communication of our ...
2
votes
3answers
170 views

Are there commercially available hardware encryption devices over USB? [closed]

I'm designing a system where some combination of hardware and software (lets call it an appliance...) sends asynchronous secure archival to the cloud. By secure, I mean, AES-256 encrypted, with AES ...
0
votes
1answer
118 views

Automate the process of giving a user access to his encrypted messages, when the user loses his password

I'm implementing a way for users to share messages with other users. All users and admin-users have a unique key pair. A message can be sent from one user to multiple users. Admin-users, who always ...
0
votes
2answers
93 views

Can I add a password to an existing private key?

Say I have previously created a private/public key combination, and decided at the time to not protect the private key with a password. If I later decide to "beef up" security and use a ...
6
votes
1answer
655 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
0
votes
3answers
115 views

Where do my keys come from for requests over SSL? [duplicate]

From what I understand, when you send information to a website over SSL, you encrypt the information you send with their public key. However, if you want to be able to decrypt the information they ...
3
votes
1answer
68 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
0
votes
1answer
230 views

Security weaknesses in using RSA encrypted MD5 hash of certificate content

Suppose you have an Internet banking site based on a secure web server running the HTTPS protocol via port 443. The server authenticates itself to clients through an X.509 certificate signed by a ...
3
votes
1answer
462 views

Open source solution to capture and decrypt SSH traffic (with private key)?

I am looking for a free open source solution that is able to capture and decrypt SSH traffic given the fact that I can provide the server's RSA private key (something like SSH CryptoAuditor). Please ...
3
votes
3answers
104 views

What benefit is there to adding a password to your SSH key?

If you run the following command on a Linux/Unix machine, among other things, you get a prompt for a password: $ ssh-keygen -t dsa Enter passphrase (empty for no passphrase): What does adding a ...
1
vote
1answer
503 views

Generating ECDSA certificate and private key in one step

Similar to how it can be easily done for RSA: openssl req -x509 -nodes -newkey rsa:2048 -rand /dev/urandom -keyout example.key -out example.crt -days 365 I'd like to generate a ECDSA cert/key in ...
0
votes
0answers
35 views

Breaking public key pinning

I was reading through the IETF's Public Key Pinning Extension for HTTP (http://tools.ietf.org/html/draft-ietf-websec-key-pinning-12). The acknowledgements section has the following: Thanks to Trevor ...
0
votes
0answers
26 views

Looking for OpenSC compatibile token

I am currently proud user of Feitan ePass2003 with OpenSC, however it is not 100% reliable on Windows, on Linux it's just perfect. Anyway I started to looking and I have two candidates eToken Pro 64K ...
0
votes
1answer
83 views

Public Key Authentication

Is there another way to verify someones public key without a CA signing it? A challenge-response authentication including some sort of UID of the smartphone? Smartphone A generates asymmetric key ...
0
votes
4answers
140 views

Can a certification authority sign another CA's certs?

Disclaimer: I have low knowledge of X.509 and PKI, so I would appreciate an answer that is not entirely technical, i.e. by using real-life example scenarios.) I was searching for information ...
1
vote
1answer
176 views

OAuth and public keys

I'm trying to wrap my head around the whole concept of public keys and Oauth. I get the basic Oauth and PKI flow and the different actors involved but I'm still unsure how public/private keys play a ...
3
votes
2answers
117 views

What are Implicit and Explicit Certificates in Public Key Cryptography?

A Public key is certified by a Trusted Certifying authority, to ensure the integrity of the key and authenticity of the entity who claims to have the corresponding private key. In this Public Key ...
2
votes
2answers
188 views

What happens if the CA has knowledge of private keys?

In a classic PKI scenario, the certificate authority receives signing requests generated by an end-user which owns the keychain, and thus has his private key secret. Consider a scenario in which the ...
0
votes
1answer
212 views

How to become an internationally recognized certificate authority (CA)?

What's the procedure a certificate authority (CA) must follow to get internationally recognized, like Verisign or GlobalSign?
9
votes
6answers
2k views

Should I hash a password if it is randomly generated

The best practice is we should hash a user password using algorithms such as bcrpyt to protect the user, however, given the following conditions, is hashing in the backend still matters? the ...
1
vote
1answer
62 views

When does S/MIME require the other party's certificate and when is their key enough?

Trying to understand S/MIME implementation, I see that sometimes you must have the other party's certificate, and sometimes its enough to just have their public key. I'm confused as to when you need ...
-2
votes
2answers
78 views

Could a network host and process programs while securing against piracy?

Consider an ideal service hosting network, which: Lets programmers: Publish a program in such a way that it can't be retrieved. Associate a program with a wallet. Specify a cost per request and ...
2
votes
1answer
282 views

OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys

The company I work for has a few OpenVPN servers used by over 200 employees. The servers were deployed a few years ago using the default easyrsa settings and now we want to upgrade to stronger ...
2
votes
1answer
68 views

X509Certificate - How to set validation Policies?

I have an X509Certificate (say Certificate-A) for signing purpose. While validating this certificate, I have to check its path with Intermediate & Root certificate which I have implemented fully. ...
0
votes
1answer
79 views

list of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
2
votes
1answer
492 views

Using client certificates for website authentication

I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
3
votes
1answer
217 views

Heartbleed - is this scenario possible? how bad would it be?

Let's make the following assumptions: A trusted root certificate was being served with a vulnerable version of OpenSSL. Prior to public disclosure, a malicious entity was aware of and exploited the ...
1
vote
2answers
101 views

Where to find or purchase non-SSL certificates

I hope this is the right stackexchange - if not, please advise. As to the actual question: have a system we've developed that makes heavy use of asymmetric cryptography in various different ways ...
0
votes
1answer
243 views

Trusted Certificate Authorities - how do they work?

microsoft.com for example can use a Verisign Certificate for their domain. What are the chances that an attacker could ask verisign for a m1crosoft.com domain and get approved? It is very simillar, ...
-1
votes
3answers
395 views

Can a smart card with PKI certificate be used to protect a document?

I want to use a smart card (or USB cryptotoken) with a PKI certificate for manual authorisation. Is this possible? I want to put a file (e.g. a word file or even a simple text file) into a smart ...
4
votes
1answer
367 views

WebRTC P2P SSL - Where are the keys generated?

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, ...
-1
votes
4answers
1k views

When should I use symmetric encryption instead of RSA?

I'm currently using GPG RSA keys to encrypt binary files. Many people recommend using symmetric keys to encrypt large files, and then encrypt the symmetric key with a public key. At what file size ...
32
votes
7answers
4k views

How dangerous might be publishing a public key?

Maybe this question sounds obvious, but I wonder how dangerous might be publishing a public key for an asymmetric encryption system? I know public keys are meant for encrypting messages by anyone ...
4
votes
1answer
121 views

Public keys without the certificates

There are two clients and a server. Each client generates an RSA key pair and uploads public key to the server. The server associates the public key with the user identifier that is specified during ...
0
votes
1answer
284 views

Possible to Derive Private Key from Public Key Given Enough Computing Power? [closed]

Is it possible via brute force to derive a private key from a public key (such as a website's SSL certificate)? If so, how much computing power would you need to make it feasible, compared to say, ...
1
vote
2answers
319 views

SSL/TLS : Authentication mechanism

I have these doubts regarding authentication in SSL/TLS : Will there be an authentication involved for all SSL connections ? For eg. when I browse the internet, using the most up-to-date browser, ...
2
votes
1answer
224 views

Making a bitcoin-like secure mail protocol, how to tackle public keys?

I'm making a new mail protocol (probably already exists, but I've learnt a lot of things about security and privacy on the way). Here's the summary(much simpler if you know bitcoin's inner workings): ...
2
votes
2answers
262 views

How to maintain security and trust with a PGP keypair for a team or group of people?

I've seen many instances where a company or organization generates and uses a PGP keypair for a team or group of people. Most likely they all have a copy of the private and public keys on their ...
0
votes
2answers
123 views

Achieving PFS with public key cryptography

I'm seeking to understand how Perfect Forward Secrecy (PFS) works for non SSL applications. More specifically, I'm interested in how Moxie Marlinspike accomplishes this in TextSecure and other ...
3
votes
3answers
243 views

Why do you need to encrypt symmetric key?

I'm reading this pki article and as you can see near the bottom, the quick animation and description: The sending computer encrypts the document with a symmetric key, then encrypts the symmetric ...
1
vote
3answers
99 views

Detect message tampering without shared key and without certificate authority

Is it possible to detect if a message has been tampered with, without using MAC (i.e. shared key) and without using a "trusted" third party (i.e. certificate authority)? I'm pretty sure it's not, but ...
0
votes
1answer
32 views

OID for creation date/time (X509 certifcate field)

X509 certificates used in PKI{X} have notBefore and notAfter dates. I'd like to stamp a certifcate with a creation stamp, and the stamp is distinct from notBefore and notAfter. Is there an OID for a ...
1
vote
2answers
416 views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...
0
votes
3answers
160 views

Is it ok to send user's private key away, even if protected with a SSL channel?

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...