A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

1
vote
1answer
45 views

Does SSL/TLS have the feasibility of detecting malicious things during transmission? [closed]

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly ...
2
votes
1answer
445 views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
1
vote
1answer
37 views

Can a PKCS12 file be distributed over insecure channel?

Is the PKCS12 only as secure as the password protecting private keys ? Can I distribute the p12 file over an insecure channel ?
9
votes
8answers
526 views

Authencity of information displayed on an untrusted device

Suppose I have a (bluetooth/usb) device which needs to displays information on an external pc/phone. Is there a simple and effective method to garantuee that the information displayed hasn't been ...
4
votes
3answers
122 views

How can I create a unique identifier that can not easily be reversed?

I've been working on the design of a longitudinal study and one requirement is: all participants will have a unique identifier that is not reversible from the data storage/analyst side of the study ...
0
votes
1answer
149 views

PGP Key publishing on MIT PGP Public Key Server [duplicate]

I have a public pgp key, so that users can send me an encrypted message. Ofcourse, any user that wants to send me a message, wants to verify that the public key (s)he has, really belongs to me. From ...
2
votes
1answer
198 views

Openssl adding a telephone number or cell number to the distinguished_name

In the openssl.cnf file, I see fields like countryName, stateOrProvinceName etc which are typically present in the distinguished_name. Where can I get a list of fields which can be added to the ...
27
votes
4answers
3k views

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single ...
2
votes
1answer
296 views

Making a bitcoin-like secure mail protocol, how to tackle public keys?

I'm making a new mail protocol (probably already exists, but I've learnt a lot of things about security and privacy on the way). Here's the summary(much simpler if you know bitcoin's inner workings): ...
0
votes
1answer
98 views

Compromised submarine cables and the consequences to internet?

I recently read an article that Google wants to build a submarine cable connecting to my country supposedly to increase overall speed and while I hope my government will never allow this kind of thing ...
1
vote
0answers
32 views

Security schemes regularly in use on cloud

I've been looking into how connections are managed in the cloud, in order to better understand the threats users and their deployments may face. The most important and common ones in use seem to be ...
0
votes
1answer
16 views

Web of Trust: What is “signatory trust”?

I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust. What is an easily understandable definition of signatory trust? An ...
4
votes
1answer
130 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of ...
2
votes
1answer
28 views

Is there a way of achieving perfect forward security with one directional messages?

Using for example ECDH and ephimeral keys, it is possible for two parties to establish a shared key with perfect forward security, i.e. even if the long term keys are lost, it will not be possible to ...
3
votes
1answer
56 views

Installing a CA only for specific domains

For many reasons, it's often convenient for organizations to have their own CA (self-signed or otherwise). As I understand it, adding the CA certificate to a OS or browser will make it trust the ...
3
votes
1answer
66 views

What encryption and signature systems (don't?) allow for plausible deniability of the OP's key being used?

I need to prevent Mallory from blindly matching encryption and signing keys to messages Hypothetical scenario: A user creates a public key An encrypted or signed payload exists. With only public ...
0
votes
2answers
146 views

Typical mistakes when implementing digital signatures?

I am looking for a list of typical mistakes someone can make when implementing digital signatures for a software. And of course why they are mistakes and how an attacker could take advantage of them. ...
1
vote
1answer
44 views

Banking card certificate

Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ? Perhaps a standard exists or a de-facto ...
1
vote
0answers
86 views

Distribute S/MIME public keys and CA cert for email security

I have my own CA. I want to distribute S/MIME certificates for 10 different users. I saw S/MIME keyservers from http://wiki.cacert.org/KeyServers, but I don't want to use public servers. What is the ...
8
votes
3answers
780 views

Does the SSL encryption strength or validation level of a website really matter?

When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart. Immediately there seems to be 4 major ...
2
votes
1answer
72 views

Smartcard - main differences between .NET and Java smartcard?

My question focuses on the differences regarding PKCS11 implementation between a .Net and a Java smartcard. More generally, do smartcard use a specific "OS" (or firmware) and only differ in the ...
3
votes
1answer
92 views

PKI - Why Root CA is in intermediate CA section?

I can't understand why, when I accept to "install" a custom self signed Root CA on IE browser, the root certificate ends up in the "intermediate CA" section, rather than in "Root CA" section in the ...
16
votes
8answers
2k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...
49
votes
1answer
3k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
1
vote
3answers
95 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
4
votes
2answers
181 views

Using a verified certificate to sign others

This relates to PKI and certificates generally but websites more specifically. Could you get a verified certificate from a CA that is signed and fine for use, and then use it to sign your own ...
11
votes
1answer
231 views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
1
vote
1answer
149 views

OpenTSA and PKCS11

We are planning to implement the time-stamping service (RFC 3161) using OpenTSA and we wanted to know: Does OpenTSA support PKCS #11 (Cryptoki) to talk to HSMs? BTW: I did not find documentation or ...
1
vote
0answers
43 views

Use of RSA in Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...
0
votes
2answers
97 views

SHA1 - S/MIME and CRL validity after deprecation?

In an internal PKI using SHA1 for hashing, will S/MIME signature and CRL/ARL signature be considered invalid in the next few years (SHA1 Deprecation) ? End certificates can be revoked, CA ...
20
votes
3answers
29k views

Expired SSL Certificate Implications

What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?
0
votes
0answers
71 views

How should I organize my keys?

Suppose I have a set of computers with variegate level of trust (for example): I fully trust my own desktop pc at home I trust a bit also my smartphone, but I know it could be stolen I trust a bit ...
2
votes
3answers
89 views

Email Encryption

I'm hoping someone can point me in the right direction. If I wanted to implement email encryption within an organisation what would be the best way? I've been searching the web tonight but all my ...
13
votes
2answers
1k views

Does it matter which key is considered private and which public?

Mathematically, is there a difference which set of characters is private_key and which one is public_key? @Edit At the moment of asking I was thinking on RSA, not asymmetric crypto in general.
0
votes
1answer
121 views

How can I generate some public and private keys on both sides with low overhead?

We have an Authority Center (CA) generating some public and private keys for each client (more than one pair for each client). One method for sending keys to client is sharing a secret key between CA ...
0
votes
0answers
56 views

Is ADCS overkill just to replace self-signed certs?

Several of our internal applications are either not using SSL certificates, or are using self-signed certificates. I wanted to utilize ADCS to create a trusted, internal-only root CA that our browsers ...
0
votes
2answers
62 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
0
votes
2answers
363 views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
0
votes
1answer
102 views

PKI - Security concerns when changing a certificate hash algorithm

Suppose I want to change the hash algorithm used for a certificate signature (ex: SHA1 to SHA2). Is it better to revoke the previous certificate and issue a new one with expected hash algorithm ? Or ...
1
vote
1answer
138 views

Automate the process of giving a user access to his encrypted messages, when the user loses his password

I'm implementing a way for users to share messages with other users. All users and admin-users have a unique key pair. A message can be sent from one user to multiple users. Admin-users, who always ...
0
votes
4answers
108 views

Temporarily suspending a Certificate Authority's Certiticate

The PKI RFC talks about revoking or suspending certificates. It also talks about revoking CA certs. However, I could not find anything about whether a CA or a Sub CA's certificates can be revoked or ...
2
votes
1answer
109 views

Why can't I upload a new ECC key to key servers, which is supported by GnuPG 2.1?

My OpenPGP key is soon to expire so I wanted to create a new one. GPG 2.1 came out a month ago including ECC support and I wanted to try the new key types. So I have generated a brand new ed25519 ...
1
vote
1answer
53 views

Definitions of PKCS#11 abbreviations

Is there a complete definition list for all CKx abbreviations in PKCS#11? I believe I gathered most of them: CK = Cryptoki CKA = ... Attribute CKC = ... Certificate type CKD = ... Key derivation ...
0
votes
0answers
115 views

Why is the public key extracted from the CSR different than the one extracted from the associated certificate?

I am playing around with pyopenssl. I am trying to extract the public key from a CSR and to check if it is the same than the one I find in the associated certificate. There is a small difference ...
1
vote
4answers
116 views

Data anonymization/ encryption requirement

I did check out the previous postings and didnt find what I was looking for- apologies if this is a repetition. I am working on an analytics engagement for a customer and he needs to share access to ...
3
votes
1answer
104 views

Must the distinguished subject name of an issued SSL Certificate match that of the generated Certificate Signing Request?

For example: from Issued SSL Certificate: CN = abc.com.my, OU = Room, O = House, C = MY from generated CSR: CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY Is it legal for a ...
1
vote
0answers
256 views

If even Apple cannot properly install certificate [closed]

I've just installed a new copy of Mozilla Firefox/29.0 SeaMonkey/2.26.1 on a new Mac with OS X 10.9.4, and I'm getting an error message in place of a webpage when trying to access ...
3
votes
3answers
3k views

Extracting the PGP keyid from the Public key file?

is there a way via an CLI tool or some kind of API to extract the PGP KEY ID from the PGP PUBLIC KEY BLOCK ? I did find the hexa value of the key in the binary file, however I guess the position is ...
1
vote
2answers
189 views

Certificate security in intranet environment?

We have this topology in our company: A new rule says that each document being sent by Outlook should be encrypted. We decided using PGP. We already have a certificate (self-signed). The problem ...