A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

6
votes
3answers
292 views

Why should my certificate signing request be signed by my private key?

Why should my certificate signing request be signed by my private key? Even if I obtain a bogus certificate out of someone else's public key, that is going to be useless, since in SSL the ...
5
votes
1answer
3k views

Adding certificate that resides on smartcard to the Microsoft store with private key ownership

How can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? In an enrollment system where users generate smartcard certificate ...
5
votes
2answers
133 views

Understanding Digital Certification as as a whole starting from a normal http request

I am trying to understand the difference between digital signature and digital certification and how they work as a whole together on a high level perspective. I hope gurus here can point to me if my ...
0
votes
1answer
69 views

OID for creation date/time (X509 certificate field)

X509 certificates used in PKI{X} have notBefore and notAfter dates. I'd like to stamp a certifcate with a creation stamp, and the stamp is distinct from notBefore and notAfter. Is there an OID for a ...
5
votes
1answer
1k views

How can a trusted intranet certificate be issued if they are being phased out?

I've just seen this article regarding the phasing out of intranet names on SSL certificates. However, CAs such as this one claim to still issue them and it will be "Trusted by all popular browsers" ...
3
votes
1answer
554 views

ECDSA/RSA certificates and cipher selection

In this image can someone tell me if a standard RSA certificate can support the EC*_RSA ciphers listed? If so do you create the typical RSA keys when you are creating the CSR? Also I am fairly ...
2
votes
1answer
44 views

Is there a way of achieving perfect forward security with one directional messages?

Using for example ECDH and ephemeral keys, it is possible for two parties to establish a shared key with perfect forward security, i.e. even if the long term keys are lost, it will not be possible to ...
3
votes
1answer
103 views

Designing a PKI environment

For our company I was given the task to design a durable, structured PKI environment for mainly client authentication purposes. We need a Root CA with a couple of Intermediate CAs, like this: ...
5
votes
2answers
212 views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
2
votes
1answer
208 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
3
votes
1answer
56 views

What happens if an OpenPGP subkey gets compromised?

In my GnuPG keyring, I have a primary key for creating keys and three subkeys: two for encryption and one for signing. All of then have the same password. If a subkey gets compromised, is it possible ...
1
vote
0answers
28 views

Can there be two certificates with a same serial number in the world? [duplicate]

Recently I came across this odd question. I hope, Serial number is unique across certificates signed by a particular CA. So is there any chance that two different CAs sign two different certificates ...
4
votes
3answers
966 views

How to secure a truecrypt container allowing access with multiple SSH public keys?

I would like to create a TrueCrypt container which can be accessed by multiple people. The container itself can be stored anywhere, e.g. in a shared folder in Dropbox or Google Drive, ... I would ...
2
votes
1answer
97 views

Correct way of signing and verifying a message

I have an object which I need to transmit to clients and I need the clients to know that I actually created the object. Obviously, this process involves in me signing the object with my private key, ...
2
votes
2answers
96 views

What exactly does `ssh -T user@domain verify` do?

The example I'm specifically thinking of is: ssh -T git@github.com verify Looking at the docs (man ssh) I can see that -T is the flag to "Disable pseudo-terminal allocation", but what implications ...
2
votes
2answers
168 views

Is there any mechanism to audit which signed certificates are unrevoked?

We are currently using EasyRSA and OpenSSL to manage our user VPN certificates for OpenVPN. The process we have in place currently is: User generates a CSR on their laptop and sends it to us to sign ...
1
vote
1answer
185 views

How does letsencrypt's ACME work?

I found the technical paper on ACME's inner workings, but I still feel a bit confused about the ways Let's encrypt's Domain Validation works. From what I already know, verification can be performed ...
0
votes
0answers
36 views

PKI, one sub CA for each certificate type VS one for all the certificates type

I'm trying to set a PKI where I can find 3 types of certificates: A client certificate to use in HTTPS communications A web server certificate to use in HTTPS communication A VPN certificate to use ...
1
vote
2answers
70 views

PGP Key Signing Robot DKIM Verified Emails

It occurred to me that DKIM verified emails, from major players (e.g., GMail), could open the door to more modern OpenPGP robot key signing authorities. The idea would be to ask people to send a key ...
1
vote
1answer
47 views

Prevent credential roaming for certain accounts/certificates?

I want to use credential roaming in Windows 7, 8 and 10 for EFS certificates, so users can access their encrypted files from any computer they login to. However, some of these users will also have ...
1
vote
1answer
30 views

Certificate binary matching

Is it an industry practice to do a binary matching of client public certificate when doing SSL with client authentication? I was thinking that if the client can successfully do the SSL handshake, ...
6
votes
1answer
1k views

What is the “PGP Global Directory Verification Key”?

In the server keys of the MIT, there is several signatures from "PGP Global Directory Verification Key". Example (from http://pgp.mit.edu/pks/lookup?op=vindex&search=0xB63024F96C73DA99): sig ...
1
vote
2answers
71 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
2
votes
1answer
445 views

Do SSH private keys always contain enough information to derive a public key?

I am working on a persistence model for SSH Private keys. The technology used is Java. Since the persistence structure of the public and private keys is pretty similar and using some of the Java APIs ...
3
votes
0answers
274 views

What are the use-cases for Hashicorp Vault PKI?

Hashicorp Vault has facility to auto generate server/client cert for authentication. https://vaultproject.io/docs/secrets/pki/index.html While it makes sense from certificate management point of view,...
1
vote
1answer
74 views

Is it safe to publish my development private key?

For my development environment, the following three SSL files allow me to access my application from https://localhost on my local machine. Private key: server.key Certificate signing request: ...
0
votes
1answer
153 views

Generate RSA2 key in OpenSSH format in windows

I have to generate a key, RSA v2 in OpenSSH format. I am a bit confused. I am trying to generate it using Putty key generator. There I see an option SSH2-RSA and SSH1-RSA. So is SSH2-RSA the RSA2 key ...
20
votes
5answers
5k views

When can I commit a Private Key to source control?

That is to say, in what cases does it make sense to commit an unencrypted keypair to internal source control like SVN or Git? Related question that discusses an encrypted private key: Is it bad ...
0
votes
0answers
67 views

Mysql SSL handshake: symmetric key exchange with CA or server key?

I have my MySQL database set up to require server and client identify verification, with both presenting their certificates signed by the same CA (mysql user was set up with 'require X509'). ...
2
votes
2answers
780 views

OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys

The company I work for has a few OpenVPN servers used by over 200 employees. The servers were deployed a few years ago using the default easyrsa settings and now we want to upgrade to stronger ...
3
votes
3answers
459 views

Should I use more than 2048 bits in my SSH-2 RSA Key?

I've been asked to generate a public key with PuTTY key generator. The default is 2048 bits, should I add additional bits to the generated key? Or is it unnecessary?
1
vote
1answer
113 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
1
vote
3answers
303 views

Using a stolen certificate on a server

Yesterday I asked the following question regarding what would happen if you placed a stolen certificate on your own server and edited the 'host' file so that the DNS name matched: Could a stolen ...
6
votes
2answers
569 views

Could a stolen certificate show as trusted?

I have recently started learning about PKI and have the following question/s. As far as I know a signed certificate contains the domain name of the server that the certificate will be placed upon. ...
0
votes
2answers
98 views

Public key - private key question

I have a query about public/private key encryption that I hope someone can answer. So as I understand it: Client connects to server and server responds with certificate Client pulls the public key ...
9
votes
3answers
1k views

Why is the subject's public key not used for encryption in SSL? [duplicate]

As far as I understand the workings of SSL - the client generates the pre-master secret and sends it to the server encrypted using the server's public key. Now, both parties perform some steps to ...
-2
votes
3answers
54 views

Changing public key of someone to read and change messages that are encrypted to him

If I am able to change someone's public key, is it possible to alter the key to later read and change his encrypted messages in an easy way? Just remember I don't have his private key.
5
votes
1answer
151 views

SSL certification path building

Background Some SSL certificates have two certification paths. In other words: the trust-chain can take two paths. I installed all the certificates for one path but that gave an HTTPS error on some ...
0
votes
3answers
292 views

Transmitting private keys between devices? [duplicate]

I have an app where a users' device create a public/private key and all communication to this user is done by encrypting against their public key, which is stored on a server and sent to other clients ...
3
votes
1answer
58 views

Two-tier PKI without OCSP?

I am currently in the planning phase of a two tier Windows PKI using this deployment guide, and I am stuck concerning the use of OCSP and the online responder role of ADCS. The guide mandates that ...
9
votes
2answers
425 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
1
vote
0answers
15 views

Partially Valid PKI certificate--But still we are able to login to our Application [closed]

User having a PKI card with an invalid PKI certificate (Among the two PKI certificates – One certificate is revoked (Damaged/ officially Cancelled) and another certificate is active)and try to login ...
4
votes
1answer
128 views

My OpenPGP private keys are set up with sub-keys. What happens if I revoke a sub-key and re-issue a new one?

I have set up my OpenPGP keys with sub-keys, following the general instructions laid out in "Creating the perfect GPG keypair." The general gist is that you create a "master keypair" which is not ...
2
votes
2answers
63 views

How does Certificate Transparance detect fake or forked logs?

I am trying to understand Certificate Transparency. Let's say I want to snoop on somebody's email. So I go hack or bribe a CA, have them issue a certificate for google.com, and then I present it when ...
0
votes
3answers
526 views

Does SSL/TLS provides non-repudiation service?

I understand that SSL/TLS provides confidentiality and integrity. But does it provide non-repudiation? I read in one book it does not. But I wonder why? What does it mean? If it means Alice can ...
-1
votes
2answers
619 views

How do openvpn/easy-rsa generated keys map to RSA algorithm variables?

I was reading up a little on openvpn and pki infra and am confused by some of the questions posed by my colleague. :) This answer did help me understand more: http://security.stackexchange.com/a/12369/...
-1
votes
1answer
92 views

Why are pgp keys limited to a number of bits?

I am wondering : why does pgp keys have a fixed number of bits. They can be 2048,4096, but why not 56000 or 23 bits ? Is there a specification, or ISO, that was made to limit thoses Keys. Why? If a ...
0
votes
2answers
113 views

Where are certificates used to prove identity and why aren't DNS responsible for the job?

I've been reading about how certificates are used to verify the owner of a public key in asymmetric encryption. Right now everything seems really theoretical to me and I'd like to know how this works ...
2
votes
2answers
133 views

Is it possible to protect a DER private key with a password?

I want to write an API, based on OpenSSL, that can convert an RSA private key stored as DER to the PEM format. I'm just wondering if a DER key can be password-protected. I've searched the OpenSSL ...
4
votes
2answers
5k views

Recommended key usage for a client certificate

My program has the following flow: a client sends a CSR to server, the server sends back a client certificate and after that the client communicates with the server to a path that requires a ...