Tagged Questions

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

3
votes
4answers
466 views

How can we trust PKI, for example, Verisign?

We want to send an encrypted message to Alice. We can ask her a public key over the network, encrypt with it a message and send that message back. It is bad, because someone can pretend to be Alice ...
23
votes
5answers
3k views

Why is Bruce Schneier recommending symmetric crypto over public key crypto

I just read the article written by Bruce Schneier, the crypto guru. In the article, he says : Prefer symmetric cryptography over public-key cryptography. But, he doesn't shed any light as to ...
3
votes
2answers
226 views

Requirements for qualified certificates in DIRECTIVE 1999/93/EC

DIRECTIVE 1999/93/EC at ANNEX I Requirements for qualified certificates states that one requirement for qualified certificates is (a) an indication that the certificate is issued as a qualified ...
4
votes
1answer
86 views

What is the meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC from ETSI TS 102 231 V3.1.2

From Technical Spec http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC a Root Certification Authority from which a certification path can be established down to ...
3
votes
2answers
585 views

Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure?

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode. I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline ...
2
votes
1answer
1k views

How do I share my S/MIME public key?

I have setup S/MIME encryption for my email address, and I'd like to allow people to download the public key from my website, rather than having to first receive an email from me. I want the public ...
4
votes
1answer
462 views

What are the alternative to PKI certificates in mesh networks?

My particular problem has to do with secure communications over a mesh network (http://en.wikipedia.org/wiki/Mesh_network), in particular man-in-the-middle (MITM) attacks. The difficulty is that mesh ...
6
votes
2answers
627 views

ECC based Client Certificate import in Chrome/Mozilla in windows

I have deployed a PKI server and successfully able to generate the ECC based user or client certificates. but non of the web browser support ECC as public key. I have tried different tools and also ...
5
votes
3answers
8k views

Is it possible to use wildcard certificates on multiple devices?

I have a server that I want to use a wildcard cert on. It runs multiple services. I purchase a wildcard cert so that I can protect mail.something.dom, www.something.dom, im.something.dom, ...
1
vote
1answer
76 views

Bootstrapping dual SMIME certificates for signing and encryption?

To maintain the non-repudiation property of signing while still having escrow for the encryption key, it's recommended to have a separate certificates (and pub-priv keys) for signing (say CertSign) ...
12
votes
2answers
469 views

Is PGP secure against a rogue keyserver?

Imagine Eve taking over the keyserver both Alica and Bob are using. By replacing Alices and Bobs public keys with her own, she can do a man-in-the-middle attack decrypting messages and relaying them ...
3
votes
2answers
144 views

Deciding whether to sign someones key

How do i decide whether to sign someones PGP public key? I was looking at some contact pages and they have a request for people to sign their public key. How serious of a commitment is it to sign ...
2
votes
1answer
251 views

What is the optimal result for the elliptic curve patent issue?

I saw an article this morning, discussing the fact that RSA and DH may be significantly less secure in the upcoming five years. Although the chance that this will materialize is small, I immediately ...
4
votes
4answers
13k views

SSL Client Certificate authentication

Is it possible to make a program which uses client certificate authentication with only public and private key (I have not generated any certificate, I have only public and private key). Simply, I ...
-2
votes
1answer
166 views

Posting public key [closed]

Should I put my public key on my website so that people can securely contact me. I have seen personal sites where there public key is at the bottom of the page such as this site by the computer ...
1
vote
1answer
191 views

What's the point of public key servers, if they usually don't require any authentication at all upon upload?

Do they offer any benefits at all to the security of key distribution?
0
votes
1answer
414 views

Splitting up symmetric key to be able to encrypt using 1024 bit RSA public key

The application which I am writing generates a 256 bit symmetric key everytime it wants to communicate with the server and encrypts the data and sends it to the server. This is to avoid storing the ...
1
vote
2answers
2k views

Public keys on OpenSSL vs PGP?

It is my understanding that PGP permits multiple public keys, and in SSL you can only extract one public key? Is this correct? Is there any brief high level run down between the two. I don't feel as ...
2
votes
3answers
447 views

If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?

Firstly, let me start by saying that I am not attempting to hack anyone or anything (not that I would know how or where to begin, if I were). For illustration purposes, let's call the primary key ...
5
votes
2answers
768 views

Root SSL certificates and browser support

I have given three certs to be install on nginx AddTrustExternalCARoot.crt PositiveSSLCA2.crt www_example_com.crt So I concat them into a chained cert cat www_example_com.crt PositiveSSLCA2.crt ...
5
votes
1answer
186 views

Password strengthening for PGP

I'm wondering about some of the semantics and security implications of using something like scrypt or bcrypt to "enhance" a password protecting a PGP private key. Essentially, I'm asking about the ...
1
vote
1answer
203 views

Generate Keytool Object from CSR

I have to develop an application which uses another application for generating a CSR. After generating the CSR I have to provide this CSR along with a SHA256 hash of the public key to a CA. The ...
3
votes
2answers
2k views

Checking SSL\TLS servers for null encryption support

I have a web server supporting SSL 3 and TLS protocols , the following are the supported cipher suites. TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can i ...
3
votes
1answer
604 views

Can you make a digital signature using the receiver's public key?

My question is, can you make a digital signature using the receiver's public key and then have the receiver verify the signature using his private key? I always thought that in order to create a ...
5
votes
2answers
135 views

Is there a reason to encrypt an encryption key with a certificate before storing it?

Suppose my .Net application which is installed in the client encrypts a data. I want to use a different key generated randomly for each client so each client doesn't know the key of the other. Someone ...
3
votes
2answers
576 views

How safe is a PGP private key that has “escaped”, but without its password?

Assuming your PGP private key is protected with a password, and it "escapes", but the password does not, how worried should you be? Obviously in the real world, you would immediately revoke the key ...
3
votes
4answers
250 views

Trust among the root-CAs

The system of CAs with the root-CAs and their subordinate CAs are IMHO in principle akin to the system of banks with their main sites and subsidiries. In the case of banks, a customer of a bank ...
6
votes
2answers
659 views

Why do embedded systems store server's public certificate in ROM?

In the home automation scenario, smart gateway can bridge the many smart devices with Internet. In many cases, a server's public certificate is stored in the embedded system's ROM during ...
6
votes
1answer
151 views

public key distribution from a central server

I'm trying to code up a encrypted communication program. Originally I was thinking that I would use public key cryptography and then I would keep the public keys in a database where users could query ...
2
votes
1answer
1k views

Are very short messages secure using Public Key Encryption? [duplicate]

Say Alice publishes her public key and then disappears from public view. Bob then needs to send a message to her that's either "OK" or ":(" so he takes her public key, encrypts his message and then ...
4
votes
2answers
4k views

Certificate Chain checking

I have a very specific question. A client verifies a sever by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (According to the ...
3
votes
2answers
189 views

Verifying the authenticity of a public key without manual intervention?

In RSA encryption it is said that ensuring the authenticity of the public key can be as important as the protection of the private key. An effective way of doing this is to have key custodians ...
3
votes
1answer
162 views

Design of system based on HTTPS, Client Certificates and custom CA

I have the following system: 2 application servers. At the beginning is installed the first server and later is installed the second one. A client access from a browser to both servers Application ...
2
votes
1answer
71 views

Remote network security option

I'm a bit confused with some different network security techniques. Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be ...
4
votes
1answer
289 views

PKI integration in MAC OS

I have setup an ejbca pki and integrated certificates in MAC OS for S/MIME signing and encrypting. I have also set up a CRL distribution point and put the CRL online available on an HTTP server. ...
3
votes
1answer
127 views

Validate XML-DSig by DVCS

Is it possible to validate an XML message (with XML-DSig or XAdES signature) by a Data Validation and Certification Server (RFC 3029)? Should it understand XML signatures or not? Could it parse XML? ...
5
votes
1answer
3k views

What is the difference between Key Escrow and a Recovery Agent?

From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later. But in the context of PKI, a Recovery Agent can also recover private keys. How ...
3
votes
3answers
345 views

Two-way secure communication using two pairs of public/private keys?

Let's say I want to create a protocol to securely communicate between two endpoints - each of the two endpoints know the other's public key and all data exchanged is encryted using one's public key ...
7
votes
5answers
4k views

A standard way to manually add a digital signature to a pdf file?

I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
8
votes
2answers
957 views

Is ECDSA breakable by quantum computers?

Is ECDSA secure from quantum computers? Will quantum computers be able to calculate it's private keys from the knowledge of the public key once there are working quantum computers?
3
votes
1answer
151 views

Clarification on Digital Certificates

I used the makecert tool to create: self-signed certificate client certificate These are the commands I used: makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
1
vote
1answer
287 views

are organizations that receive certificates considered “end entities” in a PKI?

I am trying to understand the term end-entity. Does this term just mean anybody that plays a role in a PKI system that is not a CA? So if I request a certificate from A who is a CRL issuer for ...
3
votes
1answer
229 views

Remote System Administration of an Encryption-Switch-Encrypted Infrastructure

I can't seem to find a decent explanation anywhere of the practicalities of remote system administration (e.g. SSH) of an encryption-switch-encrypted SAN-stored infrastructure. The environment will ...
11
votes
2answers
1k views

What does having an internal two-tier PKI protect against?

There are a lot of Best Practice documents that recommend having an offline Root CA and an Enterprise Subordinate CA that is signed by the root, for an internal Microsoft AD Certificate Services ...
3
votes
2answers
238 views

BOTs C&C channels

Can someone please explain the C&C for bots ? im reading a paper about Android bot , and its explaining something called URL flux as method of C&C . however i couldn't really get it , so ...
1
vote
1answer
1k views

Does Java's implementation of OCSP and CRL checking handle intermediate CAs?

I've read that Java provides OCSP and CRL checking for CertPaths via: Security.setProperty("ocsp.enable", "true"); System.setProperty("com.sun.security.enableCRLDP", "true"); Do these implementations ...
10
votes
3answers
5k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
1
vote
1answer
334 views

generating RSA keys through the browser

HTML5 has the element that sends an SPKAC to the server (as I understand it). But how do you do it in IE? One CA's websites gives me the following prompt: This Web site is attempting to perform a ...
1
vote
1answer
260 views

x509: must the signature algorithm and public key algorithm match?

I'm having trouble getting Firefox to send an encrypted message using a certificate, and I've found that the only difference between this one and others that work fine are that this one has a DSA ...
4
votes
1answer
814 views

Why is ECC more vulnerable than RSA in a post-quantum world?

Forgive me if this should be in the crypto sub, but sometimes the answers there are very mathematical and I would rather have an answer which is a bit lighter on the math but still strong on the tech ...