A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

15
votes
2answers
1k views

Which SSH security is stronger? 2 Factor or Public key

For SSH authentication, which is more secure? 2 Factor Authentication using a USB token/Google Authenticator(time based) OR Public/private key with password Or could they be both used at the same ...
4
votes
4answers
1k views

Why would someone want to encrypt RSS feeds?

I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
3
votes
2answers
1k views

x.509 CRLs: next update?

An X.509 certificate revocation list contains a field specifying when the next such list is expected to be issued. I'm trying to figure out the importance of this field...I know that sometimes ...
4
votes
3answers
2k views

How is an X509 certificate signer verified?

Lets say I create a self-signed certificate A and use it to issue certificate B. I put certificate A in my trusted root authorities so that all certificates signed by it are accepted. My question is, ...
8
votes
2answers
482 views

X.509 certificate policies question

I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies. To quote from the X.509 RFC: In an end entity certificate, these ...
15
votes
4answers
4k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
7
votes
1answer
281 views

Why is there no Domain CA?

I was asked to deliver a signed SSL certificate for an IIS server for a client. I have previously done this for the same client/domain before, so it start to seem like an unnecessary expense to hold ...
6
votes
3answers
227 views

Renew digital certificate

If I have deployed a digital certificate on a webserver and if it needs to be renewed then what steps do I need to follow? Will I need to generate a new longer public key private key pair? Why do ...
0
votes
4answers
933 views

Does a renewed certificate open old messages?

I have a digital certificate that I use to exchange messages with peers, my certificate expiration date is due next year, suppose I renew this certificate before it expires, will I be able to open the ...
4
votes
2answers
1k views

Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?

Suppose I have several independent PKIs that are used Two internal PKIs: One with SHA1 support the other with Suite B algorithms. A partner who I trust and have a policy map with. Since both my ...
3
votes
1answer
877 views

What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?

I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance. For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
3
votes
2answers
156 views

In practice, does crypto software accept a *.com or or even a *. certificate?

Assuming this will be done with your own PKI, and not a public trusted CA. Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
24
votes
3answers
934 views

A Different Approach to PKI

After yet another failure of the public key infrastructure, I was thinking about how broken the whole thing is. This business of undeniably associating an identity with a public key, and all the work ...
1
vote
2answers
632 views

Difference between Encryption and Verification certificate

What is the difference between the Encryption certificate and Verification certificate in Outlook? When exchanging certs, it just requires a digitally-signed message to be sent. It seems as though ...
1
vote
1answer
292 views

How do I verify, parse and process the results of the HTML5 keygen tag?

I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST: ...
4
votes
1answer
133 views

Share or not share public key for servers?

In order to encrypt communications from our (custom) client to our (custom) servers our current scheme is a bit like this: Client uses the bundled public key A to encrypt some random key material. ...
1
vote
2answers
645 views

Self-signed certificates usage for code signing purposes

if a self-signed certificate is trusted by the client's certificate store, then it should be fine to be used, since the client trusts the issuer of the certificate as it does any other trusted CA ...
3
votes
1answer
339 views

What are the best practices for RSA-based security?

I'm building a platform with a strong security. Security is based on encrypting data with AES-256 encryption. Yet the system needs to "share" these keys among the users and they need to be transferred ...
3
votes
2answers
698 views

What hardware technology (GPU, FPGA) is fastest at generating RSA keys?

I'm interested in generating RSA keys in rapid succession and am looking for the correct hardware to so. I think what I'm looking for is very similar to a brute force attack on RSA keys, but my ...
5
votes
3answers
2k views

What issues arise from sharing a SSL certificate's private key?

Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website. I have ...
4
votes
2answers
539 views

What did the certificate authority do with my CSR?

I needed to reach a web service which is not mine. The IT department of that web service has asked me to send them a CSR (certificate signing request). Then, he will send me back a signed certificate ...
2
votes
1answer
130 views

how does OpenSSL create X.509 certs from SPKACs?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
2
votes
3answers
1k views

Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”

Maybe this is a superuser.com question, I don't know. Anyway, I want my cert to show up like this when I double click on it in Windows: If I just double click on a random cert I get this: The ...
4
votes
1answer
113 views

What physical, electronic, and software characteristics are important in a smart card?

I'm evaluating smart card readers to store a number of private keys, but don't know where to start. What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
1
vote
1answer
179 views

spkac: what is the purpose of the challenge string?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
1
vote
4answers
325 views

RSA and encrypted authentication

Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication ...
2
votes
3answers
173 views

Given a large enough sampling of public keys could one begin to identify a private key?

For example, an ISP or government capable of tracking millions of keys being exchanged. Would that provide a sample large enough to be able to identify the private key on either end?
2
votes
1answer
402 views

X.509 certificate policy mapping question

So I'm a little confused how X.509 certificate policy mappings work. So let's say the following depicts my cert chain: root CA ---> intermediary CA ---> client cert Would the root CA have a ...
4
votes
4answers
277 views

Securely publishing GPG keys

This is probably a stupid question/vaguely defined, but I need to ask it anyway. I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
9
votes
2answers
4k views

SSL Certificate revocation check

In the SSL protocol I don't see where the certificate is checked for revocation status. https://developer.mozilla.org/en/Introduction_to_SSL Is the Certificate Revocation and Status Checking not ...
22
votes
4answers
12k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
3
votes
1answer
145 views

Can we use a public key scheme for performing cryptographic commitment

Is it possible to use a public key scheme such as DSA as a commitment scheme? Are there any problems with doing this?
9
votes
3answers
1k views

Difference between Certificate Authorities

I've been wondering for a long time about is. There are many certificate authorities having different types of certificates. But even certificates of the same security level cost a lot more with one ...
1
vote
1answer
103 views

How are root CAs for SSL distributed?

For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser. But what about for firefox and chrome? ...
6
votes
2answers
591 views

Why would the downloaded certificate show a different end-date as compared to the same certificate when viewed online?

This is sort-of a follow-up to my previous question What fields in a suspicious certificate should I look at? Chrome just presented the warning icon against the certificate presented by ...
4
votes
1answer
229 views

where to download revoked certificates from

I don't want the certificate revocation lists - I want actual full on revoked certificates for test purposes. For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and ...
4
votes
3answers
2k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
3
votes
1answer
73 views

Within a CSR, is there a field to have the MS PKI server change the default cert filename

I'm not intimately familiar with MS PKI, but it was a question that came up in a discussion for an issue a coworker is having. When you input the request fields manually on a PKI server, the cert ...
-3
votes
1answer
110 views

How to distribute public keys in the network without losing its credibility? [closed]

How to solve the key distribution encrypted with the public key? How to make public key authentication? How to distribute public keys in the network without losing its credibility?
3
votes
1answer
118 views

CMC (RFC 5272) compatible CA server

I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
10
votes
4answers
899 views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...
1
vote
2answers
145 views

Certificate Security in intranet Environment?

We have this topology in our company : A new rule says that each document being sent by outlook should be encrypted. we decided using PGP. We already have a certificate ( self signed). the ...
4
votes
1answer
314 views

Is OpenPGP encryption a valid replacement for SSL when passing messages?

I am writing an application that occasionally needs to transmit larger messages to other servers on the internet without allowing people to snoop on the traffic. The normal way to handle this is to ...
10
votes
2answers
851 views

Is it okay to widely share the RSA key fingerprint for a host?

When you ssh into a remote box for the first time or if the remote host's key fingerprint has changed (from what's stored in your known_hosts file) you get a warning and you are shown the fingerprint ...
5
votes
1answer
320 views

Which attributes of a X509v3 certificate are never really used?

Are there any extensions/extended key usage attributes of a X.509Certificate that are rarely or never used in practice? Either due to never being part of an issued certificate or because they are ...
3
votes
1answer
650 views

What are the Netscape Cert Type attributes? Why/when are they needed?

What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions? Example: There is the Client/Server Extended Key Usage (X.509) but there is ...
2
votes
2answers
632 views

Revoked certificate validation using past times

I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past. Unfortunately I have problems verifying revoked ...
1
vote
1answer
471 views

Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?

I'm confused by the difference in behavior of ssh clients I'm seeing on two different hosts. Just to be clear, this is the scenario: "macbox" OS X using OpenSSH_5.2p1 ssh client "sunbox" Solaris 10 ...
3
votes
3answers
115 views

Can the root of a system access to unencrypted data when using a double tunnel?

I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C). A-->B-->C I created a ssh tunnel from A to B and forwarding the port 22 ...
1
vote
0answers
169 views

Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]

I have installed openssl and now the rsa_test.c is running fine. What I want to do is: Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey. The public key contains the ...