A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

0
votes
0answers
43 views

Breaking public key pinning

I was reading through the IETF's Public Key Pinning Extension for HTTP (http://tools.ietf.org/html/draft-ietf-websec-key-pinning-12). The acknowledgements section has the following: Thanks to Trevor ...
1
vote
0answers
31 views

Looking for OpenSC compatibile token

I am currently proud user of Feitan ePass2003 with OpenSC, however it is not 100% reliable on Windows, on Linux it's just perfect. Anyway I started to looking and I have two candidates eToken Pro 64K ...
0
votes
1answer
87 views

Public Key Authentication

Is there another way to verify someones public key without a CA signing it? A challenge-response authentication including some sort of UID of the smartphone? Smartphone A generates asymmetric key ...
0
votes
4answers
223 views

Can a certification authority sign another CA's certs?

Disclaimer: I have low knowledge of X.509 and PKI, so I would appreciate an answer that is not entirely technical, i.e. by using real-life example scenarios.) I was searching for information ...
1
vote
1answer
405 views

OAuth and public keys

I'm trying to wrap my head around the whole concept of public keys and Oauth. I get the basic Oauth and PKI flow and the different actors involved but I'm still unsure how public/private keys play a ...
3
votes
2answers
201 views

What are Implicit and Explicit Certificates in Public Key Cryptography?

A Public key is certified by a Trusted Certifying authority, to ensure the integrity of the key and authenticity of the entity who claims to have the corresponding private key. In this Public Key ...
2
votes
2answers
192 views

What happens if the CA has knowledge of private keys?

In a classic PKI scenario, the certificate authority receives signing requests generated by an end-user which owns the keychain, and thus has his private key secret. Consider a scenario in which the ...
1
vote
1answer
306 views

How to become an internationally recognized certificate authority (CA)?

What's the procedure a certificate authority (CA) must follow to get internationally recognized, like Verisign or GlobalSign?
9
votes
6answers
2k views

Should I hash a password if it is randomly generated

The best practice is we should hash a user password using algorithms such as bcrpyt to protect the user, however, given the following conditions, is hashing in the backend still matters? the ...
1
vote
1answer
98 views

When does S/MIME require the other party's certificate and when is their key enough?

Trying to understand S/MIME implementation, I see that sometimes you must have the other party's certificate, and sometimes its enough to just have their public key. I'm confused as to when you need ...
-2
votes
2answers
109 views

Could a network host and process programs while securing against piracy?

Consider an ideal service hosting network, which: Lets programmers: Publish a program in such a way that it can't be retrieved. Associate a program with a wallet. Specify a cost per request and ...
2
votes
1answer
435 views

OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys

The company I work for has a few OpenVPN servers used by over 200 employees. The servers were deployed a few years ago using the default easyrsa settings and now we want to upgrade to stronger ...
2
votes
1answer
72 views

X509Certificate - How to set validation Policies?

I have an X509Certificate (say Certificate-A) for signing purpose. While validating this certificate, I have to check its path with Intermediate & Root certificate which I have implemented fully. ...
0
votes
1answer
102 views

list of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
3
votes
1answer
823 views

Using client certificates for website authentication

I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
3
votes
1answer
221 views

Heartbleed - is this scenario possible? how bad would it be?

Let's make the following assumptions: A trusted root certificate was being served with a vulnerable version of OpenSSL. Prior to public disclosure, a malicious entity was aware of and exploited the ...
1
vote
2answers
115 views

Where to find or purchase non-SSL certificates

I hope this is the right stackexchange - if not, please advise. As to the actual question: have a system we've developed that makes heavy use of asymmetric cryptography in various different ways ...
0
votes
1answer
566 views

Trusted Certificate Authorities - how do they work?

microsoft.com for example can use a Verisign Certificate for their domain. What are the chances that an attacker could ask verisign for a m1crosoft.com domain and get approved? It is very simillar, ...
0
votes
3answers
565 views

Can a smart card with PKI certificate be used to protect a document?

I want to use a smart card (or USB cryptotoken) with a PKI certificate for manual authorisation. Is this possible? I want to put a file (e.g. a word file or even a simple text file) into a smart ...
4
votes
1answer
570 views

WebRTC P2P SSL - Where are the keys generated?

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, ...
-1
votes
4answers
2k views

When should I use symmetric encryption instead of RSA?

I'm currently using GPG RSA keys to encrypt binary files. Many people recommend using symmetric keys to encrypt large files, and then encrypt the symmetric key with a public key. At what file size ...
34
votes
7answers
4k views

How dangerous might be publishing a public key?

Maybe this question sounds obvious, but I wonder how dangerous might be publishing a public key for an asymmetric encryption system? I know public keys are meant for encrypting messages by anyone ...
4
votes
1answer
189 views

Public keys without the certificates

There are two clients and a server. Each client generates an RSA key pair and uploads public key to the server. The server associates the public key with the user identifier that is specified during ...
0
votes
1answer
1k views

Possible to Derive Private Key from Public Key Given Enough Computing Power? [closed]

Is it possible via brute force to derive a private key from a public key (such as a website's SSL certificate)? If so, how much computing power would you need to make it feasible, compared to say, ...
1
vote
2answers
542 views

SSL/TLS : Authentication mechanism

I have these doubts regarding authentication in SSL/TLS : Will there be an authentication involved for all SSL connections ? For eg. when I browse the internet, using the most up-to-date browser, ...
2
votes
1answer
292 views

Making a bitcoin-like secure mail protocol, how to tackle public keys?

I'm making a new mail protocol (probably already exists, but I've learnt a lot of things about security and privacy on the way). Here's the summary(much simpler if you know bitcoin's inner workings): ...
2
votes
2answers
330 views

How to maintain security and trust with a PGP keypair for a team or group of people?

I've seen many instances where a company or organization generates and uses a PGP keypair for a team or group of people. Most likely they all have a copy of the private and public keys on their ...
1
vote
2answers
210 views

Achieving PFS with public key cryptography

I'm seeking to understand how Perfect Forward Secrecy (PFS) works for non SSL applications. More specifically, I'm interested in how Moxie Marlinspike accomplishes this in TextSecure and other ...
3
votes
3answers
331 views

Why do you need to encrypt symmetric key?

I'm reading this pki article and as you can see near the bottom, the quick animation and description: The sending computer encrypts the document with a symmetric key, then encrypts the symmetric ...
1
vote
3answers
161 views

Detect message tampering without shared key and without certificate authority

Is it possible to detect if a message has been tampered with, without using MAC (i.e. shared key) and without using a "trusted" third party (i.e. certificate authority)? I'm pretty sure it's not, but ...
0
votes
1answer
42 views

OID for creation date/time (X509 certifcate field)

X509 certificates used in PKI{X} have notBefore and notAfter dates. I'd like to stamp a certifcate with a creation stamp, and the stamp is distinct from notBefore and notAfter. Is there an OID for a ...
1
vote
2answers
609 views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...
0
votes
3answers
171 views

Is it ok to send user's private key away, even if protected with a SSL channel?

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
4answers
127 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
1
vote
1answer
151 views

Is there any way to restrict multiple access to my server at the same time using one client certificate?

My Server is Windows 2008. Mr. X is accessing my web server using Mr. X's certificate. In that time, an outsider is also trying to access my server using Mr. X's certificate (somehow he got it). Is ...
0
votes
2answers
107 views

Protecting against/detecting a specific Man in the Middle attack

I'm working on a specific (hypothetical) situation, where I have two client machines attempting to perform a public key exchange, via a server. There's no possibility for a direct connection between ...
1
vote
3answers
991 views

How does encryption/decryption work when one generate random key?

I am new to this and want to ask a basic question. Suppose I used my password (say "ABC123") to generate a key using the PBKDF2 algorithm (or any such algorithm). For encrypting a file I'll input my ...
1
vote
0answers
307 views

Import securely RSA private key through PKCS#11

I have a cryptographic device that supports the following mechanisms: How I could securely import RSA private key into it? Because there is no support for wrap/unwrap using symmetric key is there ...
1
vote
1answer
59 views

Message and Key Security

I'm reading Post-Quantum Cryptography, and in the page 106 in the beginning of the Section 3 it says: In this section we consider the message security (opposed to key security) of code-based ...
1
vote
1answer
45 views

In a 3 tier (or more) PKI, is it permissible that a Name Constraint only be defined on the middle tier?

I'm working with an Issuing CA that doesn't support name constraints that are defined at a higher level. Assuming that it issues certificates that are compliant with the Name Constraints that are ...
3
votes
1answer
317 views

Internal code-signing certificate on Windows

I'm looking to improve defense-in-depth on a system, primarily by closing some holes in injected DLLs. Certain applications installed on the system cause helper DLLs (e.g. shell extensions, BHOs, ...
1
vote
3answers
397 views

Why can't someone break email or https encryption by somehow getting access to the encryption key?

To repeat, "Why can't someone break email or https encryption by somehow getting access to the encryption key?" In other words, why can't someone intercept the key, or the algorithm to create the ...
6
votes
5answers
331 views

Why are private certificates not trusted?

When we go to websites that have generated certificates themselves you see this red screen that says do not go there!: However when it is trusted by some companies it's all good. So I have a couple ...
1
vote
3answers
216 views

Using public/private key without signed certificate

I am working on a java program and I am now working on its network security. I want to use a secure connection since it transfers a lot of sensitive information. On all security guides it is mentioned ...
0
votes
1answer
94 views

Public Key Cryptography : Key length

While symm. crypt. has around 256 bits of a key, why does public key crypt have a key that is much longer (1000's) ???
5
votes
3answers
1k views

Does checking the fingerprint of a self signed certificate improve security?

I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
7
votes
3answers
3k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
1
vote
1answer
108 views

Protecting data on an embedded device

I am to release a system-on-chip device that, during its lifetime, will come to store sensitive data. I want to make that data hard to extract or duplicate. Encrypting is good for dealing with MiTM, ...
2
votes
2answers
2k views

Cryptography behind chip based credit cards (smart cards)?

Why are chips safer than magnetic stripes? The answers to the above question explain that the chip based cards can not be cloned as the "secret number" is embedded in the chip and protected by the ...
12
votes
3answers
551 views

How are private keys handled in an enterprise?

We would like to start using digital signatures and possibly encryption for e-mails in our company. My knowledge of public-key cryptography is entirely theoretical with no practical experience. In ...