A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

0
votes
1answer
43 views

Do I have the private keys to CAs installed on my browser?

Could someone please help explain the following comment from Why was the private key of the Superfish certificate so easily extractable? The main issue with private key extraction is the use of ...
14
votes
2answers
1k views

How secure is “Let's Encrypt”? [duplicate]

I just configured and installed a free SSL certificate from Let's Encrypt. It's great, and very easy to set up. However in this post-Snowden era, I was wondering how secure this really is. For ...
2
votes
3answers
72 views

What specific information is used to verify an SSL certificate?

When a CA's SSL certificate is stored in a browser, a server which presents a certificate signed by this CA can be verified by the browser. My question is: How exactly is this verification done? I ...
0
votes
1answer
58 views

X509 / SSL certificates in practise

After learning the theory behind cryptography I'm having quite some problems understanding how SSL or X509 certificates works in practise and I simply cannot find useful information in the internet. ...
1
vote
1answer
110 views

Can Passpoint X.509 certificates be used to MITM SSL connections on Passpoint networks?

Passpoint/Hotspot 2.0 public networks like LinkNYC require users to install X.509 certificates, for EAP authentication. Can these certificates be used by the provider to execute man-in-the middle ...
5
votes
3answers
2k views

Digital Signature and Verification?

AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it. So public key is used to decrypt ...
0
votes
0answers
12 views

Advantages and disadvantages of two-party ECDSA [closed]

I have to study two-party ECDSA and evaluate it. I understand how it works, it uses paillier crypto system and that affects its performance. I need to evaluate it more precisely, so can you explain ...
16
votes
3answers
2k views

How to check if an SSH private key has passphrase or not?

Let's say I have access to the private portion of an RSA key-pair. How can I check if this key has associated passphrase or not?
0
votes
1answer
28 views

Would logging into Chase bank website be an example of Asymmetric cryptography? [closed]

Also anyone who is familiar with Outlook, is sending digital signed messages a process of Asymmetric cryptography? Since it uses a public key and requires your Smartcard PIN before you can actually ...
1
vote
1answer
120 views

PKI management with easy-rsa

I recently setup an OpenVPN server with easy-rsa and have questions about certificate revocation: In the event that someone's private key gets compromised and I have to revoke the certificate with ...
0
votes
0answers
21 views

How to use TPM to generate CSR for SSL?

I am following this guide: https://blog.habets.se/2012/02/TPM-backed-SSL The tutorial asks me to use libengine-tpm-openssl library to create a TPM key but it seems that the library is now obsolete. ...
1
vote
2answers
61 views

Storing Keys on Embedded Devices

What is a reasonable way of storing private keys/certs on an embedded device that doesn't have trust-zone, TPM or write-once storage? Without hardware backing the key-storage the key must be stored in ...
1
vote
1answer
54 views

Whatsapp encryption: are the public keys requested from the server every new message or only at session setup?

I was reading trough Whatsapp white paper (and all related questions here) and couldn´f find an answer to this question: are the public keys for the recipient requested by the sender from Whatsapp ...
2
votes
1answer
58 views

ECC for future IoT devices?

Elliptic Curve Cryptography(ECC) is one of the powerful cryptographic methods that requires less computational effort. IoT requires a cryptosystem that secures smart services and applications (5As i....
0
votes
1answer
45 views

PKCS #11 with the TPM

I try to understand PKCS #11 Standard. I found this link. There is this picture. So this picture is in the case of the Trusted Platform Module(TPM). We have the SRK which encrypts with the Private ...
0
votes
0answers
19 views

What public key systems allow for delegation?

I am looking for a public key system that allows for a 3rd party to use that key for other purposes. What private key systems allow for this? PGP, S/MIME, PKI?
6
votes
1answer
145 views

Centralized key management for IOS and Android Code Signing

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines. I see systems like ...
4
votes
1answer
108 views

ProtonMail: Would it not be much better if each user had their own private key?

ProtonMail keeps the encrypted private keys of all their users in their servers. The mailbox password for each user decrypts this private key, which is known only to that user. Would it not actually ...
2
votes
1answer
300 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
0
votes
0answers
22 views

Why one should prefer EST protocol instead of SCEP?

For many years SCEP was a simple and widely used protocol for obtaining X.509 certificates. However, not too so long ago another protocol called EST (RFC 7030) was developed. What are the main ...
0
votes
1answer
25 views

err_ssl_pinned_key_not_in_cert_chain

I have a question: how I can prevent this error from server side? We have a new cert, and it's valid, but users getting this error. Earlier, I've added HTTP response header Public Key Pins with 1 ...
2
votes
1answer
102 views

Generating shared secret key using existing receivers public key and senders private key

I have the public key of the receiver, and the private key of the sender. I want to generate a new key by using the receivers public key and senders private key (also known as the signing key) to ...
1
vote
2answers
148 views

sharing private key sTunnel

All of the sTunnel guides and implementations at work do the same thing, they say once the private key and the public cert are created on the server, you need to cat them together and then share with ...
147
votes
5answers
103k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
0
votes
1answer
28 views

Questions regarding DNSSEC

Until now I understood the following about DNSSEC: A client requests a certain Domain let's say google.se The root server sends the client his public KSK and public ZSK signed by his private KSK so ...
2
votes
1answer
369 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strength? (PBKDF2 as both ...
16
votes
3answers
2k views

Why is it more secure to use intermediate CA certificates?

I've read that using Intermediate CA certificates is more secure because this way the Root CA is offline. So, if the Intermediate is compromised it does not impact the Root CA. What I understand is ...
3
votes
1answer
77 views

Besides Browsers, what other Technologies are Impacted by the Deprecation of SHA-1?

I am aware that from January 2017, browsers will start rejecting, or at least warning, users browsing sites offering SHA-1-signed certificates. Would a service be impacted if the system does not ...
6
votes
2answers
1k views

Root SSL certificates and browser support

I have given three certs to be install on nginx AddTrustExternalCARoot.crt PositiveSSLCA2.crt www_example_com.crt So I concat them into a chained cert cat www_example_com.crt PositiveSSLCA2.crt ...
31
votes
4answers
13k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
0
votes
0answers
16 views

Where partially homomorphic encryption schemes like BGN are used?

Schemes like Boneh, Goh, and Nissim are interesting, because of support of polynomially many additions and one multiplication. The algorithms are indeed simple https://eprint.iacr.org/2010/182.pdf ...
0
votes
1answer
42 views

Firefox refuses to use X509 certificate, complaining “Cound not verify this certificate for unknown reasons”

I stumbled upon this question and answer. I have the same problem as the OP, and am sorry to report that the proposed answer does not resolve it. Certificate in question has been verified by OpenSSL-1....
0
votes
1answer
346 views

How to get “Policy: X509v3 Any Policy” in a certificate generated with OpenSSL?

I am trying to generate a certificate through OpenSSL which has the following line X509v3 Certificate Policies: Policy: X509v3 Any Policy But I end up getting X509v3 Certificate Policies: ...
1
vote
1answer
23 views

does openssh support authentication using public key fingerprints?

Cisco have two ways of enabling public key authentication: using the public key and using the public key hash. ip ssh pubkey-chain username <user> key-string <public key> OR ...
0
votes
1answer
46 views

Are there any risks in wrapping asymmetric encryption in symmetric?

The web app I am developing should be end-to-end-encrypted, but for slightly better user experience, I do not want the user to enter private keys into the client. Instead I am planning to store the ...
1
vote
0answers
47 views

Certificate based Access Control for Pub Sub messaging

I'm extending an existing p2p/master Pub Sub framework to support additional security measures, via over the wire encryption and topic based access control. I'd like to use the x.509 certificates that ...
2
votes
2answers
55 views

CA Certificate Lifecycle

I'm planning to implement a new PKI with 2 tiers of CAs. I'll have end entity certificates with a lifetime of up to 5 years. This means my Issuing CA should be valid for 10 years, in order to be able ...
1
vote
1answer
85 views

What's the minimal way of sharing your public PGP key in email signature?

What's the minimal (not the entire public key) and secure enough way of sharing your PGP key in an email signature?
9
votes
1answer
116 views

What LDAP schema is recommended for PKI?

In my research, I found some RFCs that have not been updated in over a decade, e.g draft-ietf-pkix-ldap-crl-schema-01. I also explored several public directories used in PKI (e.g. x500.bund.de) and ...
8
votes
1answer
5k views

SSL certificates and cipher suites correspondence

I have been learning about the SSL/TLS protocol (from https://tools.ietf.org/html/rfc5246) and have a few conceptual questions about the protocol. The client and server exchange "hello" messages ...
0
votes
1answer
46 views

How to configure SSH public key per user?

I have an OpenSSH server running and different users can log into it with different privileges. I know you can enable public key authentication and place all the allowed public keys in the ...
8
votes
1answer
345 views

How can WhatsApp recover messages sent to a damaged phone?

My mom has an Android phone that fell in the water for a couple of seconds, around 16:30. She managed to disassemble the phone and turn it off. We both share a group that is end-to-end encrypted (all ...
6
votes
1answer
83 views

Is there a way to know if a server is using ssh public key or password?

I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?
7
votes
1answer
144 views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
3
votes
1answer
49 views

Verifying SSH fingerprint of a public server

I have read somewhere that servers which have SSH access for users in the public can have their public key posted publicly (e.g., on a website), so that people who access such a server using SSH can ...
2
votes
1answer
1k views

OAuth and public keys

I get the basic OAuth and PKI flow and the different actors involved but I'm still unsure how public/private keys play a role. When a client identifies itself upon registration with a certified ...
9
votes
2answers
533 views

Why SSL uses a third party (certificate authority) yet SSH does not [duplicate]

SSL operations require the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client. SSH on the other hand relies on the client having the ...
0
votes
0answers
69 views

TOTP: Storing symmetrical secrets

I'm in the process of researching 2fa methods for a cloud connected physical access control system. There is very little margin for error in this space. Is it just me or does TOTP for two factor auth ...
0
votes
0answers
42 views

Migrate a key with a TPM

I try to understand how TPM devices handle the migration of a key. So I found this link: shazkhan.files.wordpress.com (page 4-5) I think I have understood how the rewrap scheme functions, and now I ...
0
votes
0answers
22 views

Client blocking based on PKI

I've got following scenario: Own PKI in a private network Some webservers in the private network, accessed by load balancing via proxy from the web Now I'd like to block all clients their ...