A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

0
votes
1answer
9 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
0
votes
1answer
30 views

Does a smart card do encryption or does it just provide a private certificate?

I don't really understand how smart cards work. Do they sign or encrypt themselves (where the computer provides data to it to sign) or do they provide a computer with the private certificate when I ...
2
votes
3answers
1k views

Cryptography behind chip based credit cards (smart cards)?

Why are chips safer than magnetic stripes? The answers to the above question explain that the chip based cards can not be cloned as the "secret number" is embedded in the chip and protected by the ...
0
votes
2answers
94 views

What does 2^77.1 calls presented in a SHA1 attack mean?

Regarding the SHA 1 deprecation, I found this information here: http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx I know ...
2
votes
1answer
38 views

Which PGP settings have been found to be vulnerable?

Digging through articles, one often finds recommendations such as "Use the default key type/size X", whereas an article written a few years later will write "Key type/size X has been found to be ...
2
votes
0answers
41 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
1
vote
1answer
24 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
0
votes
2answers
99 views

What would cause a server to only send over 1 SSL certificate to a client?

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
2
votes
1answer
30 views

How long to keys stay on keyservers?

Do GPG/PGP keyservers "garbage collect" old keys which have expired, been revoked, or simply haven't been updated in a decade? Or does the server (theoretically) keep every key it has ever seen from ...
0
votes
0answers
9 views

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file? [migrated]

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file? Scenario: We have a few legacy certificates based on some legacy templates (2012 R2). ...
0
votes
1answer
64 views

Smart Token Security Test [closed]

I have a question. One of my colleague gave me a Smart Token which consists of public/private key inside and asked me if I can test its security. I said it should be tested in a equipped lab for ...
0
votes
1answer
73 views

Encrypting/decrypting our license key

We need to provide a license key to customers for our application. The actual license is XML but we need to encrypt it and then in our program decrypt it. I think it is the following, but am asking to ...
0
votes
1answer
53 views

OpenTSA and PKCS11

We are planning to implement the time-stamping service(RFC 3161) using OpenTSA wanted to know If OpenTSA supports PKCS-11 (Cryptoki) to talk to HSMs? BTW: I did not find documentation or much ...
1
vote
1answer
240 views

Generating ECDSA certificate and private key in one step

Similar to how it can be easily done for RSA: openssl req -x509 -nodes -newkey rsa:2048 -rand /dev/urandom -keyout example.key -out example.crt -days 365 I'd like to generate a ECDSA cert/key in ...
1
vote
2answers
83 views

Does where I put my PKI certificates matter?

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were ...
1
vote
2answers
35 views

Best practices for GPG user ids

What is the best practice for choosing GPG user id(s)? I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because ...
7
votes
3answers
1k views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, ...
1
vote
0answers
40 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
2
votes
1answer
37 views

Is distinguished subject name at normal SSL Certificate issuance must same as generated Certificate Signing Request (CSR)?

For example: from Issued SSL Certificate: CN = abc.com.my, OU = Room, O = House, c= MY from generated CSR: CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY Questions: 1. Is it ...
2
votes
1answer
33 views

OpenVPN: Storage location and creation of keys/certificates?

I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance. It's noted that the best security policy is to keep the Certificate Authority (CA) offline ...
0
votes
2answers
91 views

Does public key encryption/decryption speed actually matter?

There have been wars fought over RSA, DSA, and I'm sure other public key encryption algorithms, and usually the arguments are "Algorithm A is faster to encode, but algorithm B is faster to decode". ...
0
votes
1answer
93 views

Automate the process of giving a user access to his encrypted messages, when the user loses his password

I'm implementing a way for users to share messages with other users. All users and admin-users have a unique key pair. A message can be sent from one user to multiple users. Admin-users, who always ...
0
votes
1answer
43 views

Temporarily suspending a Certificate Authority's Certiticate

The PKI RFC talks about revoking or suspending certificates. It also talks about revoking CA certs. However, I could not find anything about whether a CA or a Sub CA's certificates can be revoked or ...
1
vote
1answer
56 views
1
vote
1answer
57 views

Are SSH keys and PGP keys the same thing?

I have a 3072 bit RSA key that I generated for use with SSH. Can this key-pair be used with PGP/GPG, or do I need to generate a new pair of keys separately for use in email encryption? Are the two ...
15
votes
4answers
2k views

Why should I sign data that's already encrypted? [duplicate]

My question is about the difference between signing and encrypting. Why would you still sign something if you are already going to PKI encrypt it? Doesn't the PKI encryption inherently provide ...
0
votes
1answer
35 views

Forward Secrecy not supported with referenced browsers?

I am running a scan against one of our servers from the Qualys SSL tester site and it says that my server "does not support forward secrecy with the referenced browsers". What exactly does that mean? ...
363
votes
3answers
149k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
7
votes
2answers
334 views

How can we revoke all ssl certificates issued for our domain?

After having the hostmaster@domain.com email compromised, we found that someone issued a Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked. Is there ...
2
votes
1answer
379 views

adding certificate that resides on smartcard to the microsoft store with private key ownership

how can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? in an enrollment system where users generate smartcard certificate ...
0
votes
1answer
62 views

How are TLSv1.0 ciphers negotiated as TLSv1.2?

I'm a little confused about something I am reading in Bulletproof SSL. "TLS 1.2 is the only protocol that allows suites to define their PRFs. This means that for the suites defined before TLS 1.2 ...
4
votes
5answers
703 views

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
0
votes
0answers
72 views

Do SSH private keys always contain enough information to derive a public key?

I am working on a persistence model for SSH Private keys. The technology used is Java. Since the persistence structure of the public and private keys is pretty similar and using some of the Java APIs ...
0
votes
2answers
61 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
2
votes
1answer
728 views

Root certificate key usage (non-self-signed end entity)

This discussion does not include self-signed end entity certificates for hosts like web servers and mail servers. OpenSSL's default configuration for a CA certificate has the following keyUsage: ...
1
vote
1answer
46 views

ECDSA/RSA certifcates and cipher selection

In this image can someone tell me if a standard RSA certificate can support the EC*_RSA ciphers listed? If so do you create the typical RSA keys when you are creating the CSR? Also I am fairly ...
0
votes
1answer
99 views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
2
votes
4answers
216 views

SSL root certificate optional?

I may have been under the wrong impression on how servers should be setup and what certificates actually get sent over during the server hello certificate message. I came across this today from ...
1
vote
0answers
26 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
-1
votes
1answer
349 views

Can a CSR be created in OpenSSL with SHA2?

Can a CSR be created in OpenSSL with SHA2? If so, what would the command be and what does this tell the CA, if anything? If you could create a CSR using SHA2 would it "tell" the signing CA to use it ...
1
vote
1answer
73 views

Self-signing client certificates and distributing them, is the following a sound procedure?

I have a case at hand as follows: There is a number of clients in Internet (i.e. untrusted channel), initially in hundreds but growing in numbers. There is a server doing processing related to these ...
0
votes
1answer
263 views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
2answers
64 views

Typical mistakes when implementing digital signatures?

I am looking for a list of typical mistakes someone can make when implementing digital signatures for a software. And of course why they are mistakes and how an attacker could take advantage of them. ...
0
votes
1answer
29 views

Is there any benefit to providing multiple types of public keys?

Say I have a page on my website which lists public keys to be used in case people would either allow me access to a server, or send me encrypted information. Is there any benefit to me providing ...
3
votes
2answers
209 views

Export non-extractable private key from Keychain on OS X

I have a PKI certificate in Keychain Access.app on OS X 10.9, together with the private key. The manual page for /usr/bin/security indicates that there is a -x option for security import to specify ...
0
votes
0answers
57 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
0
votes
3answers
56 views

Digital Signature and man-in-the-middle

While reading this page about Public-Private key encryption, I asked myself a question about digital signature: Alice wants to sign a message for Bob; she uses her private key to sign the message. ...
0
votes
2answers
47 views

How to encode a username in PKIX certificate?

I was reading through RFC 5280, PKIX Certificate and CRL Profile, Section 4.2.1.6, Subject Alternative Name: The subject alternative name extension allows identities to be bound to the subject ...
1
vote
1answer
110 views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
3
votes
2answers
1k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...