A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

8
votes
2answers
328 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
1
vote
1answer
167 views

Distribute S/MIME public keys and CA cert for email security

I have my own CA. I want to distribute S/MIME certificates for 10 different users. I saw S/MIME keyservers from http://wiki.cacert.org/KeyServers, but I don't want to use public servers. What is the ...
3
votes
1answer
44 views

Centralized key management for IOS and Android Code Signing

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines. I see systems like ...
0
votes
0answers
2 views

Build host application for Thales payshield 9000 HSM [migrated]

I'm working on creating host application, which talks to Thales HSM over TCP/IP socket. The main use of HSM here is for PIN translation from DUKPT to ZPK for next network in EMV transaction flow. I ...
2
votes
1answer
76 views

Generating shared secret key using existing receivers public key and senders private key

I have the public key of the receiver, and the private key of the sender. I want to generate a new key by using the receivers public key and senders private key (also known as the signing key) to ...
0
votes
3answers
60 views

Difficulty of breaking private key password

I was recently reading up on the practices of keybase.io and came across this blog post. In it, the author says: ...decrypting the above [encrypted private key] is arguably as difficult as ...
1
vote
2answers
54 views

sharing private key sTunnel

All of the sTunnel guides and implementations at work do the same thing, they say once the private key and the public cert are created on the server, you need to cat them together and then share with ...
2
votes
1answer
43 views

Should my company change the internal Root CA hash method from SHA-1 to SHA-2?

My company have a Root Certificate Authority which is installed on a Windows Server 2003 and uses SHA-1 as hash method. We will migrate to Windows Server 2012. Checking the root certificates of my ...
0
votes
1answer
24 views

Why is it not recommend to use permanent validity of certificate for public key [duplicate]

As we know it is not recommended to provide permanent validity of certificate for public key. I don't know why. Could you give me some reasons ?
2
votes
3answers
2k views

Key Exchange using PKI

I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl openssl req -x509 -nodes ...
-5
votes
1answer
45 views

What happens if two parties have the same public key? [on hold]

What would happen if I get a public key that someone else already has? Isn't the security very weak in that case?
11
votes
2answers
6k views

SSL Certificate revocation check

In the SSL protocol I don't see where the certificate is checked for revocation status. https://developer.mozilla.org/en/Introduction_to_SSL Is the Certificate Revocation and Status Checking not ...
0
votes
1answer
67 views

BLS signature java implementation needed (if possible, along with some example code)

I need to sign a string with the shortest digest possible using regular certificate like X.509. As far as I understand, I will have to transform the string to the sequence of bytes, then sign. After ...
24
votes
4answers
31k views

how digital signature verification process works

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
-1
votes
0answers
21 views

What prevents certificate spoofing? [duplicate]

If someone takes the information on a legitimate certificate and provides it to an illegitimate server for distribution of the certificate as if it were the illegitimate server's certificate what tips ...
1
vote
2answers
350 views

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
0
votes
0answers
11 views

Is it possible to convert Key BLOB to any other format using CAPI [migrated]

We use Key Blobs to export keys in public key cryptography. Is there any other format to export key pair using crypto API's. So that the exported key storage type is compatible with other operating ...
10
votes
4answers
6k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
0
votes
2answers
38 views

How to avoid writing .pem while signing a csr?

I am using following command to sign a certificate, openssl ca \ -in client.csr \ -keyfile server.key \ -cert server.crt \ -outdir ./some_dir \ ...
7
votes
1answer
1k views

Has the leaked D-Link windows signing key been revoked?

Recently news broke as to D-Link mistakenly publishing a private code-signing key as part of an open source framework. The D-Link key was leaked in late February, and expired on September 3, it ...
1
vote
2answers
77 views

Self-signed cert - how it works

I am new to SSL / digital certificates / signatures. What I know is that a digital signature must be verified/decrypted using the public key. So a cert that is signed by a CA must be ...
0
votes
1answer
28 views

Authenticating a user by verifying a signature

Background I'm setting up an API which will be used primarily over HTTPS (only calls not needing any security what so ever is available over HTTP). Some aspects of it need to be accessed only by ...
0
votes
2answers
89 views

SSL digital certificate process - high level

I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database. In this case, I have an web server and needs to implement SSL ...
3
votes
2answers
32 views

Comparing allegedly identical OpenPGP keys published through different channels

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like ...
3
votes
1answer
29 views

Can I get SSL certificates for my OpenPGP key?

How can I use letsencrypt to get a signed public key for use with OpenPGP? So I can prove in court the key is mine etc., and not have to rely on the OpenPGP web of trust.
2
votes
0answers
30 views

SSL/TLS: Policy Constraints vs. Basic Constraints

Could someone please explain the difference between Policy Constraints and Basic Constraints? It appears to me that they are either redundant, or two names for the same thing. I would love some ...
1
vote
1answer
50 views

PKI management with easy-rsa

I recently setup an OpenVPN server with easy-rsa and have questions about certificate revocation: In the event that someone's private key gets compromised and I have to revoke the certificate with ...
4
votes
2answers
106 views

A potential possibility of improvement of PKI for personal communications

In countries like Germany each citizen has an identity card that is issued by the registration authority. Since the identity of a citizen is, in a sense, created by that authority via assigning him ...
6
votes
2answers
205 views

Custom data in SSL certificate

I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA. Is this possible? I want to get a SSL server certificate issued by a standard CA, so that it'll ...
4
votes
2answers
47 views

Extend hierarchical PKI

The figure below shows four simple hierarchical PKIs. A, R, H and N are trust anchors of their PKI. I am supposed to add exactly one certificate so that T trusts G, but not D. Furthermore R must ...
2
votes
1answer
47 views

Best practice to verify data against a CA

Let's say that I have signed my public key with a trusted CA and the CA provided my with a signed certificate, and I want any client applications to verify against this certificate. The general ...
1
vote
2answers
203 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: I have been researching how trusted root authorities (such as GlobalSign or Verisign) are used ...
6
votes
0answers
42 views

What LDAP schema is recommended for PKI?

In my research, I found some RFCs that have not been updated in over a decade, e.g draft-ietf-pkix-ldap-crl-schema-01. I also explored several public directories used in PKI (e.g. x500.bund.de) and ...
9
votes
1answer
438 views

Why does GoDaddy have four different certificate chain, G2, G3, G4?

I see from Godaddy they have multiple certificate chains https://certs.godaddy.com/repository GoDaddy Certificate Chain GoDaddy Certificate Chain - G2 GoDaddy Certificate Chain - G3 GoDaddy ...
3
votes
2answers
294 views

Is it possible to do Public Private Key Encryption on a chip (hardware)?

Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely? The ultimate goal ...
1
vote
2answers
120 views

Why/when would a CA make a generated public key available to the public at large?

I'm confused about this section in my CEH security exam training material: A CA is able to perform a number of roles in addition to the validation process outlined here. Some actions that a CA is ...
2
votes
2answers
54 views

Why not to use the same subordinate issuer CA for generating certificates that will be used for different things?

Microsoft has recommended my organization to use different subordinate issuer CAs in order to issue certificates that will be used for different things. For example, they recommend to use a CA for ...
6
votes
3answers
199 views

Why should my certificate signing request be signed by my private key?

Why should my certificate signing request be signed by my private key? Even if I obtain a bogus certificate out of someone else's public key, that is going to be useless, since in SSL the ...
7
votes
4answers
633 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
5
votes
1answer
3k views

Adding certificate that resides on smartcard to the Microsoft store with private key ownership

How can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? In an enrollment system where users generate smartcard certificate ...
6
votes
2answers
109 views

Understanding Digital Certification as as a whole starting from a normal http request

I am trying to understand the difference between digital signature and digital certification and how they work as a whole together on a high level perspective. I hope gurus here can point to me if my ...
0
votes
1answer
61 views

OID for creation date/time (X509 certificate field)

X509 certificates used in PKI{X} have notBefore and notAfter dates. I'd like to stamp a certifcate with a creation stamp, and the stamp is distinct from notBefore and notAfter. Is there an OID for a ...
3
votes
1answer
865 views

How can a trusted intranet certificate be issued if they are being phased out?

I've just seen this article regarding the phasing out of intranet names on SSL certificates. However, CAs such as this one claim to still issue them and it will be "Trusted by all popular browsers" ...
3
votes
1answer
412 views

ECDSA/RSA certificates and cipher selection

In this image can someone tell me if a standard RSA certificate can support the EC*_RSA ciphers listed? If so do you create the typical RSA keys when you are creating the CSR? Also I am fairly ...
2
votes
1answer
42 views

Is there a way of achieving perfect forward security with one directional messages?

Using for example ECDH and ephemeral keys, it is possible for two parties to establish a shared key with perfect forward security, i.e. even if the long term keys are lost, it will not be possible to ...
3
votes
1answer
75 views

Designing a PKI environment

For our company I was given the task to design a durable, structured PKI environment for mainly client authentication purposes. We need a Root CA with a couple of Intermediate CAs, like this: ...
5
votes
2answers
92 views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
2
votes
1answer
164 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
3
votes
1answer
45 views

What happens if an OpenPGP subkey gets compromised?

In my GnuPG keyring, I have a primary key for creating keys and three subkeys: two for encryption and one for signing. All of then have the same password. If a subkey gets compromised, is it possible ...
1
vote
0answers
26 views

Can there be two certificates with a same serial number in the world? [duplicate]

Recently I came across this odd question. I hope, Serial number is unique across certificates signed by a particular CA. So is there any chance that two different CAs sign two different certificates ...