Tag Info

Hot answers tagged

22

Certificates are signed and the cryptographic signature is verified; if the signature matches then the certificate contents are exactly as they were when the certificate was signed. This, of course, does not solve the problem, it merely moves it around. The complete structure is called a PKI. The certificates which are preinstalled in your computer (came ...


14

There is nothing at all wrong with running your own internal certificate authority; the vast majority of large companies that I have interacted with have their own internal CA. Advantages The nominal cost of a cert becomes nearly zero when amortized over enough systems and users; when you purchase certificates from an external CA, this will never become ...


8

Public Key Cryptography designates the class of cryptographic algorithms that includes asymmetric encryption (and its cousin key exchange) and digital signatures. In these algorithms, there are two operations that correspond to each other (encrypt -> decrypt, or sign -> verify) with the characteristic that one of the operations can be done by everybody while ...


7

If someone steals a CA's certificate signing key, the already signed certificates remain valid. But that doesn't mean they are not harmed. The whole point of certificates is that only a trusted party can produce them, so that when you see a certificate, you can be confident that it is valid and that you're talking to the entity you intended to talk to. If an ...


6

If a virus installs a new root certificate on your computer, and a spoofed website presents you with a certificate with a valid signature chain from that root certificate, then your computer will accept it as a valid certificate. But this shouldn't be seen as a problem with SSL/TLS -- if you have a virus with that level of access, then there are lots of ways ...


5

A normal CA has a procedure in place for this. it starts with invalidating ALL certificates signed with the key, Than have the CA make a new Root Key and Certificate. than do all the steps involving the setup of a new CA. After that is done, reissuing all certificates that were affected and still valid. A problem if this is not mitigated soon after the ...


4

What is the difference between Public Key Infrastructure and Public Key Cryptography? How are they related? I think the difference between Public-key infrastructure and Public-key cryptography is pretty clear from their Wikipedia definitions (quoted after the tldr). TLDR: Public key cryptography is another name for asymmetric algorithms, while PKI is ...


4

simply because CA's predate TLD Registrars. The whole Idea of Certificates have there origins in the DAP times (Directory Access Protocol), When the Idea was more along the lines of Central Directories giving Authority to specific users from certificates. (I am paraphrasing here) For historical reference. the first DNS (BIND) is from 1984. Many years ...


3

Short answer: No. I think you won't be happy with only three CAs. Lots of clicking around certificate warnings. This will not make your browsing safer. Also reconsider what you are trying to achieve. I'm assuming, that you want to protect yourself from rogue and/or exploited CAs. So that means CAs that will issue certificates for google.com, etc, when ...


3

As an Introduction sentence: PKI(Public Key Infrastructure) and PKC(Public Key Cryptography) with together are considered as PKT (Public Key Technology). Short answers: for reading the image open it in new window Now is the time to answer the questions. 1. What is the difference between Public Key Infrastructure and Public Key Cryptography? I ...


3

SSL certificates provide two things: Authentication of the organization to whom the visitor is connecting (the organization is verified to be www.foobar.com) Confidentiality of the communication (data is encrypted using the public keys in the certificate) Concerning point 2, there's no difference in using a self-signed cert, a certificate issued from a ...


3

It really depends on how your application/site manages the certificates and public keys, i.e. how often are the keys and certificates rotated. For example, if your site rotates the certificates very often, then you'll also need to update your application that often as well, if you are pinning the certificate. Whereas, in this use case, pinning public key ...


2

Some things to consider when dealing with TLS as a protocol. The payload of the communicating packet is encrypted. The 'dst' & 'src' packet attributes are not, which allows for any device within the network route to intercept your communication. Numerous attack against the SSL & TLS protocol over the years have allowed for the following attack ...


2

You are correct that it would not cause any harm to the certificates that were already issued, but it does call into question which certificates are still trustworthy, and which are not. It's safer and easier to just treat all certs issues by that signing key as "compromised" and re-issue them. In this case the CA's signing certificate would be revoked with ...


2

I will answer this in a two-level approach: General term answer and the specific SSL/TLS clarification in blockquotes. Public Key Cryptography (PKC) solves the problem of securely exchanging information without the need of previously agreeing upon a secret key. To be part of PKC, every agent needs to have a Private Key (which should only be kept by the ...


1

I designed an image as Short answers of questions: for reading texts of the image open image in new tab for more details go to my previous answer.


1

Since we should all be familiar with the layers a la the OSI model: PKI sits atop public key crypto. The public referred to here is a misnomer, in the sense that it does not really mean a generalised audience, but that the keys, or at least the public key, can be in the open, and also by extension able to be freely distributed, though in reality this might ...


1

Until the early 1970's, the only way to encrypt and decrypt messages was using symmetric algorithms, in which the same key is used for both operations. The key has to be exchanged securely by some means before two parties can communicate privately. Public key cryptography, or asymmetric encryption, is a novel way to encrypt and decrypt messages using two ...


1

Don't panic. It's just different ways of building a certificate chain of trust. Both ending in a trusted root CA. But once with and once without going via an additional intermediate certificate. There exists more than one certificate with the CN "VeriSign Class 3 Public Primary Certification Authority - G5" And SSL-Tools.net has a list of them. There's ...


1

There are some news articles about existing backdoors on CAs for use by Security Agencies, but the trustworthiness of these news must be checked, New NSA Leak Shows MITM Attacks Against Major Internet Services There is no evidence that shows the trusted CAs use their certificates for MITM attacks, because sooner or later will be identified or disclosed ...


1

While thinking about it, I can now definitively answer that some CA offers Web API allowing to automate part or all of the certificate generation / signature. Some concrete example of this are Digicert, GlobalSign, Gandi. Some other CA may therefore offer the same services, however you need to check: The available functionality, not all functions ...


1

Note that EV certs are not structurally different -- they are just a cert issued under a different policy. So you have to check the policy. See http://en.wikipedia.org/wiki/Extended_Validation_Certificate#Extended_Validation_certificate_identification You will need to do a fairly extensive table lookup, won't be native to openssl I'm afraid. This is ...



Only top voted, non community-wiki answers of a minimum length are eligible