Tag Info

New answers tagged

2

What you are describing is the exact problem of public key distribution that PKI is meant to solve. When your "master key pair" is used to sign the public key of an authoritative content provider for a specific domain, then you are issuing a certificate linking the domain name with a public key. That is what you are intending to do, and that's PKI, whether ...


0

We decided to go with a fingerprinting approach. When we issue a provider with a keypair, we hash the public key plus the domain it's authoritive for together, and then sign it using the master registries key. This way, we can verify that a providers key is both valid and authoritive for their domain by verifying the hash of the key+domain Is valid. If ...


0

There are a a few cases where checking the hash of a file could be prove a security benefit, even if the hash wasn't downloaded through a secure connection: If only your connection is being tampered with, you could visit the web page containing the hash using another connection (e.g. a secure VPN). If the page, when viewed through that other connection, ...


0

No, a SSL server does not sign what it returns. The operations which use asymmetric keys and may qualify as signatures occur during the initial steps of the connection (the "handshake"), before any applicative data is sent, so these operations cannot logically bind anybody to the contents of such applicative data. There is a possible source of confusion, ...


1

HTTPS does not sign a document; it does not provide any lasting affidavit as to the provenance, legitimacy, or validity of the document. A signature is a modification to or verifiable description of a document which can be used at a later time to validate the document or the fact of that document's authorship or review by an entity. As such, there must be ...


0

As already mentioned in the comments, the HTTPS protocol does not sign a document. It merely uses the SSL/TLS protocol to encrypt and decrypt on the transport layer of the OSI model, by using a certificate (which contains the public key used to encrypt/decrypt data on clients) from the Public Key Infrastructure (PKI).


2

When a certificate is revoked, the CRL contains the revocation date which tells at which date the certificate became "invalid". Indirectly, it specifies that the certificate was fine up to that date. For instance, if a private key is compromised after a burglary, the security camera recordings will be used to determine at which hour the key was stolen, and ...


1

I would look at Snort signatures, learn how they are written and use them as a template if you need to create your own. For some examples, this page has collected several signatures it has found most effective against malware found by its Honeypot. This is a good article about testing Snort with Metasploit. Since you asked about a book, it has been almost ...


0

So you should be able to recognize different exploits, or different attacks because those aren't the same. You can use wireshark to capture packets and analyses them. For attacks you should look for countermeasures. But for attack I mean D/DoS, arbitrary code execution etc. and for exploits I mean MS08-067 for example. If yo need anything else ask here.


2

Check this other question so you can understand more about certificates: How do the processes for digital certificates, signatures and ssl work? Basically signing a software guarantees that you are the author of the software and it has not been modified in any way by another party. For example if you check your PCs drivers, you will see they have a ...


3

As far as X.509 is concerned, there is absolutely no problem in having several certificates with the same public key. The validation process is described in full details here; in a nutshell, it is verified that: each certificate in the chain is currently valid (with regards to its start and end dates for validity); the signature on each certificate is ...


1

PKI isn't a very popular approach to 2 factor authentication outside the enterprise because of the overhead of protecting the private keys and managing certificates, but there are some commercial solutions available. Take a look at Layer7. Years ago I used to work for Baltimore Technologies (famous for the first digital signature of legislation (by Bill ...


0

I agree with the sentiments here, that it is very bad practice to send the private key and it would actually be almost impossible to do what you want. Why? Because you generate the private key on a smartcard. It is very difficult to mark private keys as exportable on smart card devices. It requires specific low-level knowledge of the smart card API, which ...



Top 50 recent answers are included