New answers tagged

1

Of course writing the question led me to the answer... These values come from RFC3447: For the six hash functions mentioned in Appendix B.1, the DER encoding T of the DigestInfo value is equal to the following: MD2: (0x)30 20 30 0c 06 08 2a 86 48 86 f7 0d 02 02 05 00 04 10 || H. MD5: (0x)30 20 30 0c 06 08 2a 86 48 86 f7 0d 02 05 05 ...


1

I have used osslsigncode (a linux tool) to dual sign the exe installer with SHA1 and SHA256. For Windows users I have read about a Windows fork of osslsigncode. My current comodo signing certificate 2016 comes with dual digest SHA1 and SHA256 so I only need a single certificate for both signatures. First must go the XP compatible signature: osslsigncode ...


1

Root certificates don't need to be revoked if they are not compromised. Obviously it's not possible to just create a CRL as there would not be a trusted private key; instead this is a out-of-order operation. In general it's better to create a new root certificate and let the old one expire. Note that the underlying certificates should have an expiration ...


0

If it is of limited importance http://www.icanprove.com will do for you. Otherwise you will need a real notary.


0

It validates all of them at the same time. This is called a Distinguished Name.


1

It is an arbitrary, administrative decision for the creator of CA what client certificates they want to enable to be signed by the CA. The policy_match in the following configuration line: policy = policy_match is a chosen name that corresponds to a particular section in the configuration file. That section defines in details each of the [ ...


4

I was wondering whether a CA has different private keys to sign certificates with? A CA will usually have a number of Intermediate Keys for use in signing customers' certificates. These Intermediate Keys are in turn signed by the CA's Root Key, which should be stored "offline" and only used rarely to sign those Intermediate Keys. The matching Root ...


0

What we consider to be a Certificate Authority is represented by a "Trusted Root Certificate" which is a self-signed certificate that is delivered by secure means (most often during the OS or browser installation process.) Typically a single Certificate Authority issues only one Trusted Root certificate, but not always. A company that operates as a CA is ...


3

I was wondering whether a CA has different private keys to sign certificates with? In general, no. There is one key pair - and thus private key - per certificate. Certificates can be rolled over to use a new key pair of course. Furthermore, in general, a CA manages multiple certificates for different purposes. The CA may also have different certificates ...


2

Your question boils down to "how can I initially construct a trust chain". No matter how you want to verify the download or individual steps (for example, X.509 certificates for HTTPs), you will have to start trusting somewhere. The most paranoid method of verification would be meeting GnuPG's main author, Werner Koch (and/or others from the core team). But ...


0

One way round this could be to download it and use another system to verify the hash. Or multiple other systems after putting it on to read only media. If you lack spare systems yourself then you could enlist some friends or other third parties. You could burn a CD-R (or other write once media), fill any free space with garbage, note any serial numbers, ...


0

It's a good practice to rely on your distro for this, but I don't view it as a requirement. You can still download GNUPG from their site and follow their process for validating the files: https://www.gnupg.org/download/integrity_check.html


0

Ring signatures would require modification of the OpenPGP standard and it's implementations, so you won't be able to use them while staying compatible. In fact, there was a propsal in 2014 on the OpenPGP IETF mailing list, but I couldn't find any further follow-ups towards an RFC. To achieve a similar effect without ring signatures (and the effort of ...


3

Don't be sure that you digitally signed the document. Adobe Reader and related products also include echoSign features. EchoSign is an electronic (not digital) signature system. If you still have the "signed" PDF, then open it in Adobe Reader. If you see a colored bar across the top that includes a button for the "Signature Panel," then the PDF is digitally ...


4

What you are looking for is to modify the certificate in a way that it contains the ability to be a CA, i.e. set the CA flag to true. Fortunately you cannot simply modify a certificate, because any kind of modification invalidates the signature and thus nobody will trust this certificate anymore. This is essential because otherwise everybody could just ...


1

You can't do this, you will have to apply for a new certificate. There are special types of certificates that apply for multiple previously specified domains at once.


2

I will try to simplify as much as possible The difficulty comes from some "hard to compute" operations in maths. For example, some operations are two-ways easy to compute. If I compute 5*6 = 30, it is easy to calculate x*6 = 30 (30/6 = 5). Some other operations are only one-way easy to compute: 5^6 = 15625. Ok but if I give you x^6 = 15625... how the fuck ...


-1

It is not feasable to get private key from the public key. Why? Because You should find two prime numbers which are terms of a big number and this is a really time consuming computation


1

The piece that seems to be missing is that, for some public key crypto algorithms, the public and private keys are cryptographic inverses of one another. So, encrypt with a public key, decrypt with the private key; encrypt with a private key, decrypt with the public key. So, if I encrypt a message, or more likely, a message digest, with my private key, ...


0

Where you are missing is the second input to the algorithm. To sign a message, you don't encrypt the message itself, but rather, you create a message digest using a cryptographic hash function. This digest is then encrypted with your private key, and then sent along with the message. To verify, the recipient computes the same digest from the message, ...



Top 50 recent answers are included