Tag Info

Hot answers tagged

50

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed. Source: http://support.microsoft.com/kb/293781 Some certificates that are listed in ...


11

Shouldn't necessarily matter... In RSA you can use either d (private) or e (public) to encrypt and also decrypt. This doesn't work with all cryptosystems. For example DSA won't allow this. So technically it wouldn't really matter if you exchanged the values of e and d. ...but does Performance: But actually you usually want verification (using e) to be ...


5

Recently, our clients want to encrypt their files for one reason: " They don't want FTP server admin has access to their files". With this requirement the encryption should not be done at the server side. Otherwise an administrator could just grab the content before it gets encrypted. And of course the management of the passwords/keys should also be ...


4

When you are browsing TOR hidden services, the TOR system already provides end-to-end encryption, so another TLS layer is redundant. It is in fact counter-productive, because one of the goals of TLS is to de-anonymize the server. It makes no sense to go through the trouble to set up a hidden service and then get a certificate from a certificate authority ...


4

In general, yes. With many asymmetric cryptosystems, one of the keys can be derived from the other one, so there is no choice as to which one to keep private. Many asymmetric cryptographic algorithms are based on the difficulty of computing discrete logarithms. The private key is an integer k and the public key is the value gk for some public parameter g in ...


4

My suggestion is to have your clients manage their owns encryption password or certificates. Certain FTP clients will allow the use of encryption, as an example: http://www.coreftp.com/docs/web1/FTP_Encryption.htm. I want to make sure though that you're actually using some type of encryption for the transit of their data. You don't mention it and since ...


4

pgp.mit.edu and most other key servers are currently running the SKS key server software, which is (as of November 30th, 2014) not yet ready for the new ECC keys. There is some code, though; but it is not ready for production yet. Be aware that even if most keyservers will support it (probably rather soon), broad support for ECC keys with other OpenPGP ...


2

Is this a hot issue for mostly security reasons [...] Not yet. There is no practical published attack yet. But it's in the post. The gradual transition now is better than the transition from the earlier MD5 hashing algorithm to SHA1. Back then there was no explicit deprecation strategy AFAIK and there actually were evil attacks that used ...


2

They are defined in the standard, maintained on the OASIS website...symbols and abbreviations. And the list there matches yours.


2

At a key-signing party, you show documents, you don't hand them over, nor is there an opportunity to copy them. Someone with an eidetic memory and an evil side might be a risk. However, eidetic memory is rare in adults. (So is evil, happily.) So, specific advice in answer to your question: a key-signing party should have guests known to the host, or ...


2

I Think the questioner is living in a country like Sweden, where anyone who gets hold of your social security number, can use it to order things on post-payment in your name and have the bill sent to you instead of to delivery adress, and then you become obliged to pay the bill for someone elses Products. The recommended solution for this is Notary Public. ...


1

Identity Theft If you're scared of identity theft by people reading your documents, don't go to key signing parties. Also better don't travel, as you might have to show your passport at the airport (even to normal airline staff). I'd also consider not using credit cards any more, the cashier might copy the credit card ID, and as I experienced in the US you ...


1

Passwords can be easy to forget. can be easy to guess / crack. can have different contraints in terms of characters you can use, length... are very often re-used on different services. have you heard of those passwords database leaked? Challenge-Response can comprise any amount of challenges (e.g. enter 3 passwords in a row) can support one-time ...


1

TL;DR - Use SMIME or PGP if you're paranoid of everything. More information: To answer your boiled-down question: How do you secure email? Practically speaking email is subject to attack by DNS spoofing, WIFI interception, and untrusted network administrators just to name a few. To mitigate this you need to consider the different aspects that need ...


1

Signing will be done by the key only, so as long the key is not changed all signatures done by this certificate are still valid. But, when building the trust chain for a certificate it will look at the certificates issuer field and then search for a certificate having this issuer as the subject. Only after it found a certificate (or multiple) having this ...


1

Some CAs will not allow two certificates with the same SubjectDN, so the new one would supersede the old one. If there is no reason to believe the previous certificate had its PrKey compromised, it does not need to be revoked prior to signing and installing the replacement. Speak to the operators of your CA, especially the personnel acting as an RA, since ...


1

Is it a must-act-immediately-because-attacks-are-feasible-now? No. That said, when working with PKI, you must have a long vision, so start planning now. It is estimated that by the end of 2017, precomputed hash-collisions to create imposter certificates (and hence imposter CA certificates) may drop below 100,000$ in computation, using cloud computing ...



Only top voted, non community-wiki answers of a minimum length are eligible