Tag Info

Hot answers tagged

33

I'm not sure what locks you have experience with, but deadbolt locks are commonly used to lock from the outside. Thus "Lock something in". In this case, the analogy is that a "key" is something variable, and the "lock" is the algorithm. The lock remains the same, while the key can be changed. In public key cryptography the key used to lock is different ...


23

The word key was introduced well before asymmetric encryption was even thought to be a thing. In the symmetric context, you use the same key both for encrypting and decrypting, and here the key analogy absolutely makes sense, in that physical keys are often used for both locking and unlocking. When asymmetric encryption came along, the term key was well ...


22

A piece of music has a key, but no lock. A standardized test has an answer key but no lock. A piano has 88 keys but no locks. A database table key has absolutely nothing to do with a database lock. A cryptosystem also has keys but no locks. The word key has a dozen or more meanings that have nothing to do with locks. A key in a cryptosystem is in many ...


11

If your infrastructure is tiny, much of the details of running a CA (e.g. CRLs and such) can probably be ignored. Instead all you really have to worry about is signing certificates. There's a multitude of tools out there that will manage this process for you. I even wrote one many years ago. But the one I recommend if you want something really simple is ...


8

Locks are typically operated by keys, whether you are locking or unlocking them. In cryptography, the cipher is the lock. In public-key cryptography, this lock happens to be locked with one key (designated public) and unlocked with a different key (designated private), but neither of those is any less a key for that.


8

Public Key Cryptography designates the class of cryptographic algorithms that includes asymmetric encryption (and its cousin key exchange) and digital signatures. In these algorithms, there are two operations that correspond to each other (encrypt -> decrypt, or sign -> verify) with the characteristic that one of the operations can be done by everybody while ...


7

The whole point of all encryption is that it's safe for the attacker to get your ciphertext, because they don't have the key. This is true for public-key encryption as well; it's perfectly safe for you to broadcast your ciphertext to the world, and certificates aren't related to that in any way. The reason you use certificates in public-key cryptography is ...


7

If someone steals a CA's certificate signing key, the already signed certificates remain valid. But that doesn't mean they are not harmed. The whole point of certificates is that only a trusted party can produce them, so that when you see a certificate, you can be confident that it is valid and that you're talking to the entity you intended to talk to. If an ...


7

Revocation really is cancelling the certificate issuance -- the CA which has signed the certificate announces that it now denies it. A root CA being self-issued, it cannot be revoked. A root CA, by definition, is trusted a priori, not because its certificate was signed by some higher-placed CA in the hierarchy. Thus, there is nobody to emit revocation ...


6

The message digest is a hash of the original message. You can't reconstruct the message from the digest. Bob computes the digest and compares it to the one Alice sent him. If it matches, Bob knows that the message hasn't been changed, since any change in the message will cause a change in the digest. He also knows that the message came from Alice, ...


5

This 'problem' is often encountered by people who are just learning about cryptography and public / private key cryptography. So I understand your confusion. The reason we call both a 'key' is because its cryptographic function is to be a cryptographic key which has nothing to do with common day keys and locks. In many analogies for laymen the lock - key ...


5

A normal CA has a procedure in place for this. it starts with invalidating ALL certificates signed with the key, Than have the CA make a new Root Key and Certificate. than do all the steps involving the setup of a new CA. After that is done, reissuing all certificates that were affected and still valid. A problem if this is not mitigated soon after the ...


4

The whole concept of trying to explain signatures with the terminology of encryption is flawed. It simply does not work. So let's unravel the whole thing, and this will require some formalism. Formally, a cryptographic signature system consists in three algorithms: KeyGen: takes as input a "security parameter" (say, the length of the key we want to ...


4

What is the difference between Public Key Infrastructure and Public Key Cryptography? How are they related? I think the difference between Public-key infrastructure and Public-key cryptography is pretty clear from their Wikipedia definitions (quoted after the tldr). TLDR: Public key cryptography is another name for asymmetric algorithms, while PKI is ...


4

1: Use hardware tokens, like a Yubikey configured for challenge-response based authentication. Or smartcards. You load up the key on them all and hand them out. They're designed to keep the secrets secret. 2: Stop using a single key, start using one keypair per user for accountability and practical revocability.


4

The following is a possible series of steps you could take. I'm considering that you have a secondary, online HSM for the period during which the affected HSM is removed from service for repair. Destroy all key material on the HSM Notify vendor of device problem and serial number Return device in tamper evident packaging to vendor address using secure ...


3

This in an interesting problem; with only symmetric encryption, how do you secure a communication channel (ensuring both privacy and authentication)? Researchers have been working on the problem for centuries and the best solution they've come up with is: Public Keys! That's a tongue-in-cheek way of saying that authentication is a fundamental problem in ...


3

There is no way to do this simply. there are some tools that can help you to easily get started. like: XCA EJBCA openssl none of them are a full PKI aside from possibly EJBCA but thats not trivial to setup. XCA is a small frontend tool to get a graphical interface to generate,sign and revoke Certificates. EJBCA or Enterprise Java Beans Certificate ...


3

As an Introduction sentence: PKI(Public Key Infrastructure) and PKC(Public Key Cryptography) with together are considered as PKT (Public Key Technology). Short answers: for reading the image open it in new window Now is the time to answer the questions. 1. What is the difference between Public Key Infrastructure and Public Key Cryptography? I ...


3

Credentials seems appropriate.


3

In answer to (3)- It was not until recently that API's to do this were readily available without having some significant resources behind you. Here is a guide to doing what you describe in (1) and (2). http://nelenkov.blogspot.com/2013/09/using-sim-card-as-secure-element.html There are some applications doing this- the article comments say a bitcoin app is ...


3

make a Certificate Revocation for your root certificate and export it to a Certification Revocation List, putting it at the location you specified the CRL will be placed.


2

Asymmetric crypto is made of a private and a public key. The reason for calling both keys, is the fact that you can indeed use either to encrypt and the other to decrypt. Real world scenarios do exists for this; your signature is encrypted using your private key. Anyone with access to your public key can decrypt the signature to confirm you identity. The ...


2

WARNING: Creativity ahead, which is often bad for security (at least without thorough review). This sounds like a case in which an SSH agent could be useful. An SSH agent provides a socket interface over which SSH clients can ask the agent to perform key operations for them, which enables the following common uses: You can have the long-running agent ...


2

If you truly wish to be a CA take heed of the security implications of doing so. The private key used to generate the root CA for your intranet should literally be locked in a safe. And access to said safe should be physically monitored. Using a self signed root CA forces your users to not only trust that you are performing due diligence with the safe ...


2

I will answer this in a two-level approach: General term answer and the specific SSL/TLS clarification in blockquotes. Public Key Cryptography (PKC) solves the problem of securely exchanging information without the need of previously agreeing upon a secret key. To be part of PKC, every agent needs to have a Private Key (which should only be kept by the ...


2

You are correct that it would not cause any harm to the certificates that were already issued, but it does call into question which certificates are still trustworthy, and which are not. It's safer and easier to just treat all certs issues by that signing key as "compromised" and re-issue them. In this case the CA's signing certificate would be revoked with ...


1

Possible Authentication mechanism. Sources : Oracle Dovecot (An email server) Wikipedia techrepublic Although the other suggestion of Credentials by @neil-smithline could also be true.


1

Follow these instructions to configure a Windows Based CA. Since you are issuing client certificates, be aware that SHA2 hashes aren't supported on XP. The simple answer is to: Install AD Install an Enterprise CA on the Domain Controller Edit the Certificate Template to issue End User Certificates (set the permission for users to self-enroll, or go to a ...


1

I designed an image as Short answers of questions: for reading texts of the image open image in new tab for more details go to my previous answer.



Only top voted, non community-wiki answers of a minimum length are eligible