Tag Info

Hot answers tagged

23

From what I understand, no, Cloudflare couldn't work any other way. Cloudflare analyses the connection before passing it to your webserver to ensure that it's correct and coming from a legitimate client. In order to do this, it needs to be able to see the contents of each packet from and to your server. With SSL/TLS, each packet is encrypted and therefore ...


8

It can't work any other way because the way cloudflare works is that they mirror your files for your users on their own servers. To request the files, clients connect to Cloudflare instead of your server. That means their browsers expect that the connection is encrypted with a valid TLS certificate from cdn.cloudflare.com, not from your website. End-to-end ...


5

Important note before I start: in OpenPGP, there is nobody telling you whom to trust. You have to perform this verification on your own, but there are tools (like certifications in the web of trust) that help you doing so. For the same reasons, I cannot provide you with a step-by-step tutorial on verifying a given OpenPGP key, but can only give some advice ...


5

What is a session key? A session key is a single-use symmetric key used for encrypting all messages in one communication session. Scenario: Alice would like to establish a secure communication with Bob. But she cannot provide the key in plain text, otherwise someone sniffing the communication might be able to decrypt the information later on. What ...


5

The other answers are right that in practice Cloudflare can't provide their full services as effectively without introducing this kind of security risk. Roughly speaking, Cloudflare does two things: They mirror your site, and can serve it from their own servers (their CDN). This way, if your site is getting hit with a DDoS, they can absorb the traffic ...


5

Potentially Cloudflare could work in a pass-thru SSL mode. However, it would not be as good at protecting against DDoS attacks. In pass-thru mode, clients would make a TCP connection on port 443 to Cloudflare, which is forwarded to your web server. The SSL setup takes place between the client and your web server, so while the connection goes through ...


4

There is no standard way to do what you envision and I'm not aware of any proposals of relevance. The currently established PKI structure allows only for a single certificate chain (i.e. a single issuer for a certificate) and the TLS protocol like used allows only for a single leaf certificate. In theory one might create a certificate with multiple issuers ...


4

The limiting factor for an attacker using a quantum computer is the number of qubits they can keep entangled long enough to perform a calculation. The qubits required to crack RSA keys are estimated to be 2•bits while ECC is roughly 6•bits, but RSA keys are generally much longer so they end up taking more qubits; roughly 3x on the low end (2048 vs 224) and ...


4

If my understanding is correct, anyone in possession of Bob's private key can easily determine the session key and decrypt the message. Only Bob should have access to Bob's Private Key, hence no one else would be able to decrypt the encrypted session key.


3

With the Great Firewall of China, the country has a tight grip on its communication infrastructure, especially on the IP and TCP layer, however there are still some options left. It all depends on the volume or reliability though. Be careful! By using VPN or TOR you will become subject of investigation, especially if you are building connections to the USA ...


2

I am assuming you are Using Chip based Smart cards (PKI Card).Smart Card contains a Secure File System for storing your Private Key and other information. Here is some basic about smart card. PIN is used to encrypt and decrypt the Private Key.Private Key is encrypted in Smart Card using. So when you try to login PIN is used to decrypt the Private Key and ...


1

First, I think that you're confusing some terms. The term is "digital certificate", "certificate", or simply "cert". Not "digital certification". If you really mean "digital certification" then this answer is likely wrong. Yes. Symmetric keys are used for bulk encryption because symmetric encryption algorithms are much faster than asymmetric ones. No. This ...


1

The answer by @discreet gives good links, but I want to add my understanding. Without knowing which vendor you bought your PKI from, it's hard to know exactly what the PIN is doing inside, because unlike EMV bank cards, enterprise PKI systems have no industry standards and each PKI vendor will do things differently. So here's my response to your two points ...


1

In OpenPGP, signatures are used not only for documents, but also for certifications between primary keys with different levels of trust (sig, sig1, sig2, sig3; as hex codes 0x10-0x13 in this order) and several more internal stuff. Signatures are also very important for binding subkeys to primary keys (and the other way round): these are displayed as sbind ...


1

That wording is an abbreviation; the key is (or keys are) actually the same, the difference is whether the certificate allows use of the key for the relevant purpose. See section 2: Note that there is no structural difference between ECDH and ECDSA keys. A certificate issuer may use X.509 v3 keyUsage and extendedKeyUsage extensions to restrict ...



Only top voted, non community-wiki answers of a minimum length are eligible