Tag Info

New answers tagged

0

If you do decide to use asymmetric crypto alone, you must include some randomness in each message. If you don't: Suppose an eavesdropper captures a military communication and he knows the message will be one of two things: Attack from the East Attack from the West Although he can't decrypt the message, he knows the public key, so he can try encrypting ...


2

If you have messages to send, and you use an asymmetric encryption algorithm, and that algorithm happens to be able to process each message wholesale because the messages are small enough, then indeed you can design the protocol without any recourse to extra symmetric encryption. However this may lose some flexibility, and have a non-trivial performance ...


3

PKCS#8 is a flexible standard; it is a syntax for encoding private keys with optional password-based encryption. The security level that can be achieved depends on the algorithm used to convert the password into a key, and the cryptographic algorithm that works with this key. PKCS#5 defines a number of combinations of password-based key derivation and ...


0

An alternate approach and a legitimate one is to simply use a random Class 4 UUID1. This way you detach your keys from any changes in material circumstances and any shifts in your privacy attitude in your personal or professional life. If you intend to use key servers so that people may contact you securely from the onset (instead of sending a signed ...


3

I believe that I'm now safe from all phishing and pharming attempts. Since only few CAs can issue such "green bar" extended validation (EV) certificates you are mostly right if you trust EV certificates. It might still be possible that the CA got hacked, like done with Comodo and DigiNotar in 2011. It is not possible for an attacker to just add a new CA ...


4

It's possible but highly unlikely: An attacker could have created a fake certificate based on compromising a CA certificate or reverse-engineering an valid one. These are both believed difficult, which is why the system is believed secure, but they have happened before. Typically, once the extent of the compromise is known, your OS or browser developers ...


2

The protection is called "luck". The probability that such an event occurs are sufficiently low that it can be neglected. Provided that the RSA keys are generated properly. In 2012, some researchers made an interesting study in which they collected 11.5 millions of publicly available RSA keys (e.g. keys from SSL server certificates). They found that some ...


1

Native certificate-based authentication is available in unmodified upstream OpenSSH. It is not, however, based on x.509. First, generate your CA: ssh-keygen -f ssh-ca Next, install your CA key in .authorized_keys with a cert-authority prefix: echo "cert-authority $(<ssh-ca.pub)" >>.ssh/authorized_keys From that point, whenever a key is ...


10

Probability. When generating a 1024-bit RSA keypair, one of the first jobs is to pick a pair of primes p and q such that the product of those numbers (i.e. p multiplied by q) is 1024 bits in size. The simplest way to do this is to pick both values to be somewhere around 512 bits in size each, as 2512 × 2512 = 21024. Note that I'm picking 1024-bit as ...


1

Basically, statistics. The chances of generating two identical private keys in an environment with good randomness are effectively nil.


0

I'm probably a few years late but anywasy... One problem that comes to mind is that a mitm can prevent the client from negotiating for multiple certs and only get the one they hacked from a CA. The easy solution IMO is to use another port or just make up another protocol name so that the client KNOWS it should get MORE THAN ONE certificate.


-1

I'm fairly certain SHA-1 will be deprecated by most OS's by 2017. Especially with browsers taking the initiative and flagging certificates secured by SHA-1 by mid 2016 and Google's project Zero cracking the whip on implementing encryption over the web. The issue here isn't about connectivity. It's about pressuring network administrators/device ...


1

I think you're putting two encryption forms together and getting confused. First you need to look at encryption in two ways encrypting data and encrypting a tunnel. Encryption of data is done at the endpoint before the information is send over the wire. This can be done using Symmetric or Asymmetric encryption. Symmetric encryption is an exchange of the ...


1

A man-in-the-middle attack, by definition, involves impersonation. The basic idea is something like this: Alice wants to have a conversation with Bob. Mallory tricks Alice into sending the first message to him instead of Bob (exactly how can vary greatly). Mallory contacts Bob, pretending to be Alice, and passes on Alice's message. Bob replies to ...


1

The answer to your question is: no. MiTM is done to steal information that the user THINKS they are sending to a legitimate site. HOW it accomplishes this usually involves "impersonating" whatever party you're trying to send your data to, and sometimes involves traffic decryption (although most of the time, decryption isn't feasible without some sort of ...


1

It depends. With some ciphers, it is possible to passively eavesdrop the communication once you have the private key. It may be done even for connections wiretapped before you obtained a copy of the private key used. However, for another class of ciphers, those providing forward secrecy (PFS), the client and server generate a new ephemeral key for the ...


2

Generally the main use for MitM at the moment is for the attacker to impersonate the website to the victim. The aim being, usually, to get hold of the victim's credentials in order to impersonate them, authenticate correctly to the website and make off with the contents of their bank account, data store, intellectual property etc. This is done, typically, ...


0

If a Commercial CA believe they are compromised they will revoke the sub-CAs that they believe are affected. This does not mean that all software that trusts that CA will automatically distrust the compromised CA. Browsers for example should check a certificate revocation list (CRL) before trusting a certificate chain. However, these checks are ...


0

This is quite similar to Protect database data from everyone, including sys admins, etc. Your second option doesn't work (at least in isolation). Just knowing the health info data may be "bad enough" (and indirectly matcheable to the user). It may be interesting to additionally hide that relationship, but I'm not convinced it's worth doing it. The second ...


2

TL-DR SSL client cert doesn't need KeyUsage but if present it should be digitalSignature except for very-rare-if-ever fixed-*DH. Caveat: You tagged SSL so I assume by "path that requires a certificate" you mean SSL/TLS or something over SSL/TLS (not necessarily HTTP/S). If you mean something more like CMS or S/MIME, or XML-sig, or even PGP, the answer may ...


0

not just HTTPS with SSL since I've read it can be sniffed and decrypted with a few tools This is not true. In general (and in the case of SSL/TLS) replay attacks are prevented using a "number only used once" (ie. nonce). If the other party receives the nonce twice then it's obviously a replay attack. With regard to the blog post you linked: To ...


1

No. It's irrelevant, although it's better that they don't use weak root signatures. I think the setting may refer to the intermediate CA instead. Remember that from 01/01/2017 Microsoft will start rejecting SHA-1 signed SSL certificates, and Google will degrade the security level indicator for those sites with a certificate which is valid after 01/01/2016, ...


2

The subject name, in a certificate, is in the subjectDN field, which is a Distinguished Name: a structure name whose initial goal was to serve as index in the Directory hierarchy (the Directory never existed in practice, but it can be imagined as a giant worldwide LDAP server). Sometimes, there are some usages which call for notions of identity that do not ...


0

Maybe I am misunderstanding the question, but one of the most common reasons one would use a SAN cert is for sites that have a CNAME or alias. For example: www.example.com example.com If a user accesses https://example.com but the certificate is issued to www.example.com then the user will receive a name mismatch warning. If a SAN cert is used then ...


1

Cryptographically, the scheme you describe is not increasing your risk. From an overall security standpoint, adding the additional recipients creates more points where things can go wrong. Each of the recipients represents an additional endpoint where the message must be secured. You may trust each of the people, but can you equally trust all of their ...


0

This in general depends on the exact way the assymetric encryption is peformed (i.e. a completely naive implementation of RSA could be a problem, See Halstads attack), for GPG/OpenPGP there should be negligible extra security risk when encrypting the same string using multiple different public keys. Modern cryptographic protocols and algorithms are usually ...


0

When a key never leaves the smart card there's no need to encrypt, but when it is sent to an outside storage, it's obviously different. Both ways are good in terms of security, these are just different realisations. As an example WWPass PassKey has the Secure Element which is a Java smart card. It is capable of running Java applications. It stores the ...


1

Yes. You can use OpenSSL to convert the certificate into different formats as required by the application / server. I've seen Apache / Tomcat configured a number of ways. Sometimes with a .pfx, sometimes with .pem files, and sometimes using the Java keystore. IIS typically uses .pfx files. With that being said, you want to make sure that your CA allows ...


1

Yes, you can buy one certificate and use it on unlimited number of servers. However, some servers may require you to convert the certificate and the private key into an appropriate format. You may look into documentation to find the details for each program.


2

This highly depends on the smart card. Some card simply provide a key store whereas others provide a complete infrastructure where you send your data and the smart card can sign and/or encrypt the data. The second type (which is typically meant when using the term smart card) have the advantage that the (private) keys never leave the smart card.


4

What the page you link to means is that there are known attacks which, when implemented, would allow building collisions with some costs: If the goal is "raw collisions" then the computational effort is equivalent to running 261 times the SHA-1 function. A raw collision is such that the attack produces two messages m and m' which are distinct but hash to ...


3

SHA1 hash has 160bits. If SHA1 was safe, you would need approximately 2^80 iterations to find a collision. Why 2^80 and not 2^160? Because of birthday paradox: http://en.wikipedia.org/wiki/Birthday_attack The general "collision finding" algorithm works like this: http://en.wikipedia.org/wiki/Cycle_detection#Tortoise_and_hare ...simply, to rabbits, one is ...


2

PGP Format Versions and Key IDs Older versions of the PGP Key Format have several issues that potentially harm security. RFC 4880 further explains these, summarized very briefly: higher chances for key ID collisions fingerprint only hashes key, not size and algorithm (again, higher chance for ID collisions) use of MD5, which is considered broken Anyway, ...



Top 50 recent answers are included