New answers tagged

3

You can have multiple valid certificates with the same subject but different keys active at the same time. A possible use with SAN certificates would be to use certificates with the same subject but different key for the different hostnames contained in the certificate. You could even use it for the same hostname (i.e. same hostname on multiple IP addresses) ...


2

As explained over at explain xkcd, key signing parties are a way to meet a lot of people and check their IDs easily in order to sign their (GPG) public keys. Signing public keys is essentially vouching for the identity of the key holder, as not everyone can make sure it's actually the key of the real person they'd like to talk to. Thus, the so called "web ...


0

Well, in the final PKCS12 you should encrypt the private key. The pkcs12 utility allows you to specify how you want to encrypt the private key. -aes128, -aes192, -aes256 use AES to encrypt private keys before outputting. -camellia128, -camellia192, -camellia256 use Camellia to encrypt private keys before outputting. I would consider aes256 very secure ...


0

Password-protecting a key, either symmetric or asymmetric, is a common practice. See the question Encrypting With Passwords - Encryption of Key vs. Data for an example. One problem is that users can choose weak passwords. This can either be, as you note, the same password that they use to authenticate to the site, or it can just be a generically weak ...


0

Sebastian gave a great answer, but I also wanted to point out that your problem outlines exactly why you want to build a Web of Trust (https://en.m.wikipedia.org/wiki/Web_of_trust) signing other's PGP keys and having them sign yours.


8

Will all the key pairs that ssh-keygengenerates be unique (not taking collision into account at this point)? Yes, every key pair will be unique, with well above 99.99999% probability. This is largely due to the size of the key space and the quality of the CSPRNG that is used (see below). If yes, how does ssh-keygen assure that all key pairs that ...


0

2) Use private key to create a signature of the public key. 3) Upload the public key and its signature to the FTP server. 4) Mobile device downloads the public key and its signature. 5) Mobile device uses the public key to verify the signature. Why do this. Anyone who can create a keypair can sign the public key via the corresponding ...


4

There is no security impact to either stop or continue the handshake -- the security relies in the tests performed by the client, not the server. This is why the extension is called an indication. What matters is that the client duly verifies that the apparent server public key is really owned by the intended server. The SNI is a way for the client to convey ...


1

Once you have deployed a private key in a USB Dongle it is impossible to extract it. This is the main reason to use a USB Dongle, to ensure the key is always hardware protected. The only option is to generate a new private key and request a new certificate


1

Theoretically, the DER-encoded public key may be changed without modifying the actual secret in the private key; there are (at least) two ways to do that: Change the DER encoding. While DER is supposedly deterministic, there is still an optional element in the AlgorithmIdentifier structure that identifies the key type. For a RSA public key, the OID in that ...


2

Short answer: If the public key has changed, so has their private key. Long explination: Modern cipher suites used by SSL/TLS servers have exactly one key pairing. So as long as one of the keys has changed, then the other key has changed as well. So if they have also disabled SSLv2 then you should be good to go. More information can easily be found on the ...


0

If the public key changes, does that mean that private key has changed? Yes. Worth noting that it's probably pointless insisting on such a change (the rekey) - for all you know, their new key pair is stored on a shared folder open to the whole office... That is to say, regardless of how new it is, the key is only as good as their operational ...


0

SignServer is used for central code signing of MS and Android applications. Doesn't do iOS yet. Stores the private signature key securely in an HSM, and provides audit etc.


0

It is the last block of Hex from the following command: openssl pkcs7 -inform DER -in CERT.RSA -noout -print_certs -text


3

The pathlen constraint is only valid in subordinate CA certificates. If you followed the first article you linked and generated a trust-anchor with a pathlen constraint then it is not checked. According to RFC5280 section 6.1.4 (k) basicConstraint is only checked in certificate i+1 (where the trust-anchor is the first (i=1) and subsequent certificates in ...


1

Both the QR code and the 60 digit number need to be verified "out of band", for example: Saying the number out loud in a telephone call Meeting in person and scanning the QR code directly from the other device


1

Because some people use RSS to publish something for a specific population, sometimes for payment. If you use a GPG key to encrypt a rss, and just your clients have that key or sub-key, you can use the best of rss and privacy.


4

The CSR is not used as a fixed order but more like a wishlist. Most CA do not simply sign this CSR but instead just take the clients public key from the CSR and then add whatever information and restrictions they think should be added to the certificate.



Top 50 recent answers are included