Tag Info

New answers tagged

-2

Shurmagee said, "I am curious to know about the workings of the cryptographic protocol and how it enables security." There are many kinds of cryptography, of course. One category of cryptography is called "Public Key / Private Key", or "asymmetric". One example of asymmetric encryption is "RSA" (invented by Rivest, Shamir and Adleman). The math behind ...


1

Lets assume that we're talking about PGP/GPG keys, and you've uploaded your public key for signing to one of the main PGP/GPG key servers. If you're curious how to revoke a certificate, here's a Guide to Revoking PGP/GPG Certificates. With those assumptions in mind: Will all things I have signed in the past with those subkeys be considered ...


1

Do GPG/PGP keyservers "garbage collect" old keys which have expired, been revoked, or simply haven't been updated in a decade? A kind of "garbage collection" might theoretically be implemented for some OpenPGP key servers, but currently isn't (at least not for the large pool of synchronizing key servers). There are several reasons: Sharing ...


4

Sign Your License File You want to sign the data with your private key to create a signature. Generate a license file Encrypt the file with your private key (signing it). Provide the public key with your application In your program, decrypt and verify the file contents have not changed with your public key. The signature cannot be replaced since only ...


0

I think that you're asking how to generate a timestamp response as defined in timestamp-protocol: RFC3161, with openssl to generate and sign the response using a PKCS#11 (HSM in your case) as a TSA signer. I think that there is no native way to use PKCS#11with openssl to do this. (maybe with some plugin like: opensc pkcs11 engine for openssl). If you take ...


0

When I started using PGP, it seemed reasonable to me that my email address had changed over the years and would likely change again. Having keys tied to old email addresses seemed ridiculous, so I thought if I use my full legal name and my DOB, my PGP key would be tied to my real life identity. Others encouraged me to set up my PGP this way. This was ...


0

There is no real best practice here, only conventional usage. As with all types of digital IDs, the defining element when setting one up is knowing what you want to authenticate. The identity of an email user is pretty different from the one of a server and this will reflect in the properties of the certificate you generate. One common mistake (one you ...


0

It is legal and possible for the CA to take a CSR and modify the DN it finds there before issuing the certificate. For instance, with StartSSL free certificates they ignore the DN provided and issue based solely on the public key, the domain name requested (CN), the country (C), and email of the requester (E). And according to the user interface, ...


1

Like this: CA machine: ca.crt, ca.key Server: ca.crt, server.crt, server.key Clients: client.crt, client.key, ca.crt Notably, ca.key does NOT go on the server. If the server is compromised, then the attacker won't get ca.key. With easy-rsa you generate the key and certicate on the CA machine, and send them to the client. Technically you don't need to ...


1

Yes, it matters when: 1) there is a constrained hardware and there are constrains on the time that it takes to run the whole operation (protocol) that includes authentication/encryption (e.g., waving a smartcard at a tourniquet when paying for entering a metro). The operation might include several encryption and decryption operations that take place in the ...


0

Like said in comments, it's mainly important on webservers: https connection implies that each visitor creates multiples connections for each page and doing so the encryption became a non negligible part of the resources used on the server. Since in this case server receive a lot less data than it send, and the client resource consumption is less critical, ...


1

By default, a user’s SSH keys are stored in that user’s ~/.ssh directory. You can check if your private key is in that directory by listing the contents: $ cd ~/.ssh $ ls authorized_keys2 id_dsa known_hosts config id_dsa.pub The private key is usually something like id_dsa or id_rsa. To regenerate the public key part with just a private ...


3

Yes, the same RSA key pair can be used for both (Open)SSL and OpenPGP/GnuPG. The monkeysphere project contains a tool to convert RSA keys in PEM format to the one defined by OpenPGP, pem2openpgp. For converting the SSH key pair into the PEM format, there already is a comprehensive answer in Converting keys between openssl and openssh.


1

The way I look at it is that if I have an encrypted message which is a series of bytes I can decrypt this with your public key. However any series of bytes is "valid" as a result of your encryption. This means that if somebody modifies the message then I can still decrypt it, I just won't get what you originally encrypted. The person who did the tampering ...


4

If I left a locked box on your porch in the middle of the night and chained it to your door and dropped a key in the mail slot, it would be secure. Nobody else would be able to get in to it and only you would be able to open it, but you would have no way to know who left it for you. It could have been left by the Publisher's Clearing House prize guy or a ...


9

Encryption with someones public key provides confidentiality, but doesn't provide authentication or integrity. In a PKI architecture, you encrypt your message with the public key of the recipient. This proves only that you know their public key, but nothing about yourself. When their public key is indeed public, you could be anyone, including an attacker ...


33

Encryption provides confidentiality, i.e. ensures that only intended recipient will be able to decrypt the message. Signing provides authentication, i.e. allows recipient to check that message was sent by a particular sender and wasn't modified. One way to look at this in the context of PKI is like this: encryption only requires the knowledge of ...


1

The «reference browsers» are marked with an R in the table below. What results were you given there? The problem may be on some of them (IE?) not supporting those ECDHE_RSA_* ciphers.


1

No, new versions of TLS have not removed cipher suites defined in older versions.1 Which version of TLS you use and which cipher suite you use are two linked but separate matters (you can't always use a new cipher suite in an old TLS version). OpenSSL is just listing which version the cipher suites were first added in. The PRF is mostly used for key ...



Top 50 recent answers are included