Tag Info

New answers tagged

1

First, I think that you're confusing some terms. The term is "digital certificate", "certificate", or simply "cert". Not "digital certification". If you really mean "digital certification" then this answer is likely wrong. Yes. Symmetric keys are used for bulk encryption because symmetric encryption algorithms are much faster than asymmetric ones. No. This ...


3

There is no standard way to do what you envision and I'm not aware of any proposals of relevance. The currently established PKI structure allows only for a single certificate chain (i.e. a single issuer for a certificate) and the TLS protocol like used allows only for a single leaf certificate. In theory one might create a certificate with multiple issuers ...


4

The other answers are right that in practice Cloudflare can't provide their full services as effectively without introducing this kind of security risk. Roughly speaking, Cloudflare does two things: They mirror your site, and can serve it from their own servers (their CDN). This way, if your site is getting hit with a DDoS, they can absorb the traffic ...


4

Potentially Cloudflare could work in a pass-thru SSL mode. However, it would not be as good at protecting against DDoS attacks. In pass-thru mode, clients would make a TCP connection on port 443 to Cloudflare, which is forwarded to your web server. The SSL setup takes place between the client and your web server, so while the connection goes through ...


8

It can't work any other way because the way cloudflare works is that they mirror your files for your users on their own servers. To request the files, clients connect to Cloudflare instead of your server. That means their browsers expect that the connection is encrypted with a valid TLS certificate from cdn.cloudflare.com, not from your website. End-to-end ...


23

From what I understand, no, Cloudflare couldn't work any other way. Cloudflare analyses the connection before passing it to your webserver to ensure that it's correct and coming from a legitimate client. In order to do this, it needs to be able to see the contents of each packet from and to your server. With SSL/TLS, each packet is encrypted and therefore ...


0

Why do certificates need to be renewed in the first place? That happens because: You lost your private key Your private key is stolen You want yourself to revoke the old instance of your certificate Your certificate reached its expiration day The password that protects your private key has been compromised You have misused somehow your actual ...


0

Most HSM's allow for using custom code, but in general you have to ask the specific vendor, it's not something that they advertise. Often it breaks certification. On the other hand, running applications that can e.g. validate the input can make for a much more secure experience. Generally these applications are sandboxed and need to be signed. Of course, if ...


0

It can be done with openssl. In a terminal type: openssl pkcs12 -in myfile.p12 -nokeys -nomacver And just press ENTER when the import key is requested. The certificates contained in the PKCS12 file should be printed (en PEM format) on the standard output. NOTE: even if the certificates are present in plain text in the PCKS12 file, the file full content ...


4

The limiting factor for an attacker using a quantum computer is the number of qubits they can keep entangled long enough to perform a calculation. The qubits required to crack RSA keys are estimated to be 2•bits while ECC is roughly 6•bits, but RSA keys are generally much longer so they end up taking more qubits; roughly 3x on the low end (2048 vs 224) and ...


1

The answer by @discreet gives good links, but I want to add my understanding. Without knowing which vendor you bought your PKI from, it's hard to know exactly what the PIN is doing inside, because unlike EMV bank cards, enterprise PKI systems have no industry standards and each PKI vendor will do things differently. So here's my response to your two points ...


5

What is a session key? A session key is a single-use symmetric key used for encrypting all messages in one communication session. Scenario: Alice would like to establish a secure communication with Bob. But she cannot provide the key in plain text, otherwise someone sniffing the communication might be able to decrypt the information later on. What ...


4

If my understanding is correct, anyone in possession of Bob's private key can easily determine the session key and decrypt the message. Only Bob should have access to Bob's Private Key, hence no one else would be able to decrypt the encrypted session key.


2

I am assuming you are Using Chip based Smart cards (PKI Card).Smart Card contains a Secure File System for storing your Private Key and other information. Here is some basic about smart card. PIN is used to encrypt and decrypt the Private Key.Private Key is encrypted in Smart Card using. So when you try to login PIN is used to decrypt the Private Key and ...


0

One more thought on expiration of a certificate is addressing the question of asymmetric key algorithm itself. From a public key is it possible to determine the private key? Well the answer it is improbable rather than impossible. Generally it is assumed it would take a million years to for a computer to find the private key from a public key. But what if ...


0

You don't need to do this; this is already solved by the SSL/TLS handshake. The SSL/TLS handshake goes a bit further, in that it not only establishes a secret by using both the public and private keys of both parties, but also uses a certificate to establish that the server is who it reports to be - preventing a man-in-the-middle attack. A quick, more ...


5

Important note before I start: in OpenPGP, there is nobody telling you whom to trust. You have to perform this verification on your own, but there are tools (like certifications in the web of trust) that help you doing so. For the same reasons, I cannot provide you with a step-by-step tutorial on verifying a given OpenPGP key, but can only give some advice ...


3

With the Great Firewall of China, the country has a tight grip on its communication infrastructure, especially on the IP and TCP layer, however there are still some options left. It all depends on the volume or reliability though. Be careful! By using VPN or TOR you will become subject of investigation, especially if you are building connections to the USA ...


1

In OpenPGP, signatures are used not only for documents, but also for certifications between primary keys with different levels of trust (sig, sig1, sig2, sig3; as hex codes 0x10-0x13 in this order) and several more internal stuff. Signatures are also very important for binding subkeys to primary keys (and the other way round): these are displayed as sbind ...


0

There is a pretty good write up about PGP at Wikipedia. According to the GPG manual (pgp for linux) under --check-sigs flag: The status of the verification is indicated by a flag directly following the "sig" tag... So, looking at that: Sig3 means that another user has personally checked the fingerprint or key. If it says Sig only the means ...


1

That wording is an abbreviation; the key is (or keys are) actually the same, the difference is whether the certificate allows use of the key for the relevant purpose. See section 2: Note that there is no structural difference between ECDH and ECDSA keys. A certificate issuer may use X.509 v3 keyUsage and extendedKeyUsage extensions to restrict ...



Top 50 recent answers are included