New answers tagged

3

TL;TR: there is maybe (or maybe not) some substance to the patent but I consider the claims made in the press widely exaggerated. I don't see any substance for the claims of helping against MITM. And it addresses different use cases than TLS, so no need to compare. While there was lots of press end of 2014 about this issue it basically repeats the same ...


0

After the public key has been imported pgp --import PublicKeyToImport.asc run pgp --list-userids to determine the key or User ID to be used with --encrypt. Alg Type Size/Type Flags Key ID User ID ---- ---- --------- ------- ---------- -------


6

Either you give the public key to Bob when you physically meet him and mutually verify identities (as at a key-signing party), or Bob verifies your public key through a trusted introducer (e.g. a Certification Authority) This is the "Infrastructure" part of PKI.


2

The authentication to ssh server goes in two steps. The first one is validation if your public key is in the authorized_keys file (or output of the appropriate command), the second one checks if the signature provided by the appropriate private part is the same. In the server log, you can see: sshd[9951]: debug1: test whether pkalg/pkblob are acceptable ...


0

Rouge Key Identifiers would hinder unambiguous path finding. In the worst case several potential paths have to be checked for validity. But would you have a certificate with a rouge identifier in your trust store anyway? If you don’t trust it, no need to check that path. And if you do trust it, then that path would not validate.


0

No, there is only one public key in the certificate. Obviously the server should also have the private key that belongs to the public key in the certificate. The session key is retrieved using key establishment. There are basically two ways: the master secret is generated and then encrypted by the client using the public key of the server, the server can ...


0

GlobalSign supports the installation of your certificate on a token or smart card that uses the Microsoft Base Smartcard Crypto Provider* in place of a Safenet token. *https://support.globalsign.com/customer/portal/articles/1999625 (Mentioned under Prerequisites and Step 5 of the installation)


1

The passphrase is used to encrypt the private key, which prevents it from being used to digitally sign commits. This protects your private key from being abused by an attacker if it becomes compromised (e.g. you accidentally commit your private key to a public repo) unless they can crack your password.


1

In your question you are only taking about keys, where a key can signed by someone else but the key is not associated with an identity itself: If John also has a key signed by Peter, presents it to Bob, Bob verifies, but John says that his username is Alice, than what to do? You then propose the concept of adding the identity: Is it ok if Peter ...


2

CRLs have problems, for example: online revocation checks are slow and compromise privacy. What happens if a client can't get through to a CRL server? If the client refused to go ahead until the CRL server was available, then attacker could cause a mass denial of service by dropping TCP packets targeted at this server. This would grind the Internet ...


3

The only intuitive answer (I got) is it reduces maintenance cost of CAs, since there will be loads of public keys it has to maintain. Otherwise, they can just scrap of keys whose time period is over. No, that might be a reason but this is more due to several security reasons. The first reason: better change your password every x months. Lets consider ...


0

The public key is requested from the sender when you are initiating the session. You can also verify your keys to see if you are a victim of a MitM attack. All information regarding that can be find in the whitepaper. The coming quote is an answer to your question about forward secrecy. Clients exchange messages that are protected with a Message Key using ...


4

You have got that wrong, at least the encryption. Asymmetric Encryption is done using public key of the receiver. Therefore it provides Secrecy (nobody without private key can not read the message). But it does not provide Integrity -- anyone can encrypt any message and send it to you with your public key. Wikipedia is a good friend: Digital signature ...


1

Fundamentally, to trust a computer, you need to verify that it knows something that only the computer you're expecting knows. This is how all certificates work: you assume that because they signed something with a key that only they could possibly know then it's actually the person you wanted to talk to. The same applies for computers: the computer has to ...


3

You can have multiple valid certificates with the same subject but different keys active at the same time. A possible use with SAN certificates would be to use certificates with the same subject but different key for the different hostnames contained in the certificate. You could even use it for the same hostname (i.e. same hostname on multiple IP addresses) ...



Top 50 recent answers are included