Reputation
763
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
8 19
Newest
 Critic
Impact
~16k people reached

  • 0 posts edited
  • 0 helpful flags
  • 113 votes cast
Mar
30
accepted How does SSLStrip grab traffic?
Mar
30
asked How does SSLStrip grab traffic?
Mar
23
accepted Use openssl to individually verify components of a certificate chain
Mar
22
revised Use openssl to individually verify components of a certificate chain
added 240 characters in body
Mar
21
answered Use openssl to individually verify components of a certificate chain
Mar
21
comment Use openssl to individually verify components of a certificate chain
My question was how to verify g1 signed g0. Involving g2 doesn't make sense to me here, nor does involving EquiFax's root cert from the trusted store. Can I not just verify this one sig without having to invoke the rest of the chain to some self-signed root? Or is this not supported by OpenSSL?
Mar
20
asked Use openssl to individually verify components of a certificate chain
Mar
16
accepted Why doesn't openssl s_client correctly validate google.com:443?
Mar
16
awarded  Critic
Mar
16
comment How to verify a signature of one entity by another using OpenSSL CLI?
@dave_thompson_085 Thank you; very helpful. Rather than clutter this thread with ancillary comments, I have started a new question at security.stackexchange.com/questions/117651/… Would be very grateful if you could weigh in.
Mar
16
asked Why doesn't openssl s_client correctly validate google.com:443?
Mar
16
comment How to verify a signature of one entity by another using OpenSSL CLI?
Curiously, s_client -connect www.google.com:443 fails validation with the same chain. I guess it doesn't use the certs in /etc/ssl/certs like verify does?!
Mar
16
accepted How to verify a signature of one entity by another using OpenSSL CLI?
Mar
16
comment How to verify a signature of one entity by another using OpenSSL CLI?
I think you nailed it! I didn't set up the same chain (it would require I spin up multiple local CAs), but I did notice that renaming /etc/ssl/certs so that OpenSSL couldn't find the relevant roots did result in failed verification. And then adding explicit pointers to the cert files did result in valid verification. This is consistent with your answer above! Cheers.
Mar
15
asked How to verify a signature of one entity by another using OpenSSL CLI?
Aug
15
awarded  Notable Question
Jul
6
awarded  Taxonomist
May
19
awarded  Commentator
May
19
comment Which is safer, GSM or CDMA?
Man, relying on spread spectrum as "security" is really a stretch.
Nov
28
comment Why shouldn't we roll our own?
The smartest person I know of who created a bad cryptographic primitive (in this case, a block cipher) is Dan Sleator, who is a highly-regarded theoretical computer scientist from Carnegie Mellon. He made a Feistel cipher out of a bad round function for his ICC chess server (acsac.org/2005/papers/57.pdf)