Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
6 9
~22k people reached

  • 0 posts edited
  • 2 helpful flags
  • 312 votes cast
comment Server-based PDF Signing using HSM
Well, PKCS#11 has been designed for personal smartcards and does not fit very well with cloud services. However, for instance, with the nCipher HSM (I have some experience with it) you can configure a quorum of operators required to access the key. Such a configuration can improve the trust on the system for the customers. Unfortunately I never used Cloud HSM. At first glance I think it is possible to build a signature service on a Cloud HSM. But I also believe that, first of all, it's worth an comprehensive threat analysis
comment How do systems protect against a stolen code-signing certificate after the certificate expires?
I realized that may be a bit unclear in my answer. I updated my answer trying to give a little bit more details.
comment How does encryption/decryption work when one generate random key?
I said "encrypted file" but maybe "encrypted data" is a better term. I mean, even with the password, the encrypted data (i.e. the cipher output) does not contain itself all required information to be decrypted. The algorithm parameters are also required such as the IV for a symmetric cipher, the PBKDF2 salt or iteration count... Of course, a file encryption software should gather all these information along with the encrypted data into the "encrypted file".
comment Signing my certificate by using my smart card and eID card?
When you are talking about keyserver, do you mean GPG keyserver?
comment Signing my certificate by using my smart card and eID card?
I do not know if it is a common practice and it depends on what you want to do with your certificate. For instance if you want some third parties to validate some documents you signed, you should use the signature certificate. If you want to authenticate yourself against a web site or web service (e.g. using a SSL connection with client authentication) you should use the authentication certificate. See the CPS sections 1.3 and 1.8 for more details on the certificate usages.
comment GOST cipher test vectors
Maybe you can use these tested implementations to generate some test vectors.
comment Initialization vector with cipher block
Non random IV may lead to a "chosen plain text" attack. There is a nice description here:…
comment Is anybody using client browser certificates?
Yes I was unclear. I meant that the administration is able to to ensure that the identity of certificate requestor (i.e. the private holder) matches and the declared identity. Technically speaking there is a unique private number on the tax payment receipt (of the previous year) used as shared secret during the certificate generation process.