0

According to RFC 3280 a certificate's basic syntax is

Sequence := 
{
    tbsCertificate
    signatureAlgorithm
    signatureValue
}

In tbsCertificate, SubjectPublicKey is the public key of the server. The signature value is encrypted with the private key of the server (if I am not wrong). How will I decrypt the signature value (to validate the certificate) if it can only be decrypted by the server's private key?

0

I'm sorry you don't need the private key to "decrypt" something encrypted using asymmetric encryption, you need the public key, which is in the certificate, or the certificate of the trusted authority. Using the public key also provides proof that the private key was indeed used.

See this prior entry Digital Signature and Verification? and this: how digital signature verification process works

  • reading your answer and the posts you have given the link to, I need public key to decrypt the signatureValue ? and also encrypting the data with private key is signing ? – Mamoon Ahmed Apr 30 '16 at 23:06
  • Saying you need the public key to decrypt is wrong. Public keys encrypt and verify, Private keys decrypt and sign. Im sure you know what you are talking about but your answer is misleading. – Luke Park May 1 '16 at 12:29
  • @LukePark so I will encrypt the whole certificate with the public key given in certificate and compare those encrypted messages to verify ? – Mamoon Ahmed May 2 '16 at 0:25
  • @MamoonAhmed No. The certificate contains the signature already. You use the public key to verify (decrypt) the signature, which will give you a hash. Compute the hash of the rest of the certificate and compare those. – Luke Park May 2 '16 at 0:28
  • @LukePark Thank you so much for the answer. another question is ? a data encrypted with a private key can be decrypted with public key ? – Mamoon Ahmed May 2 '16 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.