i have two similar questions about using certificates.

  1. I was reading about a Certificate Authority in a system and i've found that the CA uses PKI adhering to the X509 standard for public key infrastructure to sign a message. I will quote what the CA said:

Digital certificates are used to establish authenticity of user credentials and to digitally sign messages. Signing messages with a certificate ensures that the message has not been altered.

Source : https://github.com/hyperledger/fabric/blob/master/docs/protocol-spec.md#42-user-privacy-through-membership-services

I know X509 is a certificat format containing public key so is it possible to sign with a contract?

  1. While I was searching on the Internet for an answer to the first question, I've found that it is possible to ENCRYPT a message using a X509 certificate:


I am confused as to encrypt we need a private key. Is the key inside the certificate?

  • To encrypt a message for somebody you need the public key of the recipient which is contained in the recipients certificate. To sign a message in your name you need your private key and the recipient can use the public key in your certificate to validate the signature. – Steffen Ullrich Jan 10 '17 at 18:04
  • but the CA gives only a certificat without a Private key – Sig Touri Jan 10 '17 at 23:15
  • The private key is private to you and thus even the CA should not see it. You generate the key pair yourself and keep the private part secret. The CA just signs your certificate request which includes the public key and information about you but not the private key. – Steffen Ullrich Jan 11 '17 at 7:24
  • yes, I agree but how do you explain what i've found in these project they claim to encrypt and sign using a certificat did you visit the links? – Sig Touri Jan 11 '17 at 10:33
  • From my understanding of the linked information they don't claim that they sign and encrypt using the same certificate. Signing is done with the senders certificate where the sender needs the private key while encrypting is done with the recipients certificate and only the public key is needed. – Steffen Ullrich Jan 11 '17 at 11:08

You are missing some basic conceptual knowledge about how digital certificates, signatures, and PKI works. I work with these concepts daily as someone working in the IT Security profession, so let me explain.

Digital signatures are used to protect the Integrity principle of information (I in CIA triad) along with the related principle of non - repudiation. Integrity of information means:

Data is not maliciously modified / destroyed / corrupted while either at rest or in transit

The related principle of non - repudiation ensures that if integrity principle has been violated, the accountable party cannot deny having tampered with the data.

PKI is a asymmetric method of signing / encrypting data, which means that 2 keys are needed to complete the operation:

  1. Private key only known to one party in the transaction
  2. Public key of each party in the transaction that is freely available

Signing a Message

When signing a message, the message digest of the message body is first generated by running the message through a hashing algorithm such as SHA2. The private key of the sender is then used to encrypt the transmitted message digest. The public key of the sender is often appended to the message body. Upon receiving the message, the receiver decrypts the message digest using the freely available public key of the sender. By comparing the decrypted message digest with a separately computed hash of the original message, integrity and non - repudiation can be assured if the two resulting hashes are equal.

Non - repudiation is assured via the role of the Certificate Authority (CA). The role of this party is to attest to the identity of each party in the transaction (sender and receiver) by binding the pubic key of each party to a document known as a certificate that contains information such as the origination domain, and method used to generate the keys.

Encrypting a Message

The purpose of encrypting a message is to ensure the C and I in CIA - Confidentiality and Integrity. Encryption (ex: via TLS) ensures that data in transit only cannot be intercepted by a malicious 3rd party. Data is encrypted with the public key of the receiver so that only the matching private key of the receiver can decrypt the message.

To answer your question, The private key is known only to the receiver and is NOT in the certificate

  • thank you for your explanation but this didn't answer the qestion, I agree on what you said these are the bases but please look at the links and explain to me why they say they encrypt and sign using a delivered certificat? – Sig Touri Jan 11 '17 at 10:38
  • This is NOT the answer – Kennet Celeste Dec 9 '19 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.