May know what is the key differences between these three certificates.

  1. Sign/Verify
  2. Encrypt/Decrypt
  3. SSL
  • Wait, you mean actual certificates? As in the stuff servers present to show, who they are? As in types of key usage field in X.509 certificates? Or are you confusing stuff? – Peter Harmann Apr 26 '18 at 21:13
  • 1
    None of them are certificates. First is a task for asymmetric cryptography (which may use certificates), second is for symmetric crypto, and third is protocol. – user996142 Apr 26 '18 at 21:15
  • 2
    @user996142 you may be actually wrong. Took me some time to realize as well. He may be talking about the Key Usage field in the certificates. Also, asymmetric crypto can also encrypt and symmetric can also sign. – Peter Harmann Apr 26 '18 at 21:17

This is probably about (extended) key usage:

  1. sign / verify is known as Digital Signature:

    Use when the public key is used with a digital signature mechanism to support security services other than non-repudiation, certificate signing, or CRL signing. A digital signature is often used for entity authentication and data origin authentication with integrity.

  2. encrypt / decrypt is known as Data encipherment

    Use when the public key is used for encrypting user data, other than cryptographic keys.

  3. SSL is known as TLS Web server authentication or TLS Web client authentication

Source: this page of IBM which does a wonderful job of explaining (extended) key usage.

As for the differences: signature generation is used to provide message integrity and authentication (although it could be used for entity authentication as well), encryption is to provide message confidentiality and TLS authentication is to perform entity authentication.

There is another key usage for non-repudiation, which is for instance used for official documents. Non-rep has a slightly different use than just signature generation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.