Linked Questions

0 votes
1 answer
131 views

Server certificate authenticity validation process [duplicate]

I was reading this article about how the Server Authentication is being done During SSL Handshake https://docs.oracle.com/cd/E19693-01/819-0997/aakhc/index.html I do understand everything but I have ...
Mo Haidar's user avatar
  • 449
6 votes
1 answer
11k views

Where is the public key of the Certificate authority stored? [closed]

I'm talking about SSL/TLS certificate authorities. I know that they store their private key in a very secure location. But what about their public key that our browsers use? Where does it get stored ...
ATheCoder's user avatar
  • 183
6 votes
1 answer
9k views

How ECDHE is signed by RSA in ECDHE_RSA cipher

About ciphers that use ECDHE as Key Exchange and RSA as Authentication: How exactly this two algorithms work together, is ECDHE process encrypted by RSA public key? What are the DH parameters? ...
Johnny Willer's user avatar
6 votes
2 answers
4k views

Verify digital signature without key public key in signature

When receiving emails, I sometimes see the following: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I found an integer overflow in PHP, in the conversation of dates to "Julian Day Count" function. ...
W Khan's user avatar
  • 75
0 votes
1 answer
6k views

How to verify the signature value in a SSL certificate?

According to RFC 3280 a certificate's basic syntax is Sequence := { tbsCertificate signatureAlgorithm signatureValue } In tbsCertificate, SubjectPublicKey is the public key of the ...
Mamoon Ahmed's user avatar
3 votes
1 answer
677 views

Where does the list of trusted content authorities come from when using a web browser?

I was asked "how do browsers know whether or not to trust the certificate from the server it's connecting to" and thought it was a pretty good question. After doing some googling I found two answers: ...
Celeritas's user avatar
  • 10.2k
0 votes
2 answers
2k views

AES, RSA and man in the middle

So user A has a huge text that needs to be encrypted and send to user B. User A creates a symmetric key for AES and encrypts the messages with that AES key. Then, user A encrypts the AES key with the ...
Ivaylo Ivanov's user avatar
3 votes
1 answer
913 views

How secure is data at rest on Android/iOS mobile devices

We have a need to store security keys on a mobile device, i.e. iOS and Android consumer apps. The app uses those keys in an offline scenario to 'self validate' the signatures of its data. (it can also ...
Carlos P's user avatar
  • 141
0 votes
1 answer
172 views

PKI, certificates

I'm trying to understand how public key encryption works, or better how the authentication process works. As far as I understand the CA are here to pin a certain public key to a certain organization ...
ph0t3k's user avatar
  • 33
0 votes
0 answers
149 views

How does AWS verify signed requests?

How does AWS request signing and verification work? Let's say I have created a signed request using this guide. How does AWS service verify this signature? I see 2 options with their respective flaws (...
user32569's user avatar
  • 101
0 votes
1 answer
140 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145