Questions tagged [public-key]
The public-key tag has no usage guidance.
52
questions
2
votes
1
answer
239
views
How does JWE secure the Content Encryption Key
I apologise in advance if this is a dumb question. But this seems like one of those straight forward things that are so straight forward that its not even mentioned and I am not getting it.
Perhaps I ...
- 123
0
votes
1
answer
111
views
mTLS set up - Does it require any offline certificates exchange?
My company is exposing a few APIs to one of our partner systems (external).
We're looking at mTLS authentication here than any credentials based Auth schemes.
My understanding is,
My system (server) ...
- 101
0
votes
2
answers
59
views
Infer information of private key from public key / CSR
is it possible to infer information like: algorithm, key length, mode etc. of the private key from the public key or CSR?
- 1
0
votes
1
answer
142
views
Will sky fall if I don't verify `AuthenticatorAttestationResponse`?
Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
- 374
1
vote
1
answer
261
views
How to implement public key encryption for a webapp?
I'm making a web app where users will upload sensitive data (private financial records), so I want to encrypt one column in one table that holds the value.
If I understood correctly, I need to use a ...
- 111
0
votes
0
answers
102
views
Is a Certificate Signing Request a concatenation of public key and metadata?
From this question, it is said that when creating a CSR, we attach the public key and fill in other data.
When creating a CSR, you attach your public key to it and fill in other needed data; you then ...
- 101
4
votes
1
answer
225
views
GPG allows importing an invalid secp256k1 public key
I came across a PGP public key that seems invalid. The key is a secp256k1 public key that supported by GPG. In fact, GPG allows importing that key even if it has an invalid secp256k1 public key inside....
- 143
0
votes
1
answer
196
views
WebAuthn does not guarantee public-key integrity other than trough attestation?
I've been reading about WebAuthn and try to write some code to exercise.
One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
- 374
0
votes
1
answer
85
views
Is create a key to access resources than send it to client instead of login/password system , a good idea?
I would like to make a key/string/token encrypted string to send it to the user via email.
This encrypted KEY would have encrypted data (resource id) and would be stored in the database along with ...
- 1
8
votes
6
answers
6k
views
Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?
Lets say Bob wishes to communicate with Alice.
Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to ...
- 549
2
votes
1
answer
2k
views
PGP key pair - How to set up for multiple users to decrypt messages with Kleopatra
This is my first project of this nature, and I am hoping this is a basic use case for PGP encryption. Please forgive my ignorance!
There is a server being configured by a service provider (SP). The SP ...
- 131
3
votes
2
answers
862
views
TPM - ECC based encryption / decryption using the public key
Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly ...
- 271
0
votes
1
answer
1k
views
Size overhead of encryption approximation
Is there some rough analysis or estimation of how much overhead in bytes an encryption using a public key could add to the final object?
- 193
0
votes
1
answer
113
views
Is VPN "safer" for public key encrypted connections
I don't know much about encryption and how internet work in general, so my question might be ill-defined... but I guess I will still try to ask a question here.
When you connect to a website directly ...
- 101
0
votes
0
answers
115
views
View public key(s) exchange during https handshake from the command line
It is possible to view the entire HTTPS session from start to end? Any command line I can run?
I am interested in understanding more about the exchange of the public key(s) in order to establish a ...
- 101
0
votes
2
answers
154
views
What could be the correct and secure ways to store and manage public keys?
I am developing an open source project(PKDSA) that uses ED25519 and ED448. My purpose of this project was to help others to enable user-secretless based passwordless authentication.
There're a lot of ...
- 3
0
votes
1
answer
1k
views
Public key authentication as zero-knowledge proof?
I've been reading up a bit on zero-knowledge proofs and how they are applied to authentication, specifically the PAKE protocol and the SRP and OPAQUE implementations. From my (limited) understanding ...
2
votes
1
answer
216
views
When signing with server public key, how do I prove server key is trustworthy?
I have a server-side app in a Docker container that communicates with my desktop client app.
I am struggling with how to ensure that the response from the server is trustworthy. I am fairly new to ...
- 33
0
votes
1
answer
149
views
Authenticate people online with simple public / private key scheme or similar
how can I ensure that person X on website A is the same person who contacts me?
Here is my use case.
On website A I post message asking username X to contact me. Someone send me an email - how do I ...
- 1
1
vote
0
answers
593
views
Given a Java ECPublicKey ECDSA PublicKey, how can I build an SSH2 public key? [closed]
I have created a ECDSA key and now need to convert this to SSH2 key.
final KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ECDSA");
ECGenParameterSpec params = new ...
- 11
0
votes
3
answers
187
views
Can secret recipients be included in PGP cryptography
Can we be sure that a cleartext message that becomes encrypted by pgp or openpgp which is intended for one-or-more specific recipients doesn't also get secretly decipherable by a third party? Since i ...
- 1
0
votes
1
answer
132
views
Ubuntu vs. Debian SSH public key login
In the Debian 9 server I have, these are the least restrictive permissions I can set for SSH login with public key to work:
/home/user 775
/home/user/.ssh ...
- 101
1
vote
0
answers
55
views
In asymmetric encryption, is there a meaningful difference between the public and the private key? [duplicate]
Is it possible to swap them, so that the public key is kept secret while the private key is public? Or do they actually function differently?
Thinking specifically about DSA though I'm interested if ...
- 1,269
0
votes
0
answers
158
views
Create "bare" pgp private key / Make private key without being able to generate the public key from it
How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
- 142
0
votes
2
answers
921
views
Does my receiver have a public key for email encryption?
I'm using an email service with encryption option and I need to send an encrypted email. So if I need my letter to be sent encrypted, I need to take my receiver's public encryption key and apply it to ...
- 11
1
vote
2
answers
389
views
Best and safest way to store secret key used for PKA on server?
I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example:
Create a 0500 access directory on my server
...
- 141
1
vote
1
answer
147
views
Standard for public-key authentication (separate from channel encryption)
Because of all the problems associated with "roll-your-own cryptography", I am looking for an existing standard for standalone authentication using asymmetric keys.
Scenario/threat model
...
- 829
2
votes
2
answers
6k
views
Difference between trust anchors and certificate authorities
Trust anchors and (root) certificates authorities are often used interchangeably and it's easy to think that they are the same thing. The answer in Can an intermediate CA be trusted like a self-signed ...
- 173
0
votes
0
answers
155
views
decryption of message using private key [duplicate]
I don't why we can decrypt the message using our private key if it's encrypted using our public key.
If a message is encrypted using my public key, then how can I decrypt it using my private key? It ...
- 1
1
vote
0
answers
28
views
Why is it not a good idea to simply encrypt the plaintext with the receiver’s public key? [duplicate]
What are some of the risks when encrypting "plaintext" with a receiver's public key?
I have been Googling for hours, and been reading in the Computer Security Principles and Practice 3rd ...
- 93
2
votes
2
answers
555
views
How can I verify the hash of the plain text without being able to decrypt the cipher text?
I am building an E2EE chat app where there is one asymmetric key pair per group. Each user also has one asymmetric key pair. All messages in a group chat are encrypted with the group public key and ...
- 121
1
vote
2
answers
1k
views
What are possible implications of ignoring the ssh host key warning?
With password authentication you're basically giving your password to the attacker. At least that is my understanding. What about public key authentication? I hear that a private key never leaves your ...
- 277
3
votes
2
answers
305
views
How can I prove the content of a PGP-encrypted message to a third party?
Imagine this scenario
A StackExchange user sends you a PGP-encrypted message
You decrypt the message and discover that you are being blackmailed
You report the message to the admins but they are ...
- 33
0
votes
1
answer
228
views
Getting Smaller Output From Public Key Cryptography In PHP
I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
- 763
0
votes
1
answer
134
views
Ways to encrypt data that will be available to specific clients [closed]
I want to store information on the blockchain, but some part of it is private and must be available to selected clients (for example, users who belong to a common company)
How can this be done?
The ...
1
vote
1
answer
352
views
How vulnerable is security if a public key is swapped by active attacker if a key check is done?
Trying to understand this from a high level conceptually. It is obvious from all information on Asymmetric encryption that a public key can be of course, public and there isn't a danger of ...
- 261
1
vote
1
answer
297
views
Why does Lightsail require the server's private key to connect via SFTP?
I am still learning about SSH, SFTP and private/public keys. My elementary understanding of keys is that the private key should remain on the machine it was generated on and never be shared.
I have a ...
- 11
0
votes
2
answers
538
views
Using Private Key for encryption
I want to implement simple software protection mechanism. This is how it would look like:
My question is - is there any problem for me using the private key for encryption and public for decryption (...
- 119
0
votes
0
answers
35
views
How does the inclusion of a subprime q value affect the Diffie Hellman equation for key exchange? [duplicate]
This is a follow on from this question:
"Diffie-Hellman Key Exchange" in plain English
In the answer to that question, the standard Diffie Hellman key exchange equation is derived:
(g^a mod ...
- 1
20
votes
3
answers
8k
views
Not understanding why I should use public/private key encryption over password?
My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue.
Now ...
0
votes
1
answer
253
views
Enlighten Me Please Regarding PGP Encryption [duplicate]
I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
- 103
6
votes
3
answers
2k
views
Using Public Key Cryptography for improving 2FA?
When using 2-factor-authentication using plain TOTP, the secret is stored on both the client and the server. This in turn means, that anyone with access to the database (and a key for it) knows the ...
- 727
1
vote
1
answer
8k
views
converting just a public key from PEM to DER using openssl
There are plenty of instructions for converting PEM certificates to DER which also pop up when looking for ways to convert public keys.
These are among the options offered:
openssl x509 -in cert.pem -...
- 41
1
vote
2
answers
284
views
Deriving digital signature key pair deterministically from an arbitrary secret
Is there a scheme that let people derive public/private key pair from arbitrary secrets?
As you may know, digital signature schemes have versatile use cases. The problem is, the key pair handling is ...
- 177
1
vote
1
answer
237
views
How securely should one treat their primary public key?
First of all, is my understanding correct that primary keys and subkeys are all key pairs consisting of a private and a public key?
I get the rationale behind using primary keys and subkeys1, and why ...
- 129
0
votes
1
answer
183
views
VPS host shows plain text "root" account password upon reinstall of unmanaged VM
I recently started using a VPS hosting service, that offers unmanaged VPS. It allows me to reinstall the VM at any point in time, choosing from a number of OS ISO files (doesn't have to be the same OS ...
- 133
1
vote
3
answers
797
views
ssh and anonymity?
According to the man page, ssh by default sends multiple public keys from files in the ~/.ssh folder, one by one, until authentication success. Does that mean that the server side could know multiple (...
- 121
0
votes
1
answer
195
views
Host Keys in Public/Private Key Auth
I've chased my tail into a late night circle thinking about public key authentication to cloud instances. As such, I have some questions on the function of host keys when authenticating an SSH session....
- 185
0
votes
1
answer
1k
views
Best ways to store private keys on a client?
I am currently writing a program that sends an encrypted file to the client, and I don't want the user to be able to access the file directly (though the client program will operate on it).
Since the ...
- 1
0
votes
1
answer
1k
views
Verify signature without digest
I'm trying to verify that a smartcard (possibly doctored by an attacker) has access to the (ECDSA P-384) private key for which I was given a (signed) public key, in order to verify that the card is ...
- 175