Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [public-key]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
2 answers
46 views

Infer information of private key from public key / CSR

is it possible to infer information like: algorithm, key length, mode etc. of the private key from the public key or CSR?
Hans's user avatar
  • 1
0 votes
1 answer
124 views

Will sky fall if I don't verify `AuthenticatorAttestationResponse`?

Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
DannyNiu's user avatar
  • 374
0 votes
1 answer
143 views

How to implement public key encryption for a webapp?

I've posted this over at Stack Overflow but I think it's best suited here: I'm making a web app where users will upload sensitive data (private finances records), so I want to encrypt one column in ...
nick's user avatar
  • 101
0 votes
0 answers
92 views

Is a Certificate Signing Request a concatenation of public key and metadata?

From this question, it is said that when creating a CSR, we attach the public key and fill in other data. When creating a CSR, you attach your public key to it and fill in other needed data; you then ...
JLC's user avatar
  • 101
4 votes
1 answer
203 views

GPG allows importing an invalid secp256k1 public key

I came across a PGP public key that seems invalid. The key is a secp256k1 public key that supported by GPG. In fact, GPG allows importing that key even if it has an invalid secp256k1 public key inside....
Andreas Tzionis's user avatar
0 votes
1 answer
155 views

WebAuthn does not guarantee public-key integrity other than trough attestation?

I've been reading about WebAuthn and try to write some code to exercise. One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
DannyNiu's user avatar
  • 374
0 votes
1 answer
81 views

Is create a key to access resources than send it to client instead of login/password system , a good idea?

I would like to make a key/string/token encrypted string to send it to the user via email. This encrypted KEY would have encrypted data (resource id) and would be stored in the database along with ...
V S Vuca's user avatar
8 votes
6 answers
6k views

Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?

Lets say Bob wishes to communicate with Alice. Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to ...
David Davidson's user avatar
2 votes
1 answer
1k views

PGP key pair - How to set up for multiple users to decrypt messages with Kleopatra

This is my first project of this nature, and I am hoping this is a basic use case for PGP encryption. Please forgive my ignorance! There is a server being configured by a service provider (SP). The SP ...
Clifford Piehl's user avatar
3 votes
2 answers
684 views

TPM - ECC based encryption / decryption using the public key

Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly ...
TrinityTonic's user avatar
0 votes
1 answer
1k views

Size overhead of encryption approximation

Is there some rough analysis or estimation of how much overhead in bytes an encryption using a public key could add to the final object?
Jim's user avatar
  • 183
0 votes
1 answer
107 views

Is VPN "safer" for public key encrypted connections

I don't know much about encryption and how internet work in general, so my question might be ill-defined... but I guess I will still try to ask a question here. When you connect to a website directly ...
Bohan Xu's user avatar
  • 101
0 votes
0 answers
105 views

View public key(s) exchange during https handshake from the command line

It is possible to view the entire HTTPS session from start to end? Any command line I can run? I am interested in understanding more about the exchange of the public key(s) in order to establish a ...
Fabio's user avatar
  • 101
0 votes
2 answers
140 views

What could be the correct and secure ways to store and manage public keys?

I am developing an open source project(PKDSA) that uses ED25519 and ED448. My purpose of this project was to help others to enable user-secretless based passwordless authentication. There're a lot of ...
Hern's user avatar
  • 3
0 votes
1 answer
962 views

Public key authentication as zero-knowledge proof?

I've been reading up a bit on zero-knowledge proofs and how they are applied to authentication, specifically the PAKE protocol and the SRP and OPAQUE implementations. From my (limited) understanding ...
Joshua Hewitt's user avatar
2 votes
1 answer
203 views

When signing with server public key, how do I prove server key is trustworthy?

I have a server-side app in a Docker container that communicates with my desktop client app. I am struggling with how to ensure that the response from the server is trustworthy. I am fairly new to ...
MatkatMusic's user avatar
0 votes
1 answer
126 views

Authenticate people online with simple public / private key scheme or similar

how can I ensure that person X on website A is the same person who contacts me? Here is my use case. On website A I post message asking username X to contact me. Someone send me an email - how do I ...
Lofter's user avatar
  • 1
1 vote
0 answers
530 views

Given a Java ECPublicKey ECDSA PublicKey, how can I build an SSH2 public key? [closed]

I have created a ECDSA key and now need to convert this to SSH2 key. final KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ECDSA"); ECGenParameterSpec params = new ...
Vicky's user avatar
  • 11
0 votes
3 answers
174 views

Can secret recipients be included in PGP cryptography

Can we be sure that a cleartext message that becomes encrypted by pgp or openpgp which is intended for one-or-more specific recipients doesn't also get secretly decipherable by a third party? Since i ...
Barry's user avatar
  • 1
0 votes
1 answer
120 views

Ubuntu vs. Debian SSH public key login

In the Debian 9 server I have, these are the least restrictive permissions I can set for SSH login with public key to work: /home/user 775 /home/user/.ssh ...
Ehsan88's user avatar
  • 101
1 vote
0 answers
54 views

In asymmetric encryption, is there a meaningful difference between the public and the private key? [duplicate]

Is it possible to swap them, so that the public key is kept secret while the private key is public? Or do they actually function differently? Thinking specifically about DSA though I'm interested if ...
brentonstrine's user avatar
0 votes
0 answers
136 views

Create "bare" pgp private key / Make private key without being able to generate the public key from it

How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
Myzel394's user avatar
  • 142
0 votes
2 answers
767 views

Does my receiver have a public key for email encryption?

I'm using an email service with encryption option and I need to send an encrypted email. So if I need my letter to be sent encrypted, I need to take my receiver's public encryption key and apply it to ...
Summit2's user avatar
  • 11
1 vote
2 answers
287 views

Best and safest way to store secret key used for PKA on server?

I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example: Create a 0500 access directory on my server ...
DevelJoe's user avatar
  • 141
1 vote
1 answer
139 views

Standard for public-key authentication (separate from channel encryption)

Because of all the problems associated with "roll-your-own cryptography", I am looking for an existing standard for standalone authentication using asymmetric keys. Scenario/threat model ...
Ben Voigt's user avatar
  • 819
2 votes
2 answers
5k views

Difference between trust anchors and certificate authorities

Trust anchors and (root) certificates authorities are often used interchangeably and it's easy to think that they are the same thing. The answer in Can an intermediate CA be trusted like a self-signed ...
fast-reflexes's user avatar
0 votes
0 answers
152 views

decryption of message using private key [duplicate]

I don't why we can decrypt the message using our private key if it's encrypted using our public key. If a message is encrypted using my public key, then how can I decrypt it using my private key? It ...
navid's user avatar
  • 1
1 vote
0 answers
28 views

Why is it not a good idea to simply encrypt the plaintext with the receiver’s public key? [duplicate]

What are some of the risks when encrypting "plaintext" with a receiver's public key? I have been Googling for hours, and been reading in the Computer Security Principles and Practice 3rd ...
John Smith's user avatar
2 votes
2 answers
541 views

How can I verify the hash of the plain text without being able to decrypt the cipher text?

I am building an E2EE chat app where there is one asymmetric key pair per group. Each user also has one asymmetric key pair. All messages in a group chat are encrypted with the group public key and ...
david_adler's user avatar
1 vote
2 answers
1k views

What are possible implications of ignoring the ssh host key warning?

With password authentication you're basically giving your password to the attacker. At least that is my understanding. What about public key authentication? I hear that a private key never leaves your ...
x-yuri's user avatar
  • 277
3 votes
2 answers
290 views

How can I prove the content of a PGP-encrypted message to a third party?

Imagine this scenario A StackExchange user sends you a PGP-encrypted message You decrypt the message and discover that you are being blackmailed You report the message to the admins but they are ...
SWList's user avatar
  • 33
0 votes
1 answer
201 views

Getting Smaller Output From Public Key Cryptography In PHP

I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
azoundria's user avatar
  • 753
0 votes
1 answer
130 views

Ways to encrypt data that will be available to specific clients [closed]

I want to store information on the blockchain, but some part of it is private and must be available to selected clients (for example, users who belong to a common company) How can this be done? The ...
Wen Chiang's user avatar
1 vote
1 answer
328 views

How vulnerable is security if a public key is swapped by active attacker if a key check is done?

Trying to understand this from a high level conceptually. It is obvious from all information on Asymmetric encryption that a public key can be of course, public and there isn't a danger of ...
RobbB's user avatar
  • 261
1 vote
1 answer
282 views

Why does Lightsail require the server's private key to connect via SFTP?

I am still learning about SSH, SFTP and private/public keys. My elementary understanding of keys is that the private key should remain on the machine it was generated on and never be shared. I have a ...
kmgardner's user avatar
0 votes
2 answers
446 views

Using Private Key for encryption

I want to implement simple software protection mechanism. This is how it would look like: My question is - is there any problem for me using the private key for encryption and public for decryption (...
Bojan Vukasovic's user avatar
0 votes
0 answers
35 views

How does the inclusion of a subprime q value affect the Diffie Hellman equation for key exchange? [duplicate]

This is a follow on from this question: "Diffie-Hellman Key Exchange" in plain English In the answer to that question, the standard Diffie Hellman key exchange equation is derived: (g^a mod ...
factor2's user avatar
20 votes
3 answers
7k views

Not understanding why I should use public/private key encryption over password?

My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue. Now ...
RenatoRenatoRenato's user avatar
0 votes
1 answer
244 views

Enlighten Me Please Regarding PGP Encryption [duplicate]

I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
Gerowen's user avatar
  • 103
6 votes
3 answers
2k views

Using Public Key Cryptography for improving 2FA?

When using 2-factor-authentication using plain TOTP, the secret is stored on both the client and the server. This in turn means, that anyone with access to the database (and a key for it) knows the ...
Gamer2015's user avatar
  • 727
1 vote
1 answer
8k views

converting just a public key from PEM to DER using openssl

There are plenty of instructions for converting PEM certificates to DER which also pop up when looking for ways to convert public keys. These are among the options offered: openssl x509 -in cert.pem -...
Banyoghurt's user avatar
1 vote
2 answers
269 views

Deriving digital signature key pair deterministically from an arbitrary secret

Is there a scheme that let people derive public/private key pair from arbitrary secrets? As you may know, digital signature schemes have versatile use cases. The problem is, the key pair handling is ...
Curious Sam's user avatar
1 vote
1 answer
223 views

How securely should one treat their primary public key?

First of all, is my understanding correct that primary keys and subkeys are all key pairs consisting of a private and a public key? I get the rationale behind using primary keys and subkeys1, and why ...
toraritte's user avatar
  • 129
0 votes
1 answer
174 views

VPS host shows plain text "root" account password upon reinstall of unmanaged VM

I recently started using a VPS hosting service, that offers unmanaged VPS. It allows me to reinstall the VM at any point in time, choosing from a number of OS ISO files (doesn't have to be the same OS ...
Decent Dabbler's user avatar
1 vote
3 answers
742 views

ssh and anonymity?

According to the man page, ssh by default sends multiple public keys from files in the ~/.ssh folder, one by one, until authentication success. Does that mean that the server side could know multiple (...
QnA's user avatar
  • 121
0 votes
1 answer
172 views

Host Keys in Public/Private Key Auth

I've chased my tail into a late night circle thinking about public key authentication to cloud instances. As such, I have some questions on the function of host keys when authenticating an SSH session....
Chris's user avatar
  • 185
0 votes
1 answer
1k views

Best ways to store private keys on a client?

I am currently writing a program that sends an encrypted file to the client, and I don't want the user to be able to access the file directly (though the client program will operate on it). Since the ...
berry64's user avatar
0 votes
1 answer
1k views

Verify signature without digest

I'm trying to verify that a smartcard (possibly doctored by an attacker) has access to the (ECDSA P-384) private key for which I was given a (signed) public key, in order to verify that the card is ...
Wouter Verhelst's user avatar
9 votes
3 answers
5k views

What happens when I encrypt something with my RSA Public Key?

I know encrypting something with my private key is used for signing. To prove that the message is indeed coming from me. But what about if I sign something with my public key? That would mean that ...
Áron Pop Adorján's user avatar
0 votes
1 answer
326 views

How public key is exported from a JWT

On this https://jwt.io/ application, you can paste a jwt and it returns you a public key. How is this public key generated, and how is it exported? Is it contained inside the JWT, and if it is, then ...
Cap Barracudas's user avatar