Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
0
votes
2answers
97 views

How do you use a public key to encrypt a string

I am oversimplifying but I understand that a public key is the product of two large prime numbers. In essence as long as the private key is kept private, the owner knows something that the outside ...
0
votes
0answers
35 views

Offline code signature verification scheme

Assume that I want to sign digitally updates for an offline appliance (lets say a limited linux VM). To begin with, such mechanism is not in place and the very limited OS doesn't have any CA ...
0
votes
0answers
47 views

Cross sign two self signed root CA

I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster. However, one of the ...
2
votes
1answer
32 views

Does the CT system “enforce” CA's to log issued certificates?

If a CA, who is otherwise acting good and participating in the Certificate Transparency system, were to issue a certificate without reporting it to any log, would this be noticed somehow? I'm ...
1
vote
2answers
123 views

Encrypting intellectual property on client side

Is it possible to effectively protect/encrypt intellectual property that is on the client side? Assume that I am selling a product (software) to clients, that contains intellectual data, for example ...
0
votes
0answers
49 views

percentage of X.509 certs using rsaEncryption as publicKey algorithm

Quoting 2017_TLS_Telemetry_Report.pdf: Not surprisingly, 2048-bit keys now protect 90% of the world’s TLS hosts. The use of 4096-bit keys have quadrupled, as a share of hosts, but we expect it to ...
1
vote
1answer
99 views

How do I store other people's ssh keys securely?

This is not really a programming question, but please hear me out. I am building a deployment tool, So using my application others can deploy their own application to their own servers. (just like ...
0
votes
1answer
52 views

PKI - Hybrid - root ca in the Datacenter

PKI - Can we maintain root CA and HSM in the data center and have issuing CA on the cloud to issue certs, integrated with cloud HSM?
1
vote
1answer
67 views

Where do TLS clients fetch intermediate CA certificates from? [duplicate]

When I use my browser (a TLS client) to navigate to a secure web page (e.g. https://example.com), during the TLS handshake, the browser will receive an end-entity certificate from the web server of ...
1
vote
1answer
83 views

What's the goal behind signing a CRL with an old certificate key?

I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA ...
1
vote
1answer
51 views

Is ssh and public key scheme like ed25519 as safe as the hackability of your computer?

I am just learning Linux and I have setup ssh to connect to a server. To do that I need to generate the key for the ed25519 public-key scheme. Once generated, both the public key and the private key ...
1
vote
0answers
68 views

Extracting .p12 cert and key without OpenSSL

I've asked a question on SO, but was directed here since it might align better with this SE. The problem I have is that I need to extract the certificate and key in unencrypted PEM format for use in ...
0
votes
2answers
86 views

Would DNSSEC and certificates for IP addresses be enough?

Using DNSSEC you can be sure that you have the right IP for a domain and using a certificate for the IP signed by someone you trust you know you have the right IP. Shouldn't this be enough to know ...
1
vote
0answers
65 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
4
votes
2answers
81 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
15
votes
2answers
5k views

Possibility of faking someone's public key

I know how public key cryptography works; (very) simplified: Alice takes Bob's public key and sends an encrypted message with said key and sends it to Bob. Bob and only Bob can decrypt the message, ...
1
vote
1answer
77 views

What happens if the private key of a Trusted Timestamp Authority is compromised?

what happens if the private key certificate of a Trusted Timestamp Authority used to sign the timestamps is compromised? If this private key certificate is changed, should all timestamps be re-signed ...
-1
votes
1answer
64 views

How can I mitigate the possibility of SSL private key being copied without my knowledge?

OCSP stapling and Certificate Transparency logs seem to provide a pretty good defense against man-in-the-middle attacks if I discover that my private key has been stolen. I can revoke my old ...
1
vote
2answers
161 views

If I am able to generate the same public key as someone else, do I also get the same private key?

I have a very basic understanding of the asymetric encryption. I have a couple of simple questions. I know I can generate a key pair, of public and private keys. If by co-incidence my public key ...
2
votes
1answer
145 views

Duplicate subject names for intermediate and root certificates

I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates. They issue multiple root certificates and intermediate ...
1
vote
0answers
38 views

Revocation list for a custom solution

If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
-1
votes
1answer
36 views

How to understand the PKI's revocation of keys and certificates function?

A public key infrastructure is a collection of hardware, software, people, policies, and procedures that implement the generation, management, storage, distribution, and revocation of keys and ...
0
votes
1answer
96 views

Should CRLs be published for Standalone Offline Root CA?

I'm setting up a two tier PKI Hierarchy in our Windows Server 2012 R2 domain. A number of tutorials suggest that the root CA should publish its CA certificate and CRL in Active Directory and via HTTP,...
3
votes
1answer
87 views

Using same algorithm for signing and encrypting a message

If we use the same algorithm to encrypt and sign a message, what can happen if the message is intercepted and read by a third party?
0
votes
1answer
49 views

How to automate publication of CRL and CRT files to CDP and AIA location?

I'm setting up Two-Tier PKI for the first time in our Windows Server 2012 R2 environment and I've read several tutorials on setting this up. Some of the methodology is very different, but I've chosen ...
0
votes
1answer
190 views

PKI - CRL and OCSP

I've done quite a bit of reading about PKI in ADCS and CRL/OCSP, but I can't seem to find an answer to a small couple of questions I still have: It is clear to me that even with OCSP in place, you ...
0
votes
1answer
42 views

Asymmetric Encryption + Signature workflow

Let´s say that Alice wants to send an encrypted message that only Bob can read, plus confirm that Alice is the person that wrote that message. What is the procedure that will take place? When I see ...
2
votes
1answer
58 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
3
votes
1answer
204 views

What happens to PKI once quantum computers can break encryption?

They say that public key infrastructure or PKI uses very complex encryption. What if that encryption breaks one day when quantum computers complete? What if they decrypt all private messages and data? ...
2
votes
1answer
76 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
4
votes
1answer
51 views

Under what conditions is the Client trying “the next” CRL Distribution Point?

We've got a scenario where the CRL is distributed to 2 different Locations. One ist accessable from a private network and not from the internet. The other one is asseccable from the internet but not ...
2
votes
2answers
84 views

File integrity assurance

I have the following scenario : Two parties want to exchange files. First party publishes a file on a secure server First party sends to the second, a hash of the file in order to be able to verify ...
0
votes
0answers
24 views

Whether cipher suites is related to public key certificate? [duplicate]

I want to use TLS version 1.2 and Authenticated Encryption with Associated Data (AEAD). Can a public key certificate obtained from a certification authority specify which of the ciphers I can use? ...
1
vote
0answers
97 views

Get S/MIME from Digicert, store in escrow on on-prem CA

I'm trying to crack the following nut: I have a contract with Digicert for S/MIME certificates for my org. Digicert allows to use their API for cert issuance. Unfortunately I can't let users self-...
0
votes
1answer
71 views

RFC 5755 Attribute Certificate Validation

According to this explanation: Manually walking through the signature validation of a certificate I'd like to know how is the validation process of an RFC 5755 attribute certificates, because it ...
0
votes
1answer
44 views

truststore and intermediate certificates

We have a situation where our on premise product talks to a third party external API over SSL. This API has a certificate which is issued by an intermediate. We use the default java cacerts truststore,...
0
votes
1answer
104 views

Signing JWTs with server's SSL/TLS certificate

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my ...
0
votes
2answers
79 views

Signing webhooks with asymmetric keys

I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography). What is the recommended or ...
1
vote
4answers
156 views

Do large companies use multiple public-private key pairs?

If I were to create a website I would then naturally generate a public-private key pair. The public key is published and the private key is kept private on the server. If the website has not a lot of ...
2
votes
2answers
162 views

Maximum number of certificates generated by a CA

What is the maximum number of certificates that can be generated from a CA? The use case is a VPN using certificate authentication and I would like to know what is the theoretical number of unique ...
0
votes
1answer
114 views

More clarity on Certificate, public key, hash

I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below. I've used below command to see what this certificate ...
0
votes
2answers
165 views

How to approach 2 tier PKI RSA Root CA with subordinates that should support ECDSA

I have a situation for which I am not sure how to approach it. Basicialy I need to find out if it is possible how to issue ECDSA Certificates with a RSA Root Certificate. Is this possible? and how ...
0
votes
2answers
77 views

Is the root certificate issued from one Certificate Authority is same for all the requesting organisation?

Let me please explain the question a bit more through an example: There are lots of companies who have their certificates signed by Verisign (or any CA). I understand that Verisign signs these certs ...
0
votes
0answers
23 views

How related SSL/TLS to PKI? [duplicate]

It is not clear, how SSL/TLS related to PKI? It seems, PKI is part of SSL/TLS, but I'm not sure. Any clear explanation?
1
vote
1answer
45 views

Active Directory Certificate authentication trust

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...
1
vote
1answer
75 views

Does the key size have an effect of the size of the public key and signature

If I have a 2048-bit RSA and a 4096-bit RSA key is my signature and public key smaller when I use a 2048-bit key vs a 4096-bit one ? (In bytes)
1
vote
1answer
82 views

Why can I use 2 different private keys to connect to my SSH server storing only 1 public key?

On my server ~/.ssh/authorized_keys contains only 1 public key. However, I can connect to it using 2 different private keys. One private key looks like this: -----BEGIN RSA PRIVATE KEY----- ...
2
votes
1answer
65 views

Standard practice for managing expired and revoked certificates used for signatures?

Curious to know what the standard practice is to maintain old/revoked certificates that were previously used to sign documents that must be verified in the future. For example, suppose there is a ...
1
vote
2answers
73 views

Can Asymmetric encryption be used instead of modern authentication strategy?

Assuming that I have a way to associate a combination of public private key encryption with real people/user. The private key is stored on the device of the user. User have to communicate with some ...
0
votes
0answers
78 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...