Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

1
vote
0answers
39 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
3
votes
2answers
57 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
15
votes
2answers
5k views

Possibility of faking someone's public key

I know how public key cryptography works; (very) simplified: Alice takes Bob's public key and sends an encrypted message with said key and sends it to Bob. Bob and only Bob can decrypt the message, ...
0
votes
0answers
29 views

How Asymmetric algorithm's cipher text can be rerandomized without knowldge of secret key?

As public key algorithm Elgamal's cipher text can be re-encrypted using its homomorphic property and can be used in many application i,e Mixnets. I want some other public key algorithm can behave ...
1
vote
1answer
71 views

What happens if the private key of a Trusted Timestamp Authority is compromised?

what happens if the private key certificate of a Trusted Timestamp Authority used to sign the timestamps is compromised? If this private key certificate is changed, should all timestamps be re-signed ...
-1
votes
1answer
61 views

How can I mitigate the possibility of SSL private key being copied without my knowledge?

OCSP stapling and Certificate Transparency logs seem to provide a pretty good defense against man-in-the-middle attacks if I discover that my private key has been stolen. I can revoke my old ...
1
vote
2answers
155 views

If I am able to generate the same public key as someone else, do I also get the same private key?

I have a very basic understanding of the asymetric encryption. I have a couple of simple questions. I know I can generate a key pair, of public and private keys. If by co-incidence my public key ...
2
votes
1answer
99 views

Duplicate subject names for intermediate and root certificates

I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates. They issue multiple root certificates and intermediate ...
1
vote
0answers
32 views

Revocation list for a custom solution

If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
-1
votes
1answer
34 views

How to understand the PKI's revocation of keys and certificates function?

A public key infrastructure is a collection of hardware, software, people, policies, and procedures that implement the generation, management, storage, distribution, and revocation of keys and ...
0
votes
1answer
60 views

Should CRLs be published for Standalone Offline Root CA?

I'm setting up a two tier PKI Hierarchy in our Windows Server 2012 R2 domain. A number of tutorials suggest that the root CA should publish its CA certificate and CRL in Active Directory and via HTTP,...
3
votes
1answer
83 views

Using same algorithm for signing and encrypting a message

If we use the same algorithm to encrypt and sign a message, what can happen if the message is intercepted and read by a third party?
0
votes
1answer
37 views

How to automate publication of CRL and CRT files to CDP and AIA location?

I'm setting up Two-Tier PKI for the first time in our Windows Server 2012 R2 environment and I've read several tutorials on setting this up. Some of the methodology is very different, but I've chosen ...
0
votes
1answer
106 views

PKI - CRL and OCSP

I've done quite a bit of reading about PKI in ADCS and CRL/OCSP, but I can't seem to find an answer to a small couple of questions I still have: It is clear to me that even with OCSP in place, you ...
0
votes
1answer
40 views

Asymmetric Encryption + Signature workflow

Let´s say that Alice wants to send an encrypted message that only Bob can read, plus confirm that Alice is the person that wrote that message. What is the procedure that will take place? When I see ...
2
votes
1answer
54 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
3
votes
1answer
172 views

What happens to PKI once quantum computers can break encryption?

They say that public key infrastructure or PKI uses very complex encryption. What if that encryption breaks one day when quantum computers complete? What if they decrypt all private messages and data? ...
2
votes
1answer
69 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
4
votes
1answer
44 views

Under what conditions is the Client trying “the next” CRL Distribution Point?

We've got a scenario where the CRL is distributed to 2 different Locations. One ist accessable from a private network and not from the internet. The other one is asseccable from the internet but not ...
2
votes
2answers
83 views

File integrity assurance

I have the following scenario : Two parties want to exchange files. First party publishes a file on a secure server First party sends to the second, a hash of the file in order to be able to verify ...
0
votes
0answers
24 views

Whether cipher suites is related to public key certificate? [duplicate]

I want to use TLS version 1.2 and Authenticated Encryption with Associated Data (AEAD). Can a public key certificate obtained from a certification authority specify which of the ciphers I can use? ...
1
vote
0answers
91 views

Get S/MIME from Digicert, store in escrow on on-prem CA

I'm trying to crack the following nut: I have a contract with Digicert for S/MIME certificates for my org. Digicert allows to use their API for cert issuance. Unfortunately I can't let users self-...
0
votes
1answer
54 views

RFC 5755 Attribute Certificate Validation

According to this explanation: Manually walking through the signature validation of a certificate I'd like to know how is the validation process of an RFC 5755 attribute certificates, because it ...
0
votes
1answer
37 views

truststore and intermediate certificates

We have a situation where our on premise product talks to a third party external API over SSL. This API has a certificate which is issued by an intermediate. We use the default java cacerts truststore,...
0
votes
1answer
70 views

Signing JWTs with server's SSL/TLS certificate

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my ...
0
votes
2answers
71 views

Signing webhooks with asymmetric keys

I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography). What is the recommended or ...
1
vote
4answers
152 views

Do large companies use multiple public-private key pairs?

If I were to create a website I would then naturally generate a public-private key pair. The public key is published and the private key is kept private on the server. If the website has not a lot of ...
2
votes
2answers
151 views

Maximum number of certificates generated by a CA

What is the maximum number of certificates that can be generated from a CA? The use case is a VPN using certificate authentication and I would like to know what is the theoretical number of unique ...
0
votes
1answer
53 views

More clarity on Certificate, public key, hash

I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below. I've used below command to see what this certificate ...
0
votes
2answers
110 views

How to approach 2 tier PKI RSA Root CA with subordinates that should support ECDSA

I have a situation for which I am not sure how to approach it. Basicialy I need to find out if it is possible how to issue ECDSA Certificates with a RSA Root Certificate. Is this possible? and how ...
0
votes
2answers
67 views

Is the root certificate issued from one Certificate Authority is same for all the requesting organisation?

Let me please explain the question a bit more through an example: There are lots of companies who have their certificates signed by Verisign (or any CA). I understand that Verisign signs these certs ...
0
votes
0answers
23 views

How related SSL/TLS to PKI? [duplicate]

It is not clear, how SSL/TLS related to PKI? It seems, PKI is part of SSL/TLS, but I'm not sure. Any clear explanation?
1
vote
1answer
42 views

Active Directory Certificate authentication trust

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...
1
vote
1answer
72 views

Does the key size have an effect of the size of the public key and signature

If I have a 2048-bit RSA and a 4096-bit RSA key is my signature and public key smaller when I use a 2048-bit key vs a 4096-bit one ? (In bytes)
1
vote
1answer
77 views

Why can I use 2 different private keys to connect to my SSH server storing only 1 public key?

On my server ~/.ssh/authorized_keys contains only 1 public key. However, I can connect to it using 2 different private keys. One private key looks like this: -----BEGIN RSA PRIVATE KEY----- ...
2
votes
1answer
65 views

Standard practice for managing expired and revoked certificates used for signatures?

Curious to know what the standard practice is to maintain old/revoked certificates that were previously used to sign documents that must be verified in the future. For example, suppose there is a ...
1
vote
2answers
70 views

Can Asymmetric encryption be used instead of modern authentication strategy?

Assuming that I have a way to associate a combination of public private key encryption with real people/user. The private key is stored on the device of the user. User have to communicate with some ...
0
votes
0answers
62 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...
0
votes
2answers
46 views

Can certificate signing requests be stored at the server to prolong existing certificates?

I want to build a PKI (public key infrastructure) to host certificates for users. My use case is, that I want to use the certificates for e2e encryption between the users. Users must be able to ...
1
vote
1answer
131 views

One GPG key with multiple user identities for my career?

I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs. My understanding is that there are two ways this could be done: Have one main/master GPG ...
8
votes
1answer
2k views

The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates

I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My ...
4
votes
3answers
590 views

What is the best way to reissue user certificates after configuration change in a template?

I have setup my MS-ADCS environment in my company and configured auto-enrollment. i have everything working great, but found out that I want my "Subject Name Format" to have a different value. We are ...
4
votes
3answers
216 views

What if somebody sends me genuine certificate that they do not own? [closed]

I just started learning about the digital certificates, its architecture and how it works internally. What will happen if someone sends me a genuine certificate for authentication which does not ...
1
vote
1answer
168 views

Certificate serial and thumbprint number spacing

We have a Microsoft PKI setup at our organization. As per just about all certificates I've ever seen, new certificates issued by our issuing CAs will put the serial number and thumbprint in a HEX ...
0
votes
1answer
87 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
3
votes
1answer
173 views

How can I use X.509 cross signing to replace a CA?

I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate. I'...
1
vote
0answers
52 views

Is there a compiled list of TEE (Trusted Execution Environment) manufacturer/CA certificates?

I may be misunderstanding TEEs (I just learned about them from an HN post), but I have question regarding the features that seem to allow what seems to be the perfect form of DRM (to my maybe limited ...
0
votes
1answer
103 views

How to get public key if we know domain name?

I am solving some CTF lab. I send a request and get response in which it contains cookie. Cookie has three element. First is token and something that is ecdsa signed. The second is domain name. The ...
1
vote
0answers
48 views

Identifying and understanding a cryptographic voting protocol

I am reading about a voting protocol using public key encryption. According to the notes, if A votes va, then A broadcasts Ra(Rb(Rc(Ea(Eb(Ec(va)))))). Here, Ra is a random encoding function which ...
1
vote
0answers
34 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...