Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
0
votes
1answer
51 views

How can I authenticate the certifcate of a Private CA while I'm not on that network i.e. offline

I want my application to verify that it is being run on a computer with a certificate issued by my Private CA. How can I do this when the computer is not on the network?
0
votes
0answers
33 views

Just came to know about Digital Certificates. But did't understand the way clients can verify CA [duplicate]

So I just came to know about Digital certificates, and this is what I understand. Public Key, Message + PK_encrypt(Hash(message))/Message Signing, And other identifiers is what a digital signature is....
1
vote
2answers
60 views

ECDHE_RSA_WITH_AES_128_GCM_SHA256 - How to determine ECDHE Key Length?

Server: SSL Certificate, 2048-bit RSA Public Key, Signature Algorithm is sha256RSA What am I missing here? ! I've scoured the RFC's, and I have yet to find anything on how to determine the ECDHE key ...
1
vote
0answers
26 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
0
votes
2answers
57 views

Can I restrict a Certification Authority to signing certain device/application?

Basically another administrator wants a subordinate CA certificate for their fancy appliance. How do I restrict the subordinate CA certificate issued to them only able to issuing for their usages and ...
2
votes
1answer
69 views

SSL MITM Proxy Security - Can we rely on it?

In my organization, we have an SSL MITM (Man-in-the-middle) proxy (like ZScaler proxy). If I browse an HTTPS website and check the certificate, I can see that the proxy has issued a separate ...
3
votes
2answers
102 views

What is the best strategy for handling a compromised private key within the domain of firmware?

I have a firmware project that uses asymmetric cryptography for assuring integrity and authority of updates. The private key is stored within the company, and the public key is on the firmware to ...
0
votes
1answer
47 views

Why does the CSR state/province name need to be the same as the CA certificate?

This is more a conceptual question than it is about a bug/error I'm encountering. I am learning about PKI (public key infrastructure), and attempting to sign my own certifications by walking through ...
0
votes
0answers
43 views

Can I use a public / private keypair to secure traffic on my wifi on OpenWRT?

Wifi passwords are a pretty weak way to secure a Wifi Access point; is it possible to use a public / private key to secure traffic on a wifi access point which runs OpenWRT. I know I can secure SSH ...
0
votes
1answer
72 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
0
votes
1answer
39 views

How do I verify that an ssh public/private keypair go together, is it different for openssl and ssh-key generated keys?

Generating a Private Key... $ openssl genrsa -out ./oci_api_key.pem 2048 Generate a Public Key...from the private key: I'm trying to generate a public key from a private key in PEM format (the ...
0
votes
1answer
67 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
2
votes
4answers
98 views

How to secure VPN credentials on end-user devices?

I have a VPN and PKI in place with MFA. My question is: What's the best method/solution for protecting the integrity and identity of end-user certs? I want to make sure that users only able to use VPN ...
0
votes
0answers
23 views

Accessing a permitted file from local file system securely

I am working on project which has more focus on user data security. Public key cryptography is being used in this and private key is getting stored to user device locally (computer local file system). ...
0
votes
3answers
99 views

How does the browser decide to accept a self-signed certificate?

As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate ...
2
votes
2answers
95 views

Is it a good idea to use asymmetric encryption for a chat application?

I am reading design documents of an internal Whats-app like chat application. Developers are planning to use asymmetric encryption to encrypt all messages. Every user will have a public/private key ...
0
votes
2answers
142 views

How do you use a public key to encrypt a string

I am oversimplifying but I understand that a public key is the product of two large prime numbers. In essence as long as the private key is kept private, the owner knows something that the outside ...
0
votes
0answers
41 views

Offline code signature verification scheme

Assume that I want to sign digitally updates for an offline appliance (lets say a limited linux VM). To begin with, such mechanism is not in place and the very limited OS doesn't have any CA ...
0
votes
1answer
76 views

Cross sign two self signed root CA

I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster. However, one of the ...
2
votes
1answer
40 views

Does the CT system “enforce” CA's to log issued certificates?

If a CA, who is otherwise acting good and participating in the Certificate Transparency system, were to issue a certificate without reporting it to any log, would this be noticed somehow? I'm ...
1
vote
2answers
137 views

Encrypting intellectual property on client side

Is it possible to effectively protect/encrypt intellectual property that is on the client side? Assume that I am selling a product (software) to clients, that contains intellectual data, for example ...
0
votes
0answers
52 views

percentage of X.509 certs using rsaEncryption as publicKey algorithm

Quoting 2017_TLS_Telemetry_Report.pdf: Not surprisingly, 2048-bit keys now protect 90% of the world’s TLS hosts. The use of 4096-bit keys have quadrupled, as a share of hosts, but we expect it to ...
1
vote
1answer
112 views

How do I store other people's ssh keys securely?

This is not really a programming question, but please hear me out. I am building a deployment tool, So using my application others can deploy their own application to their own servers. (just like ...
0
votes
1answer
70 views

PKI - Hybrid - root ca in the Datacenter

PKI - Can we maintain root CA and HSM in the data center and have issuing CA on the cloud to issue certs, integrated with cloud HSM?
1
vote
1answer
83 views

Where do TLS clients fetch intermediate CA certificates from? [duplicate]

When I use my browser (a TLS client) to navigate to a secure web page (e.g. https://example.com), during the TLS handshake, the browser will receive an end-entity certificate from the web server of ...
1
vote
1answer
87 views

What's the goal behind signing a CRL with an old certificate key?

I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA ...
1
vote
1answer
61 views

Is ssh and public key scheme like ed25519 as safe as the hackability of your computer?

I am just learning Linux and I have setup ssh to connect to a server. To do that I need to generate the key for the ed25519 public-key scheme. Once generated, both the public key and the private key ...
1
vote
0answers
178 views

Extracting .p12 cert and key without OpenSSL

I've asked a question on SO, but was directed here since it might align better with this SE. The problem I have is that I need to extract the certificate and key in unencrypted PEM format for use in ...
0
votes
2answers
96 views

Would DNSSEC and certificates for IP addresses be enough?

Using DNSSEC you can be sure that you have the right IP for a domain and using a certificate for the IP signed by someone you trust you know you have the right IP. Shouldn't this be enough to know ...
1
vote
0answers
118 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
4
votes
2answers
100 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
15
votes
2answers
6k views

Possibility of faking someone's public key

I know how public key cryptography works; (very) simplified: Alice takes Bob's public key and sends an encrypted message with said key and sends it to Bob. Bob and only Bob can decrypt the message, ...
1
vote
1answer
80 views

What happens if the private key of a Trusted Timestamp Authority is compromised?

what happens if the private key certificate of a Trusted Timestamp Authority used to sign the timestamps is compromised? If this private key certificate is changed, should all timestamps be re-signed ...
-1
votes
1answer
66 views

How can I mitigate the possibility of SSL private key being copied without my knowledge?

OCSP stapling and Certificate Transparency logs seem to provide a pretty good defense against man-in-the-middle attacks if I discover that my private key has been stolen. I can revoke my old ...
1
vote
2answers
167 views

If I am able to generate the same public key as someone else, do I also get the same private key?

I have a very basic understanding of the asymetric encryption. I have a couple of simple questions. I know I can generate a key pair, of public and private keys. If by co-incidence my public key ...
2
votes
1answer
225 views

Duplicate subject names for intermediate and root certificates

I work in an organization which is employing what I believe to be a non-standard and problematic PKI system for internally used certificates. They issue multiple root certificates and intermediate ...
1
vote
0answers
38 views

Revocation list for a custom solution

If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
-1
votes
1answer
38 views

How to understand the PKI's revocation of keys and certificates function?

A public key infrastructure is a collection of hardware, software, people, policies, and procedures that implement the generation, management, storage, distribution, and revocation of keys and ...
0
votes
1answer
160 views

Should CRLs be published for Standalone Offline Root CA?

I'm setting up a two tier PKI Hierarchy in our Windows Server 2012 R2 domain. A number of tutorials suggest that the root CA should publish its CA certificate and CRL in Active Directory and via HTTP,...
3
votes
1answer
87 views

Using same algorithm for signing and encrypting a message

If we use the same algorithm to encrypt and sign a message, what can happen if the message is intercepted and read by a third party?
0
votes
1answer
104 views

How to automate publication of CRL and CRT files to CDP and AIA location?

I'm setting up Two-Tier PKI for the first time in our Windows Server 2012 R2 environment and I've read several tutorials on setting this up. Some of the methodology is very different, but I've chosen ...
0
votes
1answer
325 views

PKI - CRL and OCSP

I've done quite a bit of reading about PKI in ADCS and CRL/OCSP, but I can't seem to find an answer to a small couple of questions I still have: It is clear to me that even with OCSP in place, you ...
0
votes
1answer
50 views

Asymmetric Encryption + Signature workflow

Let´s say that Alice wants to send an encrypted message that only Bob can read, plus confirm that Alice is the person that wrote that message. What is the procedure that will take place? When I see ...
2
votes
1answer
61 views

How common is it for CAs to issue end entity certificates with Extended Key Usage marked as critical?

Does anyone know whether it is common for CAs to issue end entity certificates, which can be used as client certs (possibly among other purposes), with the Extended Key Usage (EKU) extension marked as ...
3
votes
1answer
243 views

What happens to PKI once quantum computers can break encryption?

They say that public key infrastructure or PKI uses very complex encryption. What if that encryption breaks one day when quantum computers complete? What if they decrypt all private messages and data? ...
2
votes
1answer
82 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
4
votes
1answer
65 views

Under what conditions is the Client trying “the next” CRL Distribution Point?

We've got a scenario where the CRL is distributed to 2 different Locations. One ist accessable from a private network and not from the internet. The other one is asseccable from the internet but not ...
2
votes
2answers
85 views

File integrity assurance

I have the following scenario : Two parties want to exchange files. First party publishes a file on a secure server First party sends to the second, a hash of the file in order to be able to verify ...
0
votes
0answers
24 views

Whether cipher suites is related to public key certificate? [duplicate]

I want to use TLS version 1.2 and Authenticated Encryption with Associated Data (AEAD). Can a public key certificate obtained from a certification authority specify which of the ciphers I can use? ...
1
vote
0answers
99 views

Get S/MIME from Digicert, store in escrow on on-prem CA

I'm trying to crack the following nut: I have a contract with Digicert for S/MIME certificates for my org. Digicert allows to use their API for cert issuance. Unfortunately I can't let users self-...