Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

1
vote
1answer
23 views

Active Directory Certificate authentication trust

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...
-1
votes
0answers
16 views

Can be use same public and private keys of cure25519 for x25519 and Ed25519? [on hold]

I want to build system used hybrid Cryptosystem. Thus, I use for key exchange x25519, and I would like to use the same public and private key of the x25519, for Ed25519 digital signature. For example ...
1
vote
1answer
59 views

Does the key size have an effect of the size of the public key and signature

If I have a 2048-bit RSA and a 4096-bit RSA key is my signature and public key smaller when I use a 2048-bit key vs a 4096-bit one ? (In bytes)
1
vote
1answer
60 views

Why can I use 2 different private keys to connect to my SSH server storing only 1 public key?

On my server ~/.ssh/authorized_keys contains only 1 public key. However, I can connect to it using 2 different private keys. One private key looks like this: -----BEGIN RSA PRIVATE KEY----- ...
2
votes
1answer
55 views

Standard practice for managing expired and revoked certificates used for signatures?

Curious to know what the standard practice is to maintain old/revoked certificates that were previously used to sign documents that must be verified in the future. For example, suppose there is a ...
1
vote
2answers
61 views

Can Asymmetric encryption be used instead of modern authentication strategy?

Assuming that I have a way to associate a combination of public private key encryption with real people/user. The private key is stored on the device of the user. User have to communicate with some ...
0
votes
0answers
33 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...
0
votes
2answers
39 views

Can certificate signing requests be stored at the server to prolong existing certificates?

I want to build a PKI (public key infrastructure) to host certificates for users. My use case is, that I want to use the certificates for e2e encryption between the users. Users must be able to ...
0
votes
0answers
44 views

One GPG key with multiple user identities for my career?

I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs. My understanding is that there are two ways this could be done: Have one main/master GPG ...
7
votes
1answer
90 views

The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates

I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My ...
4
votes
3answers
583 views

What is the best way to reissue user certificates after configuration change in a template?

I have setup my MS-ADCS environment in my company and configured auto-enrollment. i have everything working great, but found out that I want my "Subject Name Format" to have a different value. We are ...
4
votes
3answers
212 views

What if somebody sends me genuine certificate that they do not own? [closed]

I just started learning about the digital certificates, its architecture and how it works internally. What will happen if someone sends me a genuine certificate for authentication which does not ...
1
vote
1answer
141 views

Certificate serial and thumbprint number spacing

We have a Microsoft PKI setup at our organization. As per just about all certificates I've ever seen, new certificates issued by our issuing CAs will put the serial number and thumbprint in a HEX ...
0
votes
1answer
56 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
3
votes
1answer
73 views

How can I use X.509 cross signing to replace a CA?

I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate. I'...
1
vote
0answers
45 views

Is there a compiled list of TEE (Trusted Execution Environment) manufacturer/CA certificates?

I may be misunderstanding TEEs (I just learned about them from an HN post), but I have question regarding the features that seem to allow what seems to be the perfect form of DRM (to my maybe limited ...
0
votes
1answer
89 views

How to get public key if we know domain name?

I am solving some CTF lab. I send a request and get response in which it contains cookie. Cookie has three element. First is token and something that is ecdsa signed. The second is domain name. The ...
1
vote
0answers
40 views

Identifying and understanding a cryptographic voting protocol

I am reading about a voting protocol using public key encryption. According to the notes, if A votes va, then A broadcasts Ra(Rb(Rc(Ea(Eb(Ec(va)))))). Here, Ra is a random encoding function which ...
1
vote
0answers
19 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
1
vote
0answers
34 views

How to sign a .jar file using XMSS (PQC) Signature Scheme with JarSigner

I am trying to use JarSigner to sign .jar files with XMSS Signatures. With the use of the JCA/JCE Post-Quantum Cryptography Provider from BouncyCastle it is possible to generate XMSS and XMSSMT ...
0
votes
2answers
104 views

Rotating encryption keys - how does it work?

I haven't found a duplicate which explains with sufficient clarity how does the process of rotating encryption keys work in simple layman terms. I know how private/public key cryptography works, I ...
-1
votes
0answers
37 views

How do browsers check for an SSL Certificate Expiration Date

I was wondering if its possible to know how browsers, such Firefox or Chrome, decide about the expiration of SSL Certificates after looking at their Expiry Dates, curious about the fact if they allow ...
-1
votes
0answers
40 views

Can I hide the key pair from the issuing authority?

Let's say I want to issue certificates to create a network of machines authorized to communicate based on my authority as the issuer. But, I want the new key pair to be completely and permanently ...
2
votes
1answer
79 views

How to Manage Public Key with Asymmetric Cryptography

I'm working on an iOS chat project using Firebase RealTime Database. I want to use asymmetric cryptography for the management of messages between two users .. Browsing the net I found an excellent ...
3
votes
2answers
102 views

Delivering data securely when the data source is the key maker

Let's say we have the following: Bob needs to send data securely to Alice. Only Bob and Alice are allowed to read/see that data. Alice is not able/allowed to create keys. Alice can use any number or ...
1
vote
1answer
47 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
1
vote
1answer
45 views

Public Key Crypto - sign Bob's name into Alice's message or encrypt Alice's name

I was reading Defective Sign & Encrypt in S/MIME,  PKCS#7, MOSS, PEM, PGP, and XML and in section 5.1  Naming Repairs By signing Bob's name into her message, Alice explicitly identifies him ...
1
vote
0answers
73 views

Why Diffie-Hellman instead of just share the secret [duplicate]

I read that D-H is used to make a shared secret between parties that then they use to encrypt the messages. This is used in TLS, for example, after the server has authenticated itself with a ...
0
votes
1answer
63 views

Verify the requesting domain

I have a both a http and websocket server written in nodejs (for now) and it will be receiving requests from many different domains. The request is made from the client using JS. I need to verify 100%...
1
vote
0answers
17 views

Root CA and Intermediate CA security [duplicate]

I'm confused how intermediate CA's adds to the security of the PKI. I realize the compromise of root CA key is catastrophic as it would've to be consequently purged from the trust store of every ...
1
vote
1answer
30 views

TLS Cipher Suites and PKI

I am currently trying to figure out what cryptographic algorithms are applicable when using mutual authentication for TLS with PKI-certificates. So when I am intitially creating a certificate, I ...
1
vote
2answers
63 views

Console based PKI auth (Xubuntu Linux)

Normally, I use my PKCS#11 card to logon to a secured site using a browser plugin which initiated a local software dialog to input PKI card PIN. Is it anyhow possible to do the following? Run some ...
1
vote
2answers
82 views

Why digital signatures needs different algorithm

Why digital signatures uses algorithms such as DSA, ECDSA or RSA-PSS, and not just the RSA algorithm to encrypt the message hash with the private key? Is the choice more security or performance ...
0
votes
1answer
31 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
3
votes
1answer
78 views

Concepts of PKI Encryption and Digital Signature Authentication [duplicate]

I am trying to understand how SSL uses PKI and Digital Signature authentication to ensure secure and verified communications. I've read various sources online and from what I can tell the basic ...
1
vote
2answers
62 views

What happens when the timestamper's certificate expires?

What happens when the timestampers certificate expires? If the code is now untrusted, can it be re-stamped without re-signing? If not, what good does this timestamp do me if my cert is valid until the ...
0
votes
1answer
65 views

Best way to manage private keys for users of an application?

We're building an application which will leverage blockchain for financial transaction within itself. We won't be forcing users to manage their own keys. Our clients (we're building a B2B platform) ...
0
votes
0answers
51 views

Network attack vectors on android - an overview

I'm on vacation and - for the first time in a while - have not had the option to circumvent a public (unencrypted) WiFi for internet access. The hotel is remote (no cellular access) but has a large ...
2
votes
1answer
121 views

How does server use session key after tls handshake?

After TLS handshake both server and client agreed about session key to use as symmetric key. So server must store several session keys which each one belongs to a specific client. How server ...
0
votes
1answer
57 views

re-reading decoded openssl pubkey

I was playing with openssl just to see how reading of the public key from a certificate works; Gave a "letsencrypt.pem" certificate I have, I gave these commands. See the entire certificate text: ...
1
vote
2answers
114 views

openssl certificate chain output

I was reading the "Security with HTTPS and SSL" guide for android developers and reading this paragraph. The paragraph discusses the fact that servers do not always return the entire certificate ...
1
vote
1answer
69 views

OCSP, CRLs, crlset - Revocation Delivery and Attacks

OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the ...
2
votes
2answers
421 views

Root CA with Extended Key Usage fields

I recently started using AWS's Certificate Manager to get free TLS certificates for my load balancer. When I was inspecting the certificate chain I noticed that the Root CA, Starfield Class 2 ...
1
vote
0answers
42 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
1
vote
0answers
35 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
0
votes
1answer
88 views

Limit OpenVPN client certificate to specific VPN with shared CA chain

I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of ...
2
votes
2answers
64 views

Security Appliance Key Generation

For devices like decrypting HTTPS proxies, there is often a built-in mechanism for generating a key-pair and CSR. An admin can then have their in-house authority sign the CSR with a subordinate CA ...
0
votes
2answers
41 views

Does the symmetric key exchange through asymmetric encryption have to be done asymmetrically?

To communicate over a public channel, it seems often that 2 parties first use some asymmetric-encryption way to exchange a symmetric key. And then use the symmetric key for subsequent communication. ...
3
votes
2answers
90 views

What is the difference between digital notary and certification authority?

Is the difference purely legal or is there a technical difference between a notary notarizing the document signer's identity and a certification authority certifying a signer's certificate?
1
vote
1answer
123 views

Should we use x509 V1 certificate for a new root CA?

I read a couple of articles that kind of gives the impression that the norm is to use a V1 x509 pkc for a root CA. This is one of them. However the rfc5280 makes no such suggestion. My question is, ...