A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

learn more… | top users | synonyms (1)

0
votes
0answers
18 views

Communicating a public key vs it's SHA1 fingerprint

Let's say there is a P2P communication system that establishes secure channels between nodes by letting their users manually exchange their public keys. Would it make any difference from the security ...
0
votes
1answer
32 views

Certificates issued directly from root

EDIT: I have edited my question to not only consider SHA-1 deprecation, but more general the direct signing of subscriber certificates from root. In case a legacy system still uses a setup whereby a ...
0
votes
1answer
65 views

How does the symmetric key get exchanged in SSL/TLS handshake?

I've been reading a lot about SSL/TLS handshake between a client and a server and many articles on it are very contradictory. Some say that the symmetric key that will be used to communicate between ...
1
vote
1answer
25 views

public key Infrastructure hierarchy

I was studying about Public Key Infrastructure. Here I have a table of issuer and subject, Which looks something like this: Now I am stuck at a place. I need to draw full PKI hierarchies as trees ...
0
votes
1answer
58 views

Do I have the private keys to CAs installed on my browser?

Could someone please help explain the following comment from Why was the private key of the Superfish certificate so easily extractable? The main issue with private key extraction is the use of ...
2
votes
3answers
78 views

What specific information is used to verify an SSL certificate?

When a CA's SSL certificate is stored in a browser, a server which presents a certificate signed by this CA can be verified by the browser. My question is: How exactly is this verification done? I ...
0
votes
1answer
29 views

Would logging into Chase bank website be an example of Asymmetric cryptography? [closed]

Also anyone who is familiar with Outlook, is sending digital signed messages a process of Asymmetric cryptography? Since it uses a public key and requires your Smartcard PIN before you can actually ...
0
votes
0answers
22 views

How to use TPM to generate CSR for SSL?

I am following this guide: https://blog.habets.se/2012/02/TPM-backed-SSL The tutorial asks me to use libengine-tpm-openssl library to create a TPM key but it seems that the library is now obsolete. ...
16
votes
3answers
3k views

How to check if an SSH private key has passphrase or not?

Let's say I have access to the private portion of an RSA key-pair. How can I check if this key has associated passphrase or not?
0
votes
0answers
19 views

What public key systems allow for delegation?

I am looking for a public key system that allows for a 3rd party to use that key for other purposes. What private key systems allow for this? PGP, S/MIME, PKI?
4
votes
1answer
111 views

ProtonMail: Would it not be much better if each user had their own private key?

ProtonMail keeps the encrypted private keys of all their users in their servers. The mailbox password for each user decrypts this private key, which is known only to that user. Would it not actually ...
0
votes
0answers
24 views

Why one should prefer EST protocol instead of SCEP?

For many years SCEP was a simple and widely used protocol for obtaining X.509 certificates. However, not too so long ago another protocol called EST (RFC 7030) was developed. What are the main ...
0
votes
1answer
27 views

err_ssl_pinned_key_not_in_cert_chain

I have a question: how I can prevent this error from server side? We have a new cert, and it's valid, but users getting this error. Earlier, I've added HTTP response header Public Key Pins with 1 ...
2
votes
1answer
60 views

ECC for future IoT devices?

Elliptic Curve Cryptography(ECC) is one of the powerful cryptographic methods that requires less computational effort. IoT requires a cryptosystem that secures smart services and applications (5As i....
0
votes
1answer
28 views

Questions regarding DNSSEC

Until now I understood the following about DNSSEC: A client requests a certain Domain let's say google.se The root server sends the client his public KSK and public ZSK signed by his private KSK so ...
16
votes
3answers
2k views

Why is it more secure to use intermediate CA certificates?

I've read that using Intermediate CA certificates is more secure because this way the Root CA is offline. So, if the Intermediate is compromised it does not impact the Root CA. What I understand is ...
3
votes
1answer
77 views

Besides Browsers, what other Technologies are Impacted by the Deprecation of SHA-1?

I am aware that from January 2017, browsers will start rejecting, or at least warning, users browsing sites offering SHA-1-signed certificates. Would a service be impacted if the system does not ...
0
votes
0answers
16 views

Where partially homomorphic encryption schemes like BGN are used?

Schemes like Boneh, Goh, and Nissim are interesting, because of support of polynomially many additions and one multiplication. The algorithms are indeed simple https://eprint.iacr.org/2010/182.pdf ...
0
votes
1answer
45 views

Firefox refuses to use X509 certificate, complaining “Cound not verify this certificate for unknown reasons”

I stumbled upon this question and answer. I have the same problem as the OP, and am sorry to report that the proposed answer does not resolve it. Certificate in question has been verified by OpenSSL-1....
1
vote
1answer
24 views

does openssh support authentication using public key fingerprints?

Cisco have two ways of enabling public key authentication: using the public key and using the public key hash. ip ssh pubkey-chain username <user> key-string <public key> OR ...
1
vote
0answers
48 views

Certificate based Access Control for Pub Sub messaging

I'm extending an existing p2p/master Pub Sub framework to support additional security measures, via over the wire encryption and topic based access control. I'd like to use the x.509 certificates that ...
2
votes
2answers
55 views

CA Certificate Lifecycle

I'm planning to implement a new PKI with 2 tiers of CAs. I'll have end entity certificates with a lifetime of up to 5 years. This means my Issuing CA should be valid for 10 years, in order to be able ...
1
vote
1answer
85 views

What's the minimal way of sharing your public PGP key in email signature?

What's the minimal (not the entire public key) and secure enough way of sharing your PGP key in an email signature?
0
votes
1answer
46 views

How to configure SSH public key per user?

I have an OpenSSH server running and different users can log into it with different privileges. I know you can enable public key authentication and place all the allowed public keys in the ...
6
votes
1answer
83 views

Is there a way to know if a server is using ssh public key or password?

I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?
8
votes
1answer
349 views

How can WhatsApp recover messages sent to a damaged phone?

My mom has an Android phone that fell in the water for a couple of seconds, around 16:30. She managed to disassemble the phone and turn it off. We both share a group that is end-to-end encrypted (all ...
7
votes
1answer
145 views

Manually walking through the signature validation of a certificate

Since I am not too familiar with the Web of Trust and Public Key-Infrastructure I decided to learn about it by following the signing chain of a X.509 certificate issued to CN=*wikipedia.org (Serial ...
9
votes
2answers
534 views

Why SSL uses a third party (certificate authority) yet SSH does not [duplicate]

SSL operations require the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client. SSH on the other hand relies on the client having the ...
3
votes
1answer
56 views

Verifying SSH fingerprint of a public server

I have read somewhere that servers which have SSH access for users in the public can have their public key posted publicly (e.g., on a website), so that people who access such a server using SSH can ...
0
votes
1answer
46 views

PKCS #11 with the TPM

I try to understand PKCS #11 Standard. I found this link. There is this picture. So this picture is in the case of the Trusted Platform Module(TPM). We have the SRK which encrypts with the Private ...
0
votes
0answers
70 views

TOTP: Storing symmetrical secrets

I'm in the process of researching 2fa methods for a cloud connected physical access control system. There is very little margin for error in this space. Is it just me or does TOTP for two factor auth ...
0
votes
0answers
42 views

Migrate a key with a TPM

I try to understand how TPM devices handle the migration of a key. So I found this link: shazkhan.files.wordpress.com (page 4-5) I think I have understood how the rewrap scheme functions, and now I ...
0
votes
0answers
22 views

Client blocking based on PKI

I've got following scenario: Own PKI in a private network Some webservers in the private network, accessed by load balancing via proxy from the web Now I'd like to block all clients their ...
1
vote
1answer
44 views

Private key and wildcard certificates

I'm trying to understand the implications of private key leakage (due to Heartbleed) from a website that uses a wildcard certificate. If an organization has a wildcard certificate (valid for *.domain....
3
votes
3answers
95 views

Why does PKI use a hash function?

I'll preface my question with my understanding of PKI in case I have any misconception. Owner of domain D generates a public-private key pair (d,e), and constructs a certificate c consisting of (d, ...
0
votes
1answer
168 views

Is this company's claim to have solved MITM attacks true?

The Daily Mail reported in Dec 2014 about a company that claimed to have solved the MITM attack. Can someone explain how this is possible or what the difference is from TLS?
1
vote
1answer
304 views

How to make sure that the public key has not been tampered with during transit?

I understand how public key infrastructure works. There is a private and public key, and someone may use the public key to encrypt data that can only be decrypted with the private key. However ...
0
votes
0answers
33 views

Use MDC to provide origin authentication for public key encryption?

Why can't we use an manipultation detection code (MDC) to provide origin authentication when using public-key encryption?
2
votes
1answer
74 views

AuthorizedKeysCommand of sshd_config getting called twice

AuthorizedKeysCommand paramter present in the file /etc/ssh/sshd_config. The bash script which i called using this command is getting called twice. The config file is as follows #RSAAuthentication ...
0
votes
1answer
58 views

X509 / SSL certificates in practise

After learning the theory behind cryptography I'm having quite some problems understanding how SSL or X509 certificates works in practise and I simply cannot find useful information in the internet. ...
0
votes
1answer
33 views

Does password protected git public key protect my repository?

When generating my public key for GIT access, I decided to set up a password for it. My push procedure looks like this now: Enter passphrase for key '/c/Users/USERNAME/.ssh/id_rsa': Counting objects: ...
1
vote
1answer
34 views

Multi-User-Server Public-Key-Based Authentication

So, lets say we have Alice, John, Peter and Bob. Alice, John and Bob all know Peter's public key and trust Peter. Alice wants to connect to Bob's server, so she presents her public key, which was ...
1
vote
2answers
37 views

Why there is time period of key pairs in public key cryptography?

In Public Key Infrastructure, every key pair is associated with its life time. I don't understand why we have a life time when we have functionality such as certificate revocation list(crl) which ...
1
vote
1answer
54 views

Whatsapp encryption: are the public keys requested from the server every new message or only at session setup?

I was reading trough Whatsapp white paper (and all related questions here) and couldn´f find an answer to this question: are the public keys for the recipient requested by the sender from Whatsapp ...
2
votes
1answer
123 views

What is the difference between a digital signature and whole message encryption?

I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message. Lets consider simple example of email message. I understand how ...
1
vote
1answer
35 views

Is there a secure method of distributing keys to network-booted diskless nodes?

I have a bit of an 'initial trust' issue. We are using CoreOS to run Kubernetes, and secure both the etcd API and the Kubernetes API servers using client certificates. We are using iPXE to boot ...
-1
votes
1answer
59 views

Same certificate but different private keys on different servers. Does this work?

We have a SAN cert that is used on multiple servers. Is it possible to have the cert re-keyed and only use the new private key on a particular server while keeping all of our other servers using the ...
2
votes
1answer
49 views

What does it mean to sign a public key and what's wrong with signing someone else's key?

I just stumbled upon this comic and I'm not sure if I understand what's going on. I googled and I figured that somehow people can sign other people's public keys and then they that person is genuine. ...
0
votes
1answer
43 views

How secure is it to bundle unencrypted private key and a CSR into PKCS12 certificate?

I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, ...
0
votes
1answer
47 views

Are there any risks in wrapping asymmetric encryption in symmetric?

The web app I am developing should be end-to-end-encrypted, but for slightly better user experience, I do not want the user to enter private keys into the client. Instead I am planning to store the ...