Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
1
vote
3answers
90 views

Is CA the only way to securely share public key?

Is CA the only way to securely share public key - are there other mechanisms that are viable in practice? I guess if you had a trusted software deployment system that securely transmitted contents ...
13
votes
8answers
5k views

How can we exchange public keys between two servers in a secure way?

I have two servers with a pair of RSA public and private keys. We do not use a CA for the internal communication yet and therefore we need to exchange keys without CA. I need to establish a trust ...
0
votes
0answers
50 views

how to send prime and generator of diffie hell-men to client over network node js?

I am using crypto module of node js for exchanging key using diffie-hellman algorithm. server.js const crypto = require("crypto"); const alice = crypto.createDiffieHellman(512); const aliceKey = ...
1
vote
0answers
49 views

Best Practices Setting Up an Enterprise PKI

I am interested in learning about setting up an (internal) enterprise PKI the right way. What's mostly clear to me is the technical part. Our PKI will implement an hierarchical trust model based on X....
2
votes
1answer
78 views

X509 certificates - Are there any naming conventions?

As per the title, what are the naming conventions when buying certificates ? When buying a cert for TLS / https from a particular Server, naturally I will default to the Server name, for example, if ...
11
votes
2answers
2k views

Is an identity certificate the same as a public key?

I'm new to public key infrastructure but I think I understand how public key encryption works, conceptually. So a public key is, by definition, public and not a secret. Recently when I came across ...
0
votes
2answers
77 views

What if an attacker gets access to public key through an insecure media in digital signature?

If A encrpyts the message and creates signature using his private key and sends through the network then only B with the public key of A can decrypt that message. But what if the attacker gets access ...
0
votes
1answer
50 views

How do I identify, characterize and detect if trusted CAs compromised?

What is the best approach to use in identifying, characterizing and detecting compromised CAs? I do not mean an invalid certificate or invalid CA that can be identified by an X.509 during validation ...
0
votes
1answer
78 views

Find the certificate from a public key [closed]

I have a public key. Is there a way to find the corresponding certificate which contains this public key?
0
votes
1answer
71 views

How to generate a CSR (certificate signing request) for creating a limited CA (Certificate Authority) using LibreSSL?

Related to this (too broad) question: How to implement my PKI? I have a self-signed CA (ca0) I would like to create a CA (ca1) with limited power derived from that first CA. ca1 should only be able ...
0
votes
2answers
74 views

Can I find a private key for a known encrypted file?

Let's say I create a 100KB file only containing 1234567890, that is, a known value. This file would be sitting on several folders as bait. Once a Rasomware hits the folder and encrypts this file (...
0
votes
0answers
27 views

Are AWS KMS and Google Cloud KMS's HSMs valid as Certified Qualified Signature Creation Devices?

I'm looking into digitally signing documents and planning to use AWS KMS or Google Cloud KMS service to create and manage the private/public keys. Underneath they use Hardware Security Modules (HSMs) ...
2
votes
2answers
72 views

keyUsage Extensions on a Certificate Authority

I have a question about what key usage should I choose when creating a private CA (root or subordinate). I have inspected some root and issuing web certificate authorities and they tend to use ...
0
votes
1answer
32 views

How long does it take for a gpg key revoke certificate to propagate to all public key servers?

I recently created a new gpg key just for the sake of learning the basics of public key encryption. Now, I'd like to revoke that test key so that I can go on using a more "permanent" key that is ...
0
votes
2answers
66 views

Certificates and keys validity [duplicate]

I'm connecting to a server via TLS. My device has installed server cert, device cert, private key and public key. I read here validity SSL/TLS that TLS cert will last max 2 years. This means that ...
-1
votes
2answers
92 views

How can I create a new root CA and sign existing intermediate CAs without their private keys?

Is it possible to create a new root CA (just for myself) and use it to sign a set of existing intermediate CAs which I'd like to trust? If so, which tool can be used to accomplish this? The private ...
1
vote
0answers
46 views

I need to make a PKI infrastructure, but i don't now how to segment my CA

I'm currently working on a project where we have to rethink a PKI architecture, but we don't know how to segment the different CA_SUBs, do you have any recommendations?
0
votes
1answer
63 views

Compare fingerprints of gpg --verify for files download with / without TOR

From my understanding, except we meet the creator of an archive in person and verify the primary key fingerprint, we can never be sure, that the archive we download is really created by the person we ...
0
votes
0answers
32 views

How to efficiently deploy SMIME email certificates for entire domain with Google GSuite?

Google Suite Enterprise supports centralized SMIME email signatures. This allows for easy deployment across all devices. But besides an API, there's apparently no central management. And I couldn't ...
0
votes
0answers
23 views

Can anyone send any certificate [duplicate]

I seem to be missing one fundamental point regarding Certificates and hoping someone can set me straight. It is constantly described that a certificate can be used for authentication and to ensure the ...
0
votes
0answers
43 views

Which CAs is more vulnerable to compromise or misbehave in the trust chain (Root, Intermediate or Issuing CA)?

From the academic and real-world scenarios which CAs are more prone to misbehavior or compromise by attackers (Root, Intermediate or issuing CAs)? What are the consequences after compromise? Are the ...
2
votes
1answer
41 views

Does AWS KMS use HSM underneath by default?

Have a doubt about about how AWS KMS handles their asymmetrical/symmetrical keys. Does AWS KMS use Hardware Security Modules (HSMs) underneath by default? (cant find documentation that prove/dissmiss ...
0
votes
0answers
39 views

Why is /cacerts request necessary in RFC 7030 Enrollment Over Secure Transport?

In RFC 7030 Enrollment Over Secure Transport (EST) https://tools.ietf.org/html/rfc7030, the /cacerts request (Section 4.1 of RFC 7030) is used by the client to request the current CA certificates. The ...
0
votes
1answer
42 views

What is the role of leaf certificate private key In TLS handshake [duplicate]

What is the role of leaf certificate's private key if this certificate is signed by the intermediate certificate's private key and the certificate signature will only be validated using its public ...
1
vote
1answer
74 views

ECDH_SHA2_NISTP256 (KEX) Algorithm in SSH - Vulnerabilities?

My organization within my company uses this KEX Algorithm in our SSH Implementation. Another organization within my company won't connect to our servers as long as this algorithm is implemented as ...
0
votes
0answers
57 views

How to store ECDSA public key securely in Android

I am writing an Android application that needs to verify that a request is sent from a trusted party (me). This is my current solution: Storing keys: Generate ECDSA public key / private key from a ...
0
votes
1answer
141 views

Are SSH certificates more secure for service accounts?

I'm considering how to deploy a service that needs SSH access to many important boxes in my infrastructure. Rather than store a long-lived SSH private key in a key store that the service could request,...
15
votes
2answers
2k views

Technical description of a self-signed certificate

I'm having a friendly debate with a co-worker as to the meaning of "self-signed" when it comes to PKI. We have an internal root and subordinate CA in our organization. We import the cert chain on ...
0
votes
0answers
15 views

Is my understanding how of a secure connection is made using PKI correct? [duplicate]

My understanding as as follows: Client requests a secure connection with a Website's Server Server provides a certificate with the address of the server and public key of the server encrypted with a ...
4
votes
2answers
146 views

Why is the root in an Online CA model not a Single Point of Failure?

My textbook for CompTIA Security+ has the following practice question: In which one of following PKI Trust Models is the root NOT a single point of failure? Single CA Hierarchical CA ...
1
vote
0answers
46 views

Risk of committing IdentityFile name for OpenSSH configuration to public repository

What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
0
votes
2answers
101 views

certificate used in SSL and keys used in SSH

To do SSH to any server we should create private key pair through which we encrypt the connection. Now in SSH we are just doing encryption and here we don't need to verify the server, that's why we ...
0
votes
2answers
187 views

Accidentally Shared my Private Key - How to Remedy?

I accidentally shared my SSH private and public keys with others. I changed keys within 2 minutes of sharing the private key. I've since added a password to access my private key as well as deleted ...
0
votes
1answer
111 views

CA certificate and Local certificate

There is something which is bothering me when i think about the CA cert and Local cert. Below are my queries which pertains to juniper but may be generic as well. 1) "request security pki ca-...
0
votes
0answers
60 views

Is this a valid equation for determining certificate lifetimes in a PKI infrastructure?

I have an intuitive sense of how certificate lifetimes should work in a PKI infrastructure, but I don't consider myself an expert in this field so I would like someone to validate or critique my ...
0
votes
1answer
53 views

What are the changes in PKI when i move from TLS protocol to IPSec Protocol?

Currently i am using TLS protocol for a secure communication between my server and client. I use PKI for key/certificate Management. If i want to switch to IPsec for secure communication, how will the ...
1
vote
0answers
52 views

GPG - exported secret key with public too

I tried to export public key from my keyring. Then I imported my public key in another keyring. I find the private key too in the 2nd keyring and I can sign files from the 2nd keyring. Why is this ...
6
votes
3answers
191 views

Threema: Are received messages exposed, when sender's private key gets compromised?

Note: This question is specific to the Threema Messenger, and relates to their implementation of encryption (using the NaCl ECDH implementation as per their docs). I refer specifically to their "note ...
0
votes
1answer
29 views

Server certificate authenticity validation process [duplicate]

I was reading this article about how the Server Authentication is being done During SSL Handshake https://docs.oracle.com/cd/E19693-01/819-0997/aakhc/index.html I do understand everything but I have ...
2
votes
0answers
93 views

Why does GPG --recipient only pick one (arbitrary) key for identical names, instead of all of them?

I have a recipient with four hardware keys (HKs) that they use interchangeably. These HKs contain different GPG keys that have all been generated inside and have never left the HKs, thus resulting in ...
0
votes
1answer
80 views

When will CMP be part of OpenSSL? [closed]

CMP means Certificate Management Protocol. CMP for OpenSSL is currently a fork of OpenSSL. Do you know when it will be part of OpenSSL? https://github.com/mpeylo/cmpossl
2
votes
2answers
133 views

Can I use the same truststore and keystore on the client and the server?

TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides? More info if helpful: I'm trying to test ...
0
votes
1answer
113 views

Why generate dedicated issuer CA for TSU certificates?

I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME ...
2
votes
1answer
165 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
2
votes
1answer
122 views

Can I concatenate multiple x509 certificates?

I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. ...
1
vote
1answer
174 views

What is “-srvcert” in OpenSSL cmp command line?

I use the following command to get a signed certificate from PKI. What is the content of the file srvcert.crt of the option -srvcert ? It seems the srvcert.crt file is not the public certificate of ...
0
votes
2answers
156 views

private key of SSL certificate

To create a certificate, first we need to fill a CSR and in CSR we have to place our public key and that key pair can be generated by different ways in different devices. To do ssh, we run command (...
1
vote
1answer
79 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
2
votes
2answers
209 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
2
votes
1answer
107 views

How does an offline Root CA sign OCSP Response?

As Root CA are kept offline for security purposes, how does it sign OCSP Response sent by Client for Intermediate Certificate Status Check?

1
2 3 4 5
24