Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

Retrieve list of trusted server public keys during an application run

I'm trying to implement a mechanism that allows me to maintain a list of SSL server certificate public keys that have been verified as trusted during an application run time. For example: Application ...
user avatar
  • 111
0 votes
0 answers
29 views

How to viably use HSM on public cloud providers (AWS or GCP)

I don't have any experience with HSMs. My goal is to secure critical seed phrases used to generate crypto wallets I found a good approach is to use HSMs to store encryption keys and encrypt the seed ...
user avatar
0 votes
1 answer
20 views

Should Subordinate CAs on separate domains point to one location for CDP and AIA?

I'm a bit confused with how CRLs and AIAs work. I am on a domain B and I have been tasked with building a Subordinate CA that has an offline Root CA located in Domain A perimeter. These domains are ...
user avatar
  • 101
1 vote
1 answer
37 views

Best practice for "stateOrProvinceName" in certificate

In RFC-4519 stateOrProvinceName is abbreviated to ST. Should we assume that it is best practice to put ST=<name-of-state> in the certificate if the state or province is indicated? After all X-...
user avatar
3 votes
1 answer
111 views

What is the right way to transfer public-private keypairs over intranet?

First asked on StackOverflow and referred to this board, here: I have an embedded system (Netburner 5441x) that encodes public-private RSA keypairs into devices. I have ported OpenSSL into the system ...
user avatar
0 votes
1 answer
80 views

How do centralized crypto exchanges store seed phrases and users' private keys?

Say I'm trying to develop a CEX, hence I will hold custody of users' keys. How would I go about doing that and ensuring safety and security? From what I know, I can generate the users' keys from a ...
user avatar
0 votes
0 answers
30 views

Setting up PKI with separate machines acting as the root CA, intermediates and leaves

I am doing a project where I want to create a PKI with different VMs acting as different entities (i.e. root CA, intermediate CAs, leaves, OCSP) in the PKI hierarchy. They will be able to process ...
user avatar
0 votes
1 answer
33 views

Recommendations on PKI roles as per ETSI EN 319 401 - V2.3.1

I want to configure roles (least privilege) on my CA instance (EJBCA) and I'm trying to find what are the best practices to do this. I've tried to read the ETSI EN 319 401 - V2.3.1 standard and try to ...
user avatar
  • 83
16 votes
5 answers
5k views

Where does the root of trust actually lie?

We are told that the roots of trust in the PKI are the handful of Certificate Authorities that issue root certificates and sign other certificates and ensure at least some extent of trust to be ...
user avatar
0 votes
2 answers
87 views

Secure data (+ private key) storage in an insecure public cloud environment

We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure. The data should be so secure ...
user avatar
  • 212
0 votes
0 answers
20 views

What is a link certificate in public key infra?

What is a link certificate? in my use case we have a private ca and one our vendor has their own private ca and we should be able to link vendor with our private ca, is it possible? what are the ...
user avatar
1 vote
2 answers
58 views

How to prove the authenticity of the telemetry message?

I'm curious what is the most widespread way nowadays to sign the telemetry message from a software program to prove its authenticity to the receiver? Imagine the software (which can run on-premise, at ...
user avatar
1 vote
1 answer
37 views

Best and safest way to store secret key used for PKA on server?

I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example: Create a 0500 access directory on my server ...
user avatar
  • 115
2 votes
2 answers
71 views

How to add extension to existing TLS certficate?

We have our own root certificate authority which is used to sign the certificates for the agents connected to our server. We have generated the root certificate authority using keytool command as ...
user avatar
1 vote
2 answers
60 views

How can I prevent non-SAN TLS certificates from bypassing name constraints?

I'm trying to create a private CA and want it to only be able to issue certificates for my domain via name constraints. However, even if I create the CA with restrictions on DNS names as well as ...
user avatar
  • 113
20 votes
9 answers
9k views

Could videos be authenticated using private and public keys?

I saw a news report about now freely available software to make "deepfake" videos. Couldn't videos be internally marked using a private key, so that everyone could verify the originator ...
user avatar
1 vote
1 answer
85 views

Why do the X.509 certificates need the public key?

I am currently reading about X.509 certificates from RFC 5280 and there is a thing in section 3.1 that I cannot understand. It says: Users of a public key require confidence that the associated ...
user avatar
  • 11
0 votes
2 answers
48 views

Can any field in a CSR be overwritten in the issued cert?

Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
user avatar
3 votes
0 answers
70 views

What is expected of domain owners in the Certificate Transparency system?

As I understand it, Certificate Transparancy provides proof to the client that the presented certificate is publicly accessible in CT logs. The certificate being in the logs enables a domain owner to ...
user avatar
  • 43
1 vote
1 answer
139 views

How does the certificate transparency check in Chrome work?

I've been reading up on Certificate Transparency (CT), but can't find anywhere how a client (like a browser) is supposed to check if the certificate is present in any of the certificate transparency ...
user avatar
  • 43
0 votes
1 answer
40 views

Exposing ADCS OCSP on the Public Internet

I am building a Certificate Authority using Windows Server ADCS as a 'Standalone' CA but my application would be greatly improved if I can utilise OCSP. Is the ADCS Online Responder Role Service ...
user avatar
  • 1
0 votes
1 answer
164 views

Difference between trust anchors and certificate authorities

Trust anchors and (root) certificates authorities are often used interchangeably and it's easy to think that they are the same thing. The answer in Can an intermediate CA be trusted like a self-signed ...
user avatar
4 votes
1 answer
520 views

Difference between -CAfile and -trusted in OpenSSL verify

openssl verify can be executed with both flag -CAfile <FILE> and -trusted <FILE>. The explanations from OpenSSL 1.1.1 manual: -CAfile <FILE> A file of trusted certificates. The file ...
user avatar
0 votes
0 answers
25 views

The difference between a virtual door-lock and a public key [duplicate]

The thing that helped me to understand what is a "public key" was to parallel it with a door lock: The door lock is public in the sense that anyone can try to unlock it and the door key is ...
user avatar
0 votes
0 answers
73 views

Any harm in having a SHA-384 and 3072-Key for an intermediate Certificate?

I am building up a PKI and have 2 different chains of trust used for TLS Certificates. 1st Chain: SHA1-Root / 2048 RSA Key ( provided by CA ) --> SHA256-Intermediate / 2048 Key ( mine ) ----> ...
user avatar
  • 145
3 votes
1 answer
516 views

What signature and certificate signing is all about

I know that X.509 certificate signing process includes creating a CSR (certificate signing request) and then the following happens: Some data's from the certificate to be signed hash is computed ...
user avatar
  • 143
0 votes
0 answers
135 views

SafeNet eToken 5110CC w/ IDPrime 940MD: Generating ECC384/521 Errors + ICC/CVC Authentication

I am trying to utilize the SafeNet eToken 5110CC, which basically has the IDPrime 940MD with the applet 4.4.2.A., to generate ECC keys with lengths 384bits and 521bits to no avail. The product brief ...
user avatar
  • 111
2 votes
1 answer
496 views

should I treated the let's encrypt fullchain.pem as a public key

I am using let's encrypt to generate a certificate. It contains 'fullchain.pem' and 'privkey.pem'. should I treated the let's encrypt fullchain.pem as a public key? I find the public key certificate ...
user avatar
  • 123
0 votes
2 answers
85 views

How does a TLS client know the CA certificate?

Assuming the server doesn't send the root CA certificate along with it's certificate and all the intermediates, how does the client know the root CA certificate in order to validate the server's ...
user avatar
  • 105
0 votes
0 answers
48 views

How do Cloud-based services provide Qualified Electronic Signatures?

From what I know about QES, they come on smart cards and USB tokens and are password protected. When a site asks you for a client certificate, you need to have it plugged in and enter the password ...
user avatar
  • 101
0 votes
0 answers
54 views

How dangerous is a leaked private key from outside the infrastructure in context of: "Azure Active Directory keyCredential property Disclosure?"

Microsoft published the Guidance for Azure Active Directory (AD) keyCredential property Information Disclosure in Application and Service Principal APIs which describes how to check if an Azure AD is ...
user avatar
0 votes
1 answer
79 views

"Mutuality" of public key authentication

I'm a newbie when it comes to cryptographic security, but there's something I'm not quite getting concerning the "mutual" aspect of public key authentication. Say you have a client X, and ...
user avatar
  • 115
0 votes
1 answer
97 views

Is there any point in separating private key gen for a self signed certificate?

Disclaimer + Background Since self signed certs are not that popular, here's some context: I have a 3rd party client/server application that we're currently using (inside the LAN!) via unencrypted TCP/...
user avatar
  • 1,247
1 vote
2 answers
271 views

Possible attacks using public key in a certificate

this is purely an exploratory question. If this is not the right place to ask for it, please point me to the right one. TLS version: TLS 1.2 CIPHER SUITE : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (any ...
user avatar
1 vote
2 answers
144 views

Why is there a key exchange for symetric in TLS needed?

As i understand it, PKI with an asymetric key approach is much more secure than a symetric key encryption. The keys are much bigger but it takes more CPU power to en- and decrypt. So why do we ...
user avatar
2 votes
2 answers
133 views

Digital Signatures validity when changing Certificate Authority

An enterprise has its internal PKI-1 (Root CA) that issues certificates to sign document using CAdES-C (CAdES-LT); with Complete Validation Data References and revocation references. Now this ...
user avatar
0 votes
3 answers
120 views

Is the Initial Public Key Transfer Process in Public Key Encryption Vulnerable to MITM on Public Networks?

(shown in step 1): Is the initial process in public key encryption where the public key is transferred across the network done in plaintext? It seems like it must be, which essentially means that no ...
user avatar
  • 101
0 votes
1 answer
88 views

can an SSH session be initiated with a public key

I am able to SSH into an Embedded Linux device remotely using a private key with the following command as example (where id_rsa is the private key file): ssh -i id_rsa root@192.168.30.199 This will ...
user avatar
2 votes
0 answers
253 views

How/when does Windows link private key to imported certificate?

When creating CSR on Windows (using built-in certificate store), I found some weird behaviors: When I use enrollment policy, but then extract CSR and sign it somewhere else, on import the certificate ...
user avatar
1 vote
3 answers
169 views

Stolen server key on TLS intercepting proxy

TLS intercepting proxies create fake server public and private keys on the fly and sign them with a root CA. Depending on the software the keys might be cached or regenerated on each new connection. ...
user avatar
1 vote
1 answer
132 views

Is a OCSP request verified via TLS?

I was wondering if the connection towards the ocsp responder/server is TLS encrytped itself. Meaning that the client requesting a validity check for a certificate verifies the OCSPs server certificate?...
user avatar
  • 65
0 votes
1 answer
140 views

How to prevent server know what data is being transferred through it between two clients

Imagine a web application in which two computers can communicate with each other by transferring files, through the server linked with some unique password. Every file sent between the clients are ...
user avatar
1 vote
2 answers
135 views

Do certificate issuers perform checks against homograph attack?

I just got a very phishy looking email from Vodafone. It had encoding errors and nothing more than my name in it. It asked me to confirm my email address and in order to do that I had to enter some ...
user avatar
  • 499
1 vote
0 answers
85 views

What's the best practice for server certificate issuance protocols in mixed environments?

In mixed Windows/Linux environments what's the best practice for issuing server certificates? If you use Windows MSCA PKI, you're kind of stuck with using previous certificates to authenticate the ...
user avatar
1 vote
1 answer
191 views

Custom PKI for TLS in iOS vs. Android

The scenario An app on iOS has to perform an HTTPS connection, validating the server's TLS certificate against a root CA of a custom PKI. The target Android seems to have best-practice procedures to ...
user avatar
5 votes
1 answer
354 views

Impact of having more X509v3 Key Usage fields than required?

I was wondering if having an "oversubscription" of "Key usage fields" inside a X509v3 certificate can negatively impact the performance and/or the security of a server. For example ...
user avatar
  • 65
0 votes
2 answers
150 views

How to reliably identify a certificate as intermediate certificate?

As per the title, is there a way to reliably identify a certificate as an intermediate certificate? I can identify if a certificate is a root certificate. But i can not tell the difference between an ...
user avatar
  • 145
1 vote
1 answer
108 views

Software signing : multiple certificates

I'm quite new to the cryptography field, and I'm trying to understand a few things: I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below: I'm ...
user avatar
0 votes
1 answer
225 views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
user avatar
0 votes
1 answer
180 views

Should certificate pinning be implemented if the app can use many servers?

In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application. The vendor sells software that it's customers ...
user avatar
  • 43

1
2 3 4 5
26