Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
0 votes
1 answer
46 views

Is Digital Signature really necessary for an open system considered by FDA's 21 CFR Part 11?

21 CFR Part 11's Subpart B for Electronic Records has a section on 'Controls for Open Systems" stating that: Persons who use open systems to create, modify, maintain, or transmit electronic ...
BambiBundle's user avatar
0 votes
2 answers
89 views

How to Capture Mobile API Requests in burp when Server side pinning is implemented

I recently encountered a scenario where Mobile Application is generating CSR request, call a POST API request and in response, Ask Server for certificate. Server will respond with the temporary ...
Tejas Pandya's user avatar
0 votes
0 answers
69 views

Is hashing a digital signature for quick (but incomplete) validation a known and/or acceptable practice?

Let's say that there's a known digital signature issued by a trusted CA. Normally, digital signatures need to be evaluated: checked if they are expired, revoked, if there's a problem in the chain of ...
TAbdiukov's user avatar
  • 186
0 votes
1 answer
113 views

How are X.509 certificate revoked?

I would like to know how are X.509 certificates revoked. That is: Say I have an X509 certificate, and I want it to be revoked for whatever reason (e.g., compromise). How do I reach out to the CA? What ...
Ginswich's user avatar
  • 103
0 votes
2 answers
74 views

Web Browser and server using ECDHE_RSA cypher suite, then what is the use of X.509 certificate public key for?

User Crover has given a very great explanation for this question: RSA or ECDHE for x.509 certificates-what does each do? I have one question to Crover and/or any other member. What I understand from ...
Imran S's user avatar
0 votes
0 answers
78 views

Revoking a digital signature at the cryptographic level

How do I indicate that a specific document or transaction associated with a particular signature should no longer be considered valid? I'm talking of recalling a signed document, not revoking the ...
microwth's user avatar
  • 2,473
2 votes
1 answer
94 views

cryptography - BitBox02 firmware signed & public key attached to firmware image for verification

Bootloader of the BitBox02 crypto wallet verifies the main application with the public keys that are attached to the firmware update itself. Next to that, there are signatures of the public keys, ...
unalignedmemoryaccess's user avatar
9 votes
2 answers
2k views

Can a powerful adversary trick ACME to generate a certificate?

As per the recent jabber.ru MITM attack: The attacker has issued several new TLS certificates using Let’s Encrypt service which were used to hijack encrypted STARTTLS connections on port 5222 using ...
anon2328's user avatar
  • 121
1 vote
0 answers
217 views

SSL Certificates signed by our CA show as invalid in browser

We're experiencing an issue, where SSL server-certificates issued by our own internal PKI will show as invalid in the browser, when accessing the site. The error is NET::ERR_CERT_INVALID (Tested in ...
AssistantTOtheCA's user avatar
0 votes
0 answers
121 views

How to prevent public key tampering

I have to store a document (e.g. a JSON file) on a remote PC (that my App is running on) alongside a signature to be able to verify that this file was signed by me. I have no access to this PC nor ...
Croksie's user avatar
0 votes
0 answers
75 views

How do I create a certificate with subject containing Octet string?

I need to create a certificate with: subject.attribute1: 2.5.4.3 {Common Name} UTF8String subject.attribute2: 2.5.4.92 {tagAFI} OCTET STRING subject.attribute3: 0.9.2342.1920.0300.100.1.1 {userId} ...
J K JoCriSem's user avatar
0 votes
2 answers
192 views

Is there a tool for auditing my root certificates?

Is there any tool out there that will monitor my system's use of root CAs? So far I have not found anything, and so I am hoping that this community will know if such a tool exists. For background, I ...
Cogitative's user avatar
-1 votes
2 answers
215 views

What happens to the key pair once the CSR has been enrolled?

I have a key pair which I used to generate a CSR. Once I enrolled that CSR PKCS10, I get from the PKI (or CA) a certificate signed with the PKI private key. From here, I would like to know if my ...
MoBe's user avatar
  • 21
0 votes
0 answers
103 views

Can I Use an OpenPGP Smart Card to Sign a TLS Certificate?

I've been looking around for smart cards with support for Ed25519. More specifically, I'd like to have a TLS CA with the private key on a YubiKey. The latest YubiKey 5 supports secp256k1, secp384r1, ...
Naftuli Kay's user avatar
  • 6,763
0 votes
0 answers
69 views

Remote eIDAS Qualified Signatures: Control of Signature Activation Data

In eIDAS Remote Qualified Signatures, but also in other Remote-Signature Solutions, the cryptographic keys are held by the Remote Signature Provider. The user uses some method, e.g., a smartphone app, ...
ARGYROU MINAS's user avatar
1 vote
2 answers
396 views

Is a digital signature really needed?

I'm trying to understand the goal of a digital signature in PKI/TLS. I understand that digital signature provide us Data integrity, Authentication and Non-repudiation. But, why is it necessary to use ...
ragnar's user avatar
  • 11
3 votes
0 answers
107 views

Does a signature service provider level digital certificate for electronic signature comply with eIDAS requirement for Advanced Electronic Signatures?

I have some basic questions regarding eIDAS and 'Advanced Electronic Signatures'. Say, if I create a product under my company Acme Inc that offers a simple electronic signature where I sign every ...
BambiBundle's user avatar
0 votes
0 answers
82 views

Is a Certificate Signing Request a concatenation of public key and metadata?

From this question, it is said that when creating a CSR, we attach the public key and fill in other data. When creating a CSR, you attach your public key to it and fill in other needed data; you then ...
JLC's user avatar
  • 101
1 vote
1 answer
116 views

Write message that can be verified by any member of a group

I am trying to develop a scheme for publishing a message to a group of recipients. Any recipient needs to be able to verify who the message was sent by. There may be tens of messages generated each ...
gilbertbw's user avatar
  • 111
0 votes
1 answer
133 views

Unable to verify certificate chain

I'm trying to set-up a certificate chain (CA root -> Intermediate CA -> Server certificate) Here's my attempt: Creating CA Root: ##!/usr/bin/env bash set -xeuo pipefail CA_DIR=server/generated/...
GlinesMome's user avatar
0 votes
1 answer
132 views

Can we move a PKI-as-a-service to own managed PKI server? [closed]

I'm a noob in PKI stuff. But if we were to subscribe to a PKI cloud service, could we move our root CA and other PKI stuff to our own PKI infrastructure once I'm ready to manage it ourselves?
ratib90486's user avatar
0 votes
0 answers
70 views

Can you sign a TLS root certificate that already exists? [duplicate]

Alice and Bob have TLS certificate authorities. My device trusts Alice's CA, and connects to servers that present a certificate rooted at Alice's CA. It does not explicitly trust Bob's CA, or the ...
Danya02's user avatar
  • 373
2 votes
1 answer
175 views

Any client still supporting the S/MIME Capabilities Extension in 2023?

RFC 4262, "X.509 Certificate Extension for Secure/Multipurpose Internet Mail Extensions (S/MIME) Capabilities", defines the S/MIME Capabilities Extension which allows to communicate through ...
Jaime Hablutzel's user avatar
0 votes
1 answer
443 views

How do TLS clients validate intermediate CA certificates?

I have read many posts related to the intermediate CA certificates and I do hope my question is not a duplication. Where do TLS clients fetch intermediate CA certificates from? In SSL server handshake,...
Michael's user avatar
  • 1,469
0 votes
1 answer
110 views

Are certificates persistent outside of where it's created?

For example, consider https://www.cloudflare.com/ssl/ where I can get a free SSL cert. If I create a cloudflare account and get an cert but delete my cloudflare account, is the cert auto-revoked? What ...
bli00's user avatar
  • 115
0 votes
2 answers
134 views

What happens behind the scene when I install an SSL certificate for a website?

I understand I need to upload my digital certificate that I obtained from CA and also my private key. But what happens in the server after I uploaded? Does the server actually read my certificate and ...
warnerque's user avatar
8 votes
6 answers
6k views

Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?

Lets say Bob wishes to communicate with Alice. Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to ...
David Davidson's user avatar
1 vote
0 answers
129 views

how to create truststore and keystore

I created a root CA and intermediate CA, and then created a server CA certificate signed by the intermediate CA. The purpose of whole that is for a TLS one way encryption between a java thin client ...
ethicalhacker's user avatar
0 votes
0 answers
127 views

Brute force copy of PKI root certificates

If an attacker wants to create a phishing website with a fake TLS certificate, to my noob mind, there is a way to do this: Create the fake website certificate Create the hash for this certificate ...
Martijn's user avatar
  • 51
0 votes
2 answers
277 views

Why is known_hosts automatically updated but authorized_keys is not?

Referring to this post. We learned about ssh today, and I know that you have to add your public key to the "authorized_keys" manually on the server, but the very first time you log into the ...
user129393192's user avatar
2 votes
1 answer
108 views

Can you use AD CS to generate certificates for service users with the computer name in the certificate details?

I am working on seeing if Active Directory Certificate Services can be used to manage the trust infrastructure for a data center environment. I have a series of different services that are run on web ...
AJ Henderson's user avatar
  • 42.1k
0 votes
1 answer
136 views

2FA implementation security

I am looking to implement 2FA. I know of duo and eg. Eset secure authentication. But both solutions seem to be implemented in a strange way, that is they require some form of communication with either ...
atapaka's user avatar
  • 465
1 vote
2 answers
159 views

How does a CA-backed signature works?

I would like to understand how certificate-based signature works, I understand the standard asymmetric key signature where one party signs using their private key, and anyone else can validate this is ...
felartu's user avatar
  • 43
-1 votes
2 answers
460 views

Strategy for storing private keys used in an embedded device

I am developing an embedded device using a bootloader. This means that the device will store in its flash an encryption key for decrypting update packages and an ECC public key for verifying update ...
user2563661's user avatar
0 votes
0 answers
74 views

Risk of sharing p12 files for iOS development

When we have only the individual Apple developer account and want to develop with a team, I believe we should share the p12 file with other developers. Then what will happen? The private key differs ...
bakatsuyuki's user avatar
1 vote
0 answers
193 views

Microsoft Software Key Storage Provider for ECDH (Key Usage: keyAgreement) and for RSA encryption (Key Usage: keyEncipherment)

In the Windows Certificate Store, during a request creation, there are options given for the private key to be ECDH (Key Usage: keyAgreement) and for RSA for encryption only (Key Usage: ...
ARGYROU MINAS's user avatar
1 vote
0 answers
18 views

ECDSA_nistP384 vs ECDSA_secP384 vs ECDSA_P384 Microsoft Software Key Storage Provider (KSP) [duplicate]

The windows certificate store, during the creation of a request, gives the following options for the private key: ECDSA_nistP384,Microsoft Software Key Storage Provider (KSP) ECDSA_secP384,Microsoft ...
ARGYROU MINAS's user avatar
1 vote
1 answer
189 views

ECDSA_bainpoolP512 vs ECDSA Microsoft Software Key Storage Provider (KSP) / ECDSA_nistP384 vs ECDSA_secP384 vs ECDSA_P384

During the creation of a certificate request through the Windows Certificate Store, at the options for the private key, there are the following options for choosing a KSP: ECDSA_brainpoolP512,...
ARGYROU MINAS's user avatar
4 votes
1 answer
803 views

Do current browsers still validate CRLs in enterprise PKI environments

I know that modern web browsers don't check CRLs for certificates from CAs in the default trust store anymore. I also know that there are some exceptions for certificate validation when it comes to ...
Ludwig Behm's user avatar
0 votes
0 answers
219 views

SSL/x509 certificate/public key expiration [duplicate]

I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
Jeff's user avatar
  • 1
0 votes
1 answer
337 views

Over what fields is the X509 hash computed over? [duplicate]

Is this how X509 certificates are verified to be valid? The receiver receives the certificate Look at the issuer of the cert, and find the public key of that CA (its hardcoded in the application or ...
user289431's user avatar
0 votes
0 answers
99 views

View public key(s) exchange during https handshake from the command line

It is possible to view the entire HTTPS session from start to end? Any command line I can run? I am interested in understanding more about the exchange of the public key(s) in order to establish a ...
Fabio's user avatar
  • 101
2 votes
1 answer
413 views

Asymmetric encryption in case of multiple parties

For the consumer of the API to send and receive, encrypt and decrypt into that same API, wouldn't the client consumer also have to have the same public and private key as the server that provides the ...
Berlin Brown's user avatar
1 vote
1 answer
138 views

Does defining "a minimum path length" for certification validation have any security benefit?

As you may know, Common Criteria (AKA ISO/IEC15408: A standard for IT Security Evaluation) have provided some security base-line documents named "Protection Profile" for software developers ...
Ebrahim Ghasemi's user avatar
1 vote
1 answer
382 views

What problem does "max_path_length" attribute in certificates are going to solve?

I'm trying to understand the purpose of defining pathLenConstraint and max_path_length in RFC5280 (Internet X509 PKI Certificate and CRL Profile): For pathLenConstraint The above mentioned RFC states: ...
Ebrahim Ghasemi's user avatar
2 votes
1 answer
299 views

Can an Intermediate CA extend its "Certificate Key Usage" by issuing a new certificate for itself?

I'm trying to understand the purpose of defining self-issued certificate concept in RFC5280 (Internet X509 PKI Certificate and CRL Profile): Regarding this concept the RFC states: This specification ...
Ebrahim Ghasemi's user avatar
0 votes
1 answer
315 views

What mechanisms exist to detect compromised default certificate private signing keys?

This is partially a follow-up to the these questions: Is visiting HTTPS websites on a public hotspot secure? Can free Wi-Fi hotspot providers snoop on HTTPS communications? I understand of course ...
Tronman's user avatar
  • 101
0 votes
1 answer
579 views

Why installing a root certificate on the client opens a door for MitM attack?

Most internet communication is now end-end encrypted using TLS. In the TLS process, the TLS server sends a PKI certificate to the user which then gets authenticated using the CA's root certificate ...
lll's user avatar
  • 3
2 votes
1 answer
303 views

A web browser localy encrypted by default

Some years ago, I've found a web browser which I can't remember the name. It had pretty impressive security standards. For example: Symmetric encryption key (password) is mandatory for saving ...
cryptostudy's user avatar
0 votes
0 answers
250 views

client side certificate installed on ios 16 are not being sent by browsers on that device when a server requests for a identity cert

I have a client side certificate from cloudflare (non-root) that i install on our devices in order to gain access to our sites that ask for a client side certificate from browsers. This works ...
Muhammad Ebrahym's user avatar

1
2 3 4 5
28