Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a ...

0
votes
0answers
16 views

How to load EC private key to keystore

I want to load EC private key (private.pem) to keystore. $ cat private.pem -----BEGIN EC PRIVATE KEY----- -------some text ----------- -----END EC PRIVATE KEY----- After reading lot of SE answers, ...
-1
votes
0answers
13 views

Store public key in Firebase Database or Mediator Service

hello everyone I'm working with a library called Themis https://github.com/cossacklabs/themis that I use for end-to-end encryption in my ios application. In the safety notes, the library recommends ...
0
votes
0answers
37 views

Can I hide the key pair from the issuing authority?

Let's say I want to issue certificates to create a network of machines authorized to communicate based on my authority as the issuer. But, I want the new key pair to be completely and permanently ...
2
votes
1answer
61 views

How to Manage Public Key with Asymmetric Cryptography

I'm working on an iOS chat project using Firebase RealTime Database. I want to use asymmetric cryptography for the management of messages between two users .. Browsing the net I found an excellent ...
3
votes
2answers
101 views

Delivering data securely when the data source is the key maker

Let's say we have the following: Bob needs to send data securely to Alice. Only Bob and Alice are allowed to read/see that data. Alice is not able/allowed to create keys. Alice can use any number or ...
0
votes
0answers
20 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
1
vote
1answer
35 views

Public Key Crypto - sign Bob's name into Alice's message or encrypt Alice's name

I was reading Defective Sign & Encrypt in S/MIME,  PKCS#7, MOSS, PEM, PGP, and XML and in section 5.1  Naming Repairs By signing Bob's name into her message, Alice explicitly identifies him ...
1
vote
0answers
69 views

Why Diffie-Hellman instead of just share the secret [duplicate]

I read that D-H is used to make a shared secret between parties that then they use to encrypt the messages. This is used in TLS, for example, after the server has authenticated itself with a ...
0
votes
0answers
19 views

TPM 2.0 Reissue EK Cert

Unlike the TPM 1.2 module, the TPM 2.0 specification allows the platform user to create own EK (Endorsement Key) using EPS (Endorsement Primary Seed) and EKTemplate and obtain a certificate signed by ...
0
votes
1answer
61 views

Verify the requesting domain

I have a both a http and websocket server written in nodejs (for now) and it will be receiving requests from many different domains. The request is made from the client using JS. I need to verify 100%...
1
vote
0answers
12 views

Root CA and Intermediate CA security [duplicate]

I'm confused how intermediate CA's adds to the security of the PKI. I realize the compromise of root CA key is catastrophic as it would've to be consequently purged from the trust store of every ...
1
vote
1answer
24 views

TLS Cipher Suites and PKI

I am currently trying to figure out what cryptographic algorithms are applicable when using mutual authentication for TLS with PKI-certificates. So when I am intitially creating a certificate, I ...
1
vote
2answers
59 views

Console based PKI auth (Xubuntu Linux)

Normally, I use my PKCS#11 card to logon to a secured site using a browser plugin which initiated a local software dialog to input PKI card PIN. Is it anyhow possible to do the following? Run some ...
0
votes
0answers
17 views

Is it possible to not specify user id in gpg command and only specify public key? [duplicate]

Here is the code. if exist !SourcePath!\!SourceFilename! ( for %%z in (!SourcePath!\!SourceFilename!) do ( gpg -e -r esbdev@set.or.th --yes --always-trust %%z ) SET ...
1
vote
2answers
75 views

Why digital signatures needs different algorithm

Why digital signatures uses algorithms such as DSA, ECDSA or RSA-PSS, and not just the RSA algorithm to encrypt the message hash with the private key? Is the choice more security or performance ...
0
votes
1answer
17 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
3
votes
1answer
62 views

Concepts of PKI Encryption and Digital Signature Authentication [duplicate]

I am trying to understand how SSL uses PKI and Digital Signature authentication to ensure secure and verified communications. I've read various sources online and from what I can tell the basic ...
1
vote
2answers
55 views

What happens when the timestamper's certificate expires?

What happens when the timestampers certificate expires? If the code is now untrusted, can it be re-stamped without re-signing? If not, what good does this timestamp do me if my cert is valid until the ...
0
votes
1answer
56 views

Best way to manage private keys for users of an application?

We're building an application which will leverage blockchain for financial transaction within itself. We won't be forcing users to manage their own keys. Our clients (we're building a B2B platform) ...
0
votes
0answers
37 views

Network attack vectors on android - an overview

I'm on vacation and - for the first time in a while - have not had the option to circumvent a public (unencrypted) WiFi for internet access. The hotel is remote (no cellular access) but has a large ...
2
votes
1answer
107 views

How does server use session key after tls handshake?

After TLS handshake both server and client agreed about session key to use as symmetric key. So server must store several session keys which each one belongs to a specific client. How server ...
0
votes
1answer
44 views

re-reading decoded openssl pubkey

I was playing with openssl just to see how reading of the public key from a certificate works; Gave a "letsencrypt.pem" certificate I have, I gave these commands. See the entire certificate text: ...
1
vote
2answers
51 views

openssl certificate chain output

I was reading the "Security with HTTPS and SSL" guide for android developers and reading this paragraph. The paragraph discusses the fact that servers do not always return the entire certificate ...
0
votes
1answer
49 views

OCSP, CRLs, crlset - Revocation Delivery and Attacks

OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the ...
2
votes
2answers
164 views

Root CA with Extended Key Usage fields

I recently started using AWS's Certificate Manager to get free TLS certificates for my load balancer. When I was inspecting the certificate chain I noticed that the Root CA, Starfield Class 2 ...
0
votes
0answers
21 views

How to detect C2C communications on HTTPS? [duplicate]

I’m apologizing first If this question is very trivial for many of you. HTTPS traffic is encrypted and we cannot see POST and GET artifacts on them. So, if an C2C is using HTTPS, then what are the ...
1
vote
0answers
36 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
1
vote
0answers
29 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
0
votes
1answer
35 views

Limit OpenVPN client certificate to specific VPN with shared CA chain

I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of ...
1
vote
1answer
29 views

Security Appliance Key Generation

For devices like decrypting HTTPS proxies, there is often a built-in mechanism for generating a key-pair and CSR. An admin can then have their in-house authority sign the CSR with a subordinate CA ...
0
votes
2answers
41 views

Does the symmetric key exchange through asymmetric encryption have to be done asymmetrically?

To communicate over a public channel, it seems often that 2 parties first use some asymmetric-encryption way to exchange a symmetric key. And then use the symmetric key for subsequent communication. ...
3
votes
2answers
85 views

What is the difference between digital notary and certification authority?

Is the difference purely legal or is there a technical difference between a notary notarizing the document signer's identity and a certification authority certifying a signer's certificate?
1
vote
1answer
101 views

Should we use x509 V1 certificate for a new root CA?

I read a couple of articles that kind of gives the impression that the norm is to use a V1 x509 pkc for a root CA. This is one of them. However the rfc5280 makes no such suggestion. My question is, ...
-1
votes
1answer
65 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
2
votes
4answers
237 views

How do mobile apps prevent HTTPS MITM attacks when the user installs the attacker's CA certificate?

I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful. However, I noticed ...
1
vote
0answers
145 views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
2
votes
0answers
35 views

Protecting private keys of common chat applications with 2FA

Say a user uses a common chat application like Telegram, Signal, Whatsapp, Ricochet. His device gets hacked and private keys get stolen. For normal PGP usage with email you can use two factor ...
0
votes
1answer
47 views

What happens if my private key gets stolen in the web of trust?

If I'm a trusted user in the web-of-trust but my private key gets stolen by Eve, how would other users find out that my key is compromised and thus cannot be trusted anymore? Is there a way for them ...
0
votes
1answer
145 views

Should I distribute Root CA or Intermediate CA certificates to client?

I've been following this tutorial to create a Root CA, intermediate CA, and server certificate. I can verify: the intermediate certificate with the root certificate the server certificate with the ...
0
votes
1answer
106 views

Trustworthiness of Let’s Encrypt and ZeroSSL within browsers and OS [duplicate]

With regard to Are there technical disadvantages in using free ssl certificates? it has been highlighted by some that StartSSL is not a trustworthy CA, and I was wondering if Let’s Encrypt is the same....
1
vote
1answer
69 views

How does blockchain client trust other nodes?

If we consider any blockchain based system (bitcoin, for example), how does initial trust setup works? When a new user wants to join blockchain network, how does the client know that it talks to ...
2
votes
1answer
70 views

Web of trust jeopardized because servers getting hacked?

I've read that a common way for servers to handle the SSL certificate is that the private key is not encrypted. Now, a many web servers are getting hacked each day. Assumed that the private key is ...
1
vote
1answer
62 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
-4
votes
2answers
98 views

Private Blockchain VS regular Public-key cryptography [closed]

Private Blockchain (permissioned) VS regular Public-key cryptography: What is the need and add-value of a private blockchain (permissioned) if one can use normal regular public-key cryptography?
0
votes
2answers
369 views

What is the Session ID parameter indicate in Client Hello and Server Hello messages

I was trying to understand the TLS handshake in depth. I set up Wireshark and captured the github.com traffic. While inspecting the Client Hello and Server Hello, I found a parameter Session ID. ...
0
votes
2answers
52 views

Usage of same certificate for client and server authentication

Let's assume I have a device that has both client and server applications running on it at the same time. The client application for example connects to a remote secure webserver (HTTPS) that requires ...
0
votes
1answer
117 views

Can Apple technically intercept iMessage messages

I'm basing this question off the iOS Security Guide. If I understand this correctly, when you enlist in iMessage, the private key stays on your device, while the public key is pushed to a directory ...
0
votes
0answers
32 views

After downloading my private key/public key pair from a Google API service account, where is my public key?

I'm sure there's an obvious answer - I have been searching. I created a Google service account and generated a key. The tutorials say that this creates a public/private key pair. The created file is ....
1
vote
0answers
54 views

Client authentication using certificates in M2M communication

We're planning to implement following scenario for a secure machine-to-machine (M2M) communication network. We have some gateways and a lot of secure sensors which should only be able to "speak" to ...
2
votes
0answers
35 views

Why CA certificate can't be spoofed? [duplicate]

I was trying to learn TLS in depth. Probably my understanding is wrong. This is what I understood: At the end of client handshake, the server will send the CA certificate to the client which contains ...