The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

68 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9
votes
1answer
434 views

Pin required for accessing (smartcard) Card Authentication Slot

So let me set the stage: I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html I made a couple ...
5
votes
0answers
451 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
4
votes
0answers
598 views

What is the openssl equivalent of using java's KeyPairGenerator?

I have been using java's KeyPairGenerator in order to generate public/private keys within a program so that I can encrypt and decrypt files(also using java encrypt/decrypt methods). I want to be able ...
3
votes
0answers
432 views

How to securely print private key and protect against attacks on printer itself?

The question is in the title, but below are my thoughts on this. As we know there are various possible attacks on printer, so it is not very secure to print high security things like private keys for ...
3
votes
0answers
367 views

Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?

I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
3
votes
0answers
558 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: 0_.].[0Y0W0U..image/gif0!0.0...+......
2
votes
0answers
39 views

Protecting private keys of common chat applications with 2FA

Say a user uses a common chat application like Telegram, Signal, Whatsapp, Ricochet. His device gets hacked and private keys get stolen. For normal PGP usage with email you can use two factor ...
2
votes
0answers
966 views

cfssl example certificate chain verification failure

I am getting the following error when trying to verify the certificate chain of a dummy root/intermediary/end PKI. root generated as follows: mkdir {root,inter,end} cfssl print-defaults config > ...
2
votes
0answers
114 views

Certificate Transparency and S/MIME certificates

When people speak about CT that usually means only TLS certificates are stored in log. However, CT probable might be considered for usage in other PKI-based technologies. Is CT designed to log S/MIME ...
2
votes
0answers
339 views

Mobile Device identification best practices

When mobile app connects to back-end and requests the data, back-end should be sure that requestor is one it pretends to be. So, we need some way to securely identify the app on a device. While ...
2
votes
0answers
51 views

Securing communications between PoS terminals and sTunnel server

Am I correct in thinking that a PoS Terminal only needs my public key installed on the device to connect to my sTunnel server (with Private key) and that communications between client and server will ...
2
votes
0answers
655 views

What is the .kdb file extension for?

I know that the Public Key Cryptography Standards #12 file format can be used to bundle up an OpenSSL certificate and a private key. From the linked wiki page: These files can be created, parsed ...
2
votes
0answers
151 views

ASN1 Public Key Signature Verification

I'm interested in handling licenses I distribute with my app with ASN1 and including the Public Key within my application. I've already created the Private/Public Keys, but my confusion is in how the ...
2
votes
0answers
610 views

find owner of private key

On one of the old dev servers I manage there is an RSA public and private key pair ~/.ssh/id_rsa.pub and ~/.ssh/id_rsa in a staging user account (used for automation and testing prior to production)...
2
votes
0answers
102 views

Finding the EMSA-PKCS1-v1_5 DigestAlgorithm field in the x509 certificate

From the RFC - https://www.ietf.org/rfc/rfc3447.txt A.2.4 RSASSA-PKCS1-v1_5 For each OID, the parameters field associated with this OID in a value of type AlgorithmIdentifier shall have a value ...
2
votes
0answers
450 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
2
votes
0answers
416 views

Mitigating the risk of disabling EPA on ADFS

I'm currently investigating the deployment of an Active Directory Federation Services (ADFS) server for providing Single Sign-on for various services. By default, ADFS enables support for Extended ...
1
vote
0answers
27 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
1
vote
0answers
234 views

Extracting .p12 cert and key without OpenSSL

I've asked a question on SO, but was directed here since it might align better with this SE. The problem I have is that I need to extract the certificate and key in unencrypted PEM format for use in ...
1
vote
0answers
136 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
1
vote
0answers
38 views

Revocation list for a custom solution

If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
1
vote
0answers
104 views

Get S/MIME from Digicert, store in escrow on on-prem CA

I'm trying to crack the following nut: I have a contract with Digicert for S/MIME certificates for my org. Digicert allows to use their API for cert issuance. Unfortunately I can't let users self-...
1
vote
0answers
61 views

Is there a compiled list of TEE (Trusted Execution Environment) manufacturer/CA certificates?

I may be misunderstanding TEEs (I just learned about them from an HN post), but I have question regarding the features that seem to allow what seems to be the perfect form of DRM (to my maybe limited ...
1
vote
0answers
52 views

Identifying and understanding a cryptographic voting protocol

I am reading about a voting protocol using public key encryption. According to the notes, if A votes va, then A broadcasts Ra(Rb(Rc(Ea(Eb(Ec(va)))))). Here, Ra is a random encoding function which ...
1
vote
0answers
44 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
1
vote
1answer
70 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
1
vote
0answers
87 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
1
vote
0answers
52 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
1
vote
0answers
585 views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
1
vote
1answer
115 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
1
vote
0answers
145 views

Client authentication using certificates in M2M communication

We're planning to implement following scenario for a secure machine-to-machine (M2M) communication network. We have some gateways and a lot of secure sensors which should only be able to "speak" to ...
1
vote
0answers
40 views

Is this protection for customer data both secure and fast enough?

A small electrical installation company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what product/installation) and some small ...
1
vote
0answers
82 views

What is a KEA certificate and how it is used?

I'm currently studying IKE and IPsec in the context of VPN applications and I know that a X.509 certificate is used to provide server's public key to the client (and vice-versa in case of mutual ...
1
vote
0answers
1k views

How to force a full Client SSL handshake and ignore abbreviated client SSL handshake? Is it insecure?

I understand the SSL handshake flow, but I'm facing a logic problem with an abbreviated SSL handshake. Use case: The user is authenticated on system for common ways, such as passwords. But for some ...
1
vote
0answers
644 views

Implementing Internal Certificate Authority

We're considering setting up an internal certificate authority to issue ssl certificates. The certificates would primarily be used to secure internal websites, but I could foresee us potentially ...
1
vote
0answers
61 views

Adding a permission layer on RSA keys?

Scenario: Imagine I want to create an app where users can share encrypted documents with other users, but have certain permissions with regards to what kind of permissions the user they are sharing ...
1
vote
0answers
80 views

key hierarchy management and master key

Now, I have this equation, {{K_ab}K_bs}K_as. K_ab is encrypted by K_bs then whole packet is encrypted by K_as I think the key structure is K_as is the master key, K_bs is under K_as and K_ab is the ...
1
vote
0answers
160 views

Key Hierarchy and key Encryption

If i have two 56-bit DES keys, and I use these two key to encrypt a 256-bit AES key. Like this: K_AT encrypts K_BT and K_BT encrypts K What is the effective security of key K? Is it 2 X 56 Bits?
1
vote
0answers
195 views

Mysql SSL handshake: symmetric key exchange with CA or server key?

I have my MySQL database set up to require server and client identify verification, with both presenting their certificates signed by the same CA (mysql user was set up with 'require X509'). ...
1
vote
0answers
1k views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: http://www....
1
vote
0answers
71 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
1
vote
0answers
45 views

Security schemes regularly in use on cloud

I've been looking into how connections are managed in the cloud, in order to better understand the threats users and their deployments may face. The most important and common ones in use seem to be ...
1
vote
0answers
666 views

Distribute S/MIME public keys and CA cert for email security

I have my own CA. I want to distribute S/MIME certificates for 10 different users. I saw S/MIME keyservers from http://wiki.cacert.org/KeyServers, but I don't want to use public servers. What is the ...
1
vote
0answers
63 views

Use of RSA in Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...
1
vote
0answers
39 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
1
vote
0answers
77 views

Breaking public key pinning

I was reading through the IETF's Public Key Pinning Extension for HTTP (http://tools.ietf.org/html/draft-ietf-websec-key-pinning-12). The acknowledgements section has the following: Thanks to Trevor ...
1
vote
0answers
54 views

Looking for OpenSC compatibile token

I am currently proud user of Feitan ePass2003 with OpenSC, however it is not 100% reliable on Windows, on Linux it's just perfect. Anyway I started to looking and I have two candidates eToken Pro 64K ...
1
vote
0answers
1k views

Import securely RSA private key through PKCS#11

I have a cryptographic device that supports the following mechanisms: How I could securely import RSA private key into it? Because there is no support for wrap/unwrap using symmetric key is there any ...
0
votes
1answer
64 views

Is it common for malwares to use public-key cryptography to authenticate their C2 commmunications?

I'm sure there are instances of this, but I ask it because malwares are often so makeshift that I could definitely see their authors purposely using weaker forms of authentication to perform ...
0
votes
0answers
20 views

Get Hash from PKIsignature

I have a PKIsignature and a certificate attached to same file, How can I: extract public key from certificate chain use public key to get hash file from PKIsignature DBNmqrbZ+...