Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
0
votes
0answers
12 views

How do i produce keypairs for my users while implementing json web token

I want to check the integrity of my user information; that the information which my website server receives was indeed sent by them. From what I understand, json web tokens (jwt) is the way to go. I ...
0
votes
0answers
15 views

IEEE 1363 is inactive-reserved, having been withdrawn on 2019-11-07 : what does this mean?

IEEE 1363-2000 - IEEE Standard Specifications for Public-Key Cryptography - has been withdrawn on 7th November 2019 and is now in inactive-reserved status. What does this mean? Why was it withdrawn? ...
0
votes
1answer
37 views

why CA use private key to sign a digital certificate? What is the logic behind sign a digital certificate with CA private key?

In general(PKI), encryption happens with public key and decryption happens with private key. But, how Certificate Authority sign a digital certificate with private key? How this can be validated using ...
1
vote
2answers
71 views

Man-in-the-middle attack in SSH when attacker copies the public key

If an attacker is able to gain access to the public key on a host server, they can setup a different machine between the client and the server, and place the key there. When clients connect via SSH, ...
1
vote
0answers
44 views

Is macOS installing known bad Certificate Authorities by default?

Today I was checking out macOS security and privacy guide, and when I looked at my keychain, I was surprised to find Startcom CA and Symantec CA trusted by default. Isn't this supposed to be ...
0
votes
0answers
22 views

Certificates for authentication and signing [closed]

Cross posting from SO to here for better reach https://stackoverflow.com/questions/62137112/certificates-for-authentication-and-signing I have a client server scenario. I have both thick client and ...
1
vote
3answers
92 views

Is CA the only way to securely share public key?

Is CA the only way to securely share public key - are there other mechanisms that are viable in practice? I guess if you had a trusted software deployment system that securely transmitted contents ...
13
votes
8answers
5k views

How can we exchange public keys between two servers in a secure way?

I have two servers with a pair of RSA public and private keys. We do not use a CA for the internal communication yet and therefore we need to exchange keys without CA. I need to establish a trust ...
0
votes
0answers
50 views

how to send prime and generator of diffie hell-men to client over network node js?

I am using crypto module of node js for exchanging key using diffie-hellman algorithm. server.js const crypto = require("crypto"); const alice = crypto.createDiffieHellman(512); const aliceKey = ...
1
vote
0answers
50 views

Best Practices Setting Up an Enterprise PKI

I am interested in learning about setting up an (internal) enterprise PKI the right way. What's mostly clear to me is the technical part. Our PKI will implement an hierarchical trust model based on X....
2
votes
0answers
78 views

X509 certificates - Are there any naming conventions? [migrated]

As per the title, what are the naming conventions when buying certificates ? When buying a cert for TLS / https from a particular Server, naturally I will default to the Server name, for example, if ...
11
votes
2answers
2k views

Is an identity certificate the same as a public key?

I'm new to public key infrastructure but I think I understand how public key encryption works, conceptually. So a public key is, by definition, public and not a secret. Recently when I came across ...
0
votes
2answers
78 views

What if an attacker gets access to public key through an insecure media in digital signature?

If A encrpyts the message and creates signature using his private key and sends through the network then only B with the public key of A can decrypt that message. But what if the attacker gets access ...
0
votes
1answer
51 views

How do I identify, characterize and detect if trusted CAs compromised?

What is the best approach to use in identifying, characterizing and detecting compromised CAs? I do not mean an invalid certificate or invalid CA that can be identified by an X.509 during validation ...
0
votes
1answer
79 views

Find the certificate from a public key [closed]

I have a public key. Is there a way to find the corresponding certificate which contains this public key?
0
votes
1answer
72 views

How to generate a CSR (certificate signing request) for creating a limited CA (Certificate Authority) using LibreSSL?

Related to this (too broad) question: How to implement my PKI? I have a self-signed CA (ca0) I would like to create a CA (ca1) with limited power derived from that first CA. ca1 should only be able ...
0
votes
2answers
76 views

Can I find a private key for a known encrypted file?

Let's say I create a 100KB file only containing 1234567890, that is, a known value. This file would be sitting on several folders as bait. Once a Rasomware hits the folder and encrypts this file (...
0
votes
0answers
27 views

Are AWS KMS and Google Cloud KMS's HSMs valid as Certified Qualified Signature Creation Devices?

I'm looking into digitally signing documents and planning to use AWS KMS or Google Cloud KMS service to create and manage the private/public keys. Underneath they use Hardware Security Modules (HSMs) ...
2
votes
2answers
73 views

keyUsage Extensions on a Certificate Authority

I have a question about what key usage should I choose when creating a private CA (root or subordinate). I have inspected some root and issuing web certificate authorities and they tend to use ...
0
votes
1answer
35 views

How long does it take for a gpg key revoke certificate to propagate to all public key servers?

I recently created a new gpg key just for the sake of learning the basics of public key encryption. Now, I'd like to revoke that test key so that I can go on using a more "permanent" key that is ...
0
votes
2answers
67 views

Certificates and keys validity [duplicate]

I'm connecting to a server via TLS. My device has installed server cert, device cert, private key and public key. I read here validity SSL/TLS that TLS cert will last max 2 years. This means that ...
-1
votes
2answers
92 views

How can I create a new root CA and sign existing intermediate CAs without their private keys?

Is it possible to create a new root CA (just for myself) and use it to sign a set of existing intermediate CAs which I'd like to trust? If so, which tool can be used to accomplish this? The private ...
1
vote
0answers
47 views

I need to make a PKI infrastructure, but i don't now how to segment my CA

I'm currently working on a project where we have to rethink a PKI architecture, but we don't know how to segment the different CA_SUBs, do you have any recommendations?
0
votes
1answer
63 views

Compare fingerprints of gpg --verify for files download with / without TOR

From my understanding, except we meet the creator of an archive in person and verify the primary key fingerprint, we can never be sure, that the archive we download is really created by the person we ...
0
votes
0answers
32 views

How to efficiently deploy SMIME email certificates for entire domain with Google GSuite?

Google Suite Enterprise supports centralized SMIME email signatures. This allows for easy deployment across all devices. But besides an API, there's apparently no central management. And I couldn't ...
0
votes
0answers
23 views

Can anyone send any certificate [duplicate]

I seem to be missing one fundamental point regarding Certificates and hoping someone can set me straight. It is constantly described that a certificate can be used for authentication and to ensure the ...
0
votes
0answers
43 views

Which CAs is more vulnerable to compromise or misbehave in the trust chain (Root, Intermediate or Issuing CA)?

From the academic and real-world scenarios which CAs are more prone to misbehavior or compromise by attackers (Root, Intermediate or issuing CAs)? What are the consequences after compromise? Are the ...
2
votes
1answer
42 views

Does AWS KMS use HSM underneath by default?

Have a doubt about about how AWS KMS handles their asymmetrical/symmetrical keys. Does AWS KMS use Hardware Security Modules (HSMs) underneath by default? (cant find documentation that prove/dissmiss ...
0
votes
0answers
39 views

Why is /cacerts request necessary in RFC 7030 Enrollment Over Secure Transport?

In RFC 7030 Enrollment Over Secure Transport (EST) https://tools.ietf.org/html/rfc7030, the /cacerts request (Section 4.1 of RFC 7030) is used by the client to request the current CA certificates. The ...
0
votes
1answer
42 views

What is the role of leaf certificate private key In TLS handshake [duplicate]

What is the role of leaf certificate's private key if this certificate is signed by the intermediate certificate's private key and the certificate signature will only be validated using its public ...
1
vote
1answer
74 views

ECDH_SHA2_NISTP256 (KEX) Algorithm in SSH - Vulnerabilities?

My organization within my company uses this KEX Algorithm in our SSH Implementation. Another organization within my company won't connect to our servers as long as this algorithm is implemented as ...
0
votes
0answers
58 views

How to store ECDSA public key securely in Android

I am writing an Android application that needs to verify that a request is sent from a trusted party (me). This is my current solution: Storing keys: Generate ECDSA public key / private key from a ...
0
votes
1answer
141 views

Are SSH certificates more secure for service accounts?

I'm considering how to deploy a service that needs SSH access to many important boxes in my infrastructure. Rather than store a long-lived SSH private key in a key store that the service could request,...
15
votes
2answers
2k views

Technical description of a self-signed certificate

I'm having a friendly debate with a co-worker as to the meaning of "self-signed" when it comes to PKI. We have an internal root and subordinate CA in our organization. We import the cert chain on ...
0
votes
0answers
15 views

Is my understanding how of a secure connection is made using PKI correct? [duplicate]

My understanding as as follows: Client requests a secure connection with a Website's Server Server provides a certificate with the address of the server and public key of the server encrypted with a ...
4
votes
2answers
147 views

Why is the root in an Online CA model not a Single Point of Failure?

My textbook for CompTIA Security+ has the following practice question: In which one of following PKI Trust Models is the root NOT a single point of failure? Single CA Hierarchical CA ...
1
vote
0answers
46 views

Risk of committing IdentityFile name for OpenSSH configuration to public repository

What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
0
votes
2answers
102 views

certificate used in SSL and keys used in SSH

To do SSH to any server we should create private key pair through which we encrypt the connection. Now in SSH we are just doing encryption and here we don't need to verify the server, that's why we ...
0
votes
2answers
188 views

Accidentally Shared my Private Key - How to Remedy?

I accidentally shared my SSH private and public keys with others. I changed keys within 2 minutes of sharing the private key. I've since added a password to access my private key as well as deleted ...
0
votes
1answer
112 views

CA certificate and Local certificate

There is something which is bothering me when i think about the CA cert and Local cert. Below are my queries which pertains to juniper but may be generic as well. 1) "request security pki ca-...
0
votes
0answers
60 views

Is this a valid equation for determining certificate lifetimes in a PKI infrastructure?

I have an intuitive sense of how certificate lifetimes should work in a PKI infrastructure, but I don't consider myself an expert in this field so I would like someone to validate or critique my ...
0
votes
1answer
53 views

What are the changes in PKI when i move from TLS protocol to IPSec Protocol?

Currently i am using TLS protocol for a secure communication between my server and client. I use PKI for key/certificate Management. If i want to switch to IPsec for secure communication, how will the ...
1
vote
0answers
52 views

GPG - exported secret key with public too

I tried to export public key from my keyring. Then I imported my public key in another keyring. I find the private key too in the 2nd keyring and I can sign files from the 2nd keyring. Why is this ...
6
votes
3answers
191 views

Threema: Are received messages exposed, when sender's private key gets compromised?

Note: This question is specific to the Threema Messenger, and relates to their implementation of encryption (using the NaCl ECDH implementation as per their docs). I refer specifically to their "note ...
0
votes
1answer
30 views

Server certificate authenticity validation process [duplicate]

I was reading this article about how the Server Authentication is being done During SSL Handshake https://docs.oracle.com/cd/E19693-01/819-0997/aakhc/index.html I do understand everything but I have ...
2
votes
0answers
93 views

Why does GPG --recipient only pick one (arbitrary) key for identical names, instead of all of them?

I have a recipient with four hardware keys (HKs) that they use interchangeably. These HKs contain different GPG keys that have all been generated inside and have never left the HKs, thus resulting in ...
0
votes
1answer
80 views

When will CMP be part of OpenSSL? [closed]

CMP means Certificate Management Protocol. CMP for OpenSSL is currently a fork of OpenSSL. Do you know when it will be part of OpenSSL? https://github.com/mpeylo/cmpossl
2
votes
2answers
133 views

Can I use the same truststore and keystore on the client and the server?

TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides? More info if helpful: I'm trying to test ...
0
votes
1answer
113 views

Why generate dedicated issuer CA for TSU certificates?

I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME ...
2
votes
1answer
166 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...

1
2 3 4 5
24