Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
0
votes
0answers
35 views

Are there any identity providers which support securing RESTful interfaces using digital signature?

I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract: When signing, the sender uses ...
0
votes
0answers
50 views

oauth mutual authentication and certificaate bound access token

I have a system where two clients (A, B) ask and receive information from each other. I am following mutual tls. In order to make this work, I am following this procedure First I create an ...
1
vote
2answers
216 views

is this a good practice for storing private keys?

I'm working on a centralized exchange for cryptocurrencies. the approach that I'm taking for some reasons is to create an account(private key) per user inside platform. so these accounts should be ...
0
votes
1answer
58 views

Is encrypting a private key inside a pkcs12 file using openssl secure?

This answer states that encrypting a private key using openssl rsa -aes256 isn't secure, because the md5 hash of the password is used as encryption key. But what if I do openssl pkcs12 -export -in ...
0
votes
0answers
37 views

Re-use autoenrolment CSR to obtain another certificate [migrated]

It's about Windows ADCS. The problem: we want to get S/MIME certificates from external vendor, but the local law obligates us to keep encryption keys so we can decrypt any company data in case of any ...
0
votes
1answer
57 views

Why must I send certificate and private key when make HTTPS requests? [duplicate]

In my company, we are issued .p12 files and extract the certificate and private key like so: openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys openssl pkcs12 -in path.p12 -out newfile....
0
votes
0answers
46 views

PKI: how to get OCSP Signing certificate information?

If I want to find the actual signing certificate for OCSP responder, how can I go about it? Is it possible to get it anywhere in .pem format?
2
votes
1answer
288 views

What is the correct terminology for a private key corresponding to a public key certificate?

I have learned that the certificate is something that contain information about a public key. An article on wikipedia says Public Key Certificate as well. If we are talking about private key, it's not ...
0
votes
1answer
46 views

MFA using PKI certificates [closed]

I'm trying to set up a multi factor authentication using PKIs certificates. A PKI infrastructure is ready to use and i'm planning to put these certificates on smart cards. I was looking for a smart ...
0
votes
1answer
56 views

Certificate Authority generates private key for Extended Validation code signing certificate?

My company upgraded to an Extended Validation code signing security certificate, which was delivered via mail on a physical USB key, called a "token." The token contains a private key and ...
6
votes
1answer
147 views

Why not signing a certificate with more than one Certification Authority [duplicate]

A student asked me a good question today when I was explaining the concept of certificates chain. As I said "if a CA is compromised by an attacker he can emit false certificates for the entities ...
0
votes
2answers
113 views

Create CSR for S/MIME certificate from existing OpenPGP key pair

While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone). I believe the ...
0
votes
2answers
203 views

openssl verify error: unable to get local issuer certificate

I have a test certificate chain that I generated and it fails the openssl verify command: openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem The output I get from the ...
1
vote
0answers
38 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
1
vote
2answers
85 views

Is it the public key or the key pair that is included in the x509 certificate?

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate: Root CA: openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -...
0
votes
1answer
41 views

How to use another SSL certificate for DHE-RSA while I already have one with domain?

I'm working in IOT team to build a web based IOT system. I'm using Dataplicity's Wormhole to host my nodeJS app on raspberry pi. I want to use DHE-RSA symmetric key encryption channel for sending/...
0
votes
2answers
134 views

Security risks from exposing ssh to a home server

I'm not sure if this is the right place to ask. My goal is to establish an external connection to my home server through ssh and tunnel some ports to the laptop. For this reason, I've exposed the SSH ...
4
votes
2answers
167 views

Is Java's probablePrime used in production?

Prime numbers are core in security. I saw this question about Java's probablePrime and was wondering if that API/approach is indeed used for real production-ready security code or other approaches are ...
0
votes
0answers
28 views

Is JPAKE over SSL/HTTPS overkill?

We have an API that runs exclusively in HTTPS, any unencrypted traffic is dropped. We want to add public-key encryption to some of our methods (like login, payments, and so), by making the client ...
0
votes
1answer
75 views

Diffie Hellman implementation- NodeJS

Diffie Hellman is a key exchange algorithm where client and server both generate public and private key, exchange their public key and combine this key with his own private key to generate same secret ...
3
votes
2answers
242 views

Why would a certificate authority have multiple root certificates?

When I look at the trusted certificates in my browser, I see that many certificate authorities have multiple root certificates associated with them. For example, org-Amazon has Amazon Root CA 1, ...
1
vote
2answers
67 views

What is the name of the crypto system used by ICANN's DNS recovery system?

I once heard about a type of crypto system that behaves in the following way: I have x secret keys that work together to decrypt messages encrypted with a public key d. If I get at least n of the x ...
2
votes
1answer
98 views

What is LS0… encoding of a PKI certificate?

I am looking through a set of PKI certificates and key strings that are specified in a kubernetes yaml file. They are used for testing. Some of the strings are keyed (as in yaml key-value) as crt.pem. ...
0
votes
0answers
64 views

Reused key issue in Asymmetric Encryption

We all hear often about the reused key issue in block cipher. For example, for a picture being encrypted by the electronic codebook mode, we will still see the shape of the picture. https://images.app....
1
vote
1answer
71 views

Expiration of superadmin.p12 certificate

I have a super admin certificate which is expired two days ago.When I try to click on Administration tab in my EJBCA instance to renew this certificate ,I am getting error like certificate has expired....
1
vote
1answer
45 views

Is it allowed to store billing address for merchants SAQ A merchants? (PCI DSS)

I know there are many limitations for data storing and processing by PCI DSS. Some of them are explained here. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf But I can't find any ...
0
votes
1answer
70 views

pki infrastructure for REST API

My question is based on to secure REST API's. We have to publish a REST API and we want only certain consumers to consume the API. I was thinking of one way is to use asymmetric encryption. The steps ...
2
votes
0answers
107 views

Why don't CAs advertize public keys of verified entities on a central location instead of giving out signed certificates?

If CAs (Certification Authorities) start advertizing public keys of verified websites via some API, browsers can simply query them for each domain instead of asking websites to give them certificates ...
2
votes
1answer
133 views

How do clients extract the public key from a self-signed certificate?

I have gone over: Why do we need to sign the self-signed certificate? Basic self-signed certificate questions Is a self-signed SSL certificate much better than nothing? I am new to cryptography and ...
6
votes
2answers
459 views

Impact of Root certificate Renewal

I have generated a good number of leaf certificates with my root CA but now it(Root) has expired. Even though leaf certificates have a longer expiry date than root CA, they also expired due to ...
0
votes
0answers
30 views

GPG Questions About Exporting Subkeys to File

GPG novice here so please bear with me. From what I understand, when you generate a keypair with GPG it will automatically create a subkey pair (sub, ssb). If I wanted to give these to another party ...
0
votes
1answer
288 views

Windows Certificates - where is private key located?

In Windows 10: When I load a certficate into the "Current User" store, it puts a private key file here: C:\Users\[userID-A]\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-xxx\...
2
votes
1answer
76 views

PKI: How does CA certificate revocation affect leaf certificates?

I'm struggling to find relevant section in RFCs, and I hope someone here can help me. How does - per specification - subCA revocation affect leaf certificates issued from this CA prior to revocation? ...
3
votes
2answers
236 views

Does the CA create the public key or is it created by the requesting server and sent to the CA?

This link says that the requesting server creates the public-private key pair and sends the public key to the CA inside the CSR. However, DigiCert says: The CSR is submitted to a Certificate ...
0
votes
0answers
31 views

Mnemonic Seed Phrase Generation For Private Key Truncation

The below code block is capable of generating a mnemonic seed phrase. If I want to generate a mnemonic seed for a private key, is it then correctly understood that I should input the private key as ...
2
votes
0answers
44 views

Public key stored in server is different from what is shown in OpenSSL

I obtained an SSL certificate from LetsEncrypt for my web application using Apache web server. LetsEncrypt generated these 4 files: cert.pem chain.pem fullchain.pem privkey.pem As I understand, ...
0
votes
2answers
73 views

How is the digital certificate sent alongside digital signatures?

Most tutorials on the net only mention sending the digital signature attached to the document, but without the digital signature certificate, it'll be impossible for receivers to verify the signature. ...
0
votes
1answer
36 views

Does a password-derived public key authentication improve security over pure password-based authentication?

Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of ...
0
votes
2answers
51 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
0
votes
0answers
33 views

What are the recommended mechanism to securely distribute private keys to thousands of servers?

I am asking this question because in this article https://engineering.fb.com/security/delegated-credentials/ there is a sentence stating "We securely distribute private keys to the servers". ...
4
votes
0answers
131 views

Where can I find a list of all government agencies with CAs in PKI root stores?

Is there a source that monitors popular root stores for CAs controlled by government agencies? There are several "root stores" that maintain a list of trusted root CAs. These root stores are ...
0
votes
1answer
98 views

Can PKCS#12 files contain multiple certificate chains?

I know that PKCS#12 files can contain multiple certificates and private keys. However, I could not find any resource where any limit was mentioned for the number of certificate chains or private keys ...
0
votes
3answers
131 views

Why do we need to sign the self-signed certificate?

When we add a self-signed certificate to a device's list of trusted root certificates, we're already trusting it. So, why should it be signed with the server's private key? Signatures only ensure ...
0
votes
3answers
63 views

While importing certificates in keystore, do we treat these like CA root certificates?

When we need to call an internal domain via HTTPS, Java doesn't allow it because it doesn't recognize the certificate that those domain web servers are sending (probably because those certificates are ...
0
votes
0answers
21 views

How do i produce keypairs for my users while implementing json web token

I want to check the integrity of my user information; that the information which my website server receives was indeed sent by them. From what I understand, json web tokens (jwt) is the way to go. I ...
0
votes
2answers
78 views

IEEE 1363 is inactive-reserved, having been withdrawn on 2019-11-07 : what does this mean?

IEEE 1363-2000 - IEEE Standard Specifications for Public-Key Cryptography - has been withdrawn on 7th November 2019 and is now in inactive-reserved status. What does this mean? Why was it withdrawn? ...
0
votes
1answer
80 views

why CA use private key to sign a digital certificate? What is the logic behind sign a digital certificate with CA private key?

In general(PKI), encryption happens with public key and decryption happens with private key. But, how Certificate Authority sign a digital certificate with private key? How this can be validated using ...
1
vote
2answers
100 views

Man-in-the-middle attack in SSH when attacker copies the public key

If an attacker is able to gain access to the public key on a host server, they can setup a different machine between the client and the server, and place the key there. When clients connect via SSH, ...
3
votes
1answer
94 views

Is macOS installing known bad Certificate Authorities by default?

Today I was checking out macOS security and privacy guide, and when I looked at my keychain, I was surprised to find Startcom CA and Symantec CA trusted by default. Isn't this supposed to be ...
1
vote
3answers
98 views

Is CA the only way to securely share public key?

Is CA the only way to securely share public key - are there other mechanisms that are viable in practice? I guess if you had a trusted software deployment system that securely transmitted contents ...

1
2 3 4 5
25