Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

92 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
129 views

Where can I find a list of all government agencies with CAs in PKI root stores?

Is there a source that monitors popular root stores for CAs controlled by government agencies? There are several "root stores" that maintain a list of trusted root CAs. These root stores are ...
4
votes
0answers
405 views

Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?

I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
4
votes
0answers
705 views

What is the openssl equivalent of using java's KeyPairGenerator?

I have been using java's KeyPairGenerator in order to generate public/private keys within a program so that I can encrypt and decrypt files(also using java encrypt/decrypt methods). I want to be able ...
3
votes
0answers
175 views

Why does GPG --recipient only pick one (arbitrary) key for identical names, instead of all of them?

I have a recipient with four hardware keys (HKs) that they use interchangeably. These HKs contain different GPG keys that have all been generated inside and have never left the HKs, thus resulting in ...
3
votes
0answers
1k views

cfssl example certificate chain verification failure

I am getting the following error when trying to verify the certificate chain of a dummy root/intermediary/end PKI. root generated as follows: mkdir {root,inter,end} cfssl print-defaults config > ...
3
votes
0answers
612 views

1.3.6.1.5.5.7.1.12 Logotype extension - how can it be generated from openssl command line

If you look at this subCA Certificate from Verisign http://www.tbs-certificats.com/FAQ/en/495.html?p=en/495.html It has the following field 1.3.6.1.5.5.7.1.12: 0_.].[0Y0W0U..image/gif0!0.0...+......
2
votes
0answers
107 views

Why don't CAs advertize public keys of verified entities on a central location instead of giving out signed certificates?

If CAs (Certification Authorities) start advertizing public keys of verified websites via some API, browsers can simply query them for each domain instead of asking websites to give them certificates ...
2
votes
1answer
118 views

How do clients extract the public key from a self-signed certificate?

I have gone over: Why do we need to sign the self-signed certificate? Basic self-signed certificate questions Is a self-signed SSL certificate much better than nothing? I am new to cryptography and ...
2
votes
0answers
43 views

Public key stored in server is different from what is shown in OpenSSL

I obtained an SSL certificate from LetsEncrypt for my web application using Apache web server. LetsEncrypt generated these 4 files: cert.pem chain.pem fullchain.pem privkey.pem As I understand, ...
2
votes
1answer
178 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
2
votes
2answers
280 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
2
votes
0answers
62 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
2
votes
0answers
40 views

Protecting private keys of common chat applications with 2FA

Say a user uses a common chat application like Telegram, Signal, Whatsapp, Ricochet. His device gets hacked and private keys get stolen. For normal PGP usage with email you can use two factor ...
2
votes
0answers
146 views

Certificate Transparency and S/MIME certificates

When people speak about CT that usually means only TLS certificates are stored in log. However, CT probable might be considered for usage in other PKI-based technologies. Is CT designed to log S/MIME ...
2
votes
0answers
447 views

Mobile Device identification best practices

When mobile app connects to back-end and requests the data, back-end should be sure that requestor is one it pretends to be. So, we need some way to securely identify the app on a device. While ...
2
votes
0answers
56 views

Securing communications between PoS terminals and sTunnel server

Am I correct in thinking that a PoS Terminal only needs my public key installed on the device to connect to my sTunnel server (with Private key) and that communications between client and server will ...
2
votes
0answers
749 views

What is the .kdb file extension for?

I know that the Public Key Cryptography Standards #12 file format can be used to bundle up an OpenSSL certificate and a private key. From the linked wiki page: These files can be created, parsed ...
2
votes
0answers
182 views

ASN1 Public Key Signature Verification

I'm interested in handling licenses I distribute with my app with ASN1 and including the Public Key within my application. I've already created the Private/Public Keys, but my confusion is in how the ...
2
votes
0answers
831 views

find owner of private key

On one of the old dev servers I manage there is an RSA public and private key pair ~/.ssh/id_rsa.pub and ~/.ssh/id_rsa in a staging user account (used for automation and testing prior to production)...
2
votes
0answers
138 views

Finding the EMSA-PKCS1-v1_5 DigestAlgorithm field in the x509 certificate

From the RFC - https://www.ietf.org/rfc/rfc3447.txt A.2.4 RSASSA-PKCS1-v1_5 For each OID, the parameters field associated with this OID in a value of type AlgorithmIdentifier shall have a value ...
2
votes
0answers
469 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
2
votes
0answers
436 views

Mitigating the risk of disabling EPA on ADFS

I'm currently investigating the deployment of an Active Directory Federation Services (ADFS) server for providing Single Sign-on for various services. By default, ADFS enables support for Extended ...
1
vote
0answers
34 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
1
vote
1answer
56 views

Expiration of superadmin.p12 certificate

I have a super admin certificate which is expired two days ago.When I try to click on Administration tab in my EJBCA instance to renew this certificate ,I am getting error like certificate has expired....
1
vote
0answers
49 views

I need to make a PKI infrastructure, but i don't now how to segment my CA

I'm currently working on a project where we have to rethink a PKI architecture, but we don't know how to segment the different CA_SUBs, do you have any recommendations?
1
vote
0answers
46 views

Risk of committing IdentityFile name for OpenSSH configuration to public repository

What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
1
vote
0answers
58 views

GPG - exported secret key with public too

I tried to export public key from my keyring. Then I imported my public key in another keyring. I find the private key too in the 2nd keyring and I can sign files from the 2nd keyring. Why is this ...
1
vote
0answers
33 views

How do I check if my key is updated in a keyserver after I resend it with new signatures?

I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures. The thing is that when ...
1
vote
2answers
137 views

Is it common for malwares to use public-key cryptography to authenticate their C2 commmunications?

I'm sure there are instances of this, but I ask it because malwares are often so makeshift that I could definitely see their authors purposely using weaker forms of authentication to perform ...
1
vote
0answers
53 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
1
vote
1answer
105 views

PKI - Hybrid - root ca in the Datacenter

PKI - Can we maintain root CA and HSM in the data center and have issuing CA on the cloud to issue certs, integrated with cloud HSM?
1
vote
0answers
758 views

Extracting .p12 cert and key without OpenSSL

I've asked a question on SO, but was directed here since it might align better with this SE. The problem I have is that I need to extract the certificate and key in unencrypted PEM format for use in ...
1
vote
0answers
234 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
1
vote
0answers
42 views

Revocation list for a custom solution

If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
1
vote
0answers
127 views

Get S/MIME from Digicert, store in escrow on on-prem CA

I'm trying to crack the following nut: I have a contract with Digicert for S/MIME certificates for my org. Digicert allows to use their API for cert issuance. Unfortunately I can't let users self-...
1
vote
0answers
89 views

Is there a compiled list of TEE (Trusted Execution Environment) manufacturer/CA certificates?

I may be misunderstanding TEEs (I just learned about them from an HN post), but I have question regarding the features that seem to allow what seems to be the perfect form of DRM (to my maybe limited ...
1
vote
0answers
59 views

Identifying and understanding a cryptographic voting protocol

I am reading about a voting protocol using public key encryption. According to the notes, if A votes va, then A broadcasts Ra(Rb(Rc(Ea(Eb(Ec(va)))))). Here, Ra is a random encoding function which ...
1
vote
1answer
84 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
1
vote
0answers
122 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
1
vote
0answers
76 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
1
vote
2answers
145 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
1
vote
0answers
269 views

Client authentication using certificates in M2M communication

We're planning to implement following scenario for a secure machine-to-machine (M2M) communication network. We have some gateways and a lot of secure sensors which should only be able to "speak" to ...
1
vote
0answers
44 views

Is this protection for customer data both secure and fast enough?

A small electrical installation company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what product/installation) and some small ...
1
vote
0answers
97 views

What is a KEA certificate and how it is used?

I'm currently studying IKE and IPsec in the context of VPN applications and I know that a X.509 certificate is used to provide server's public key to the client (and vice-versa in case of mutual ...
1
vote
0answers
1k views

How to force a full Client SSL handshake and ignore abbreviated client SSL handshake? Is it insecure?

I understand the SSL handshake flow, but I'm facing a logic problem with an abbreviated SSL handshake. Use case: The user is authenticated on system for common ways, such as passwords. But for some ...
1
vote
0answers
682 views

Implementing Internal Certificate Authority

We're considering setting up an internal certificate authority to issue ssl certificates. The certificates would primarily be used to secure internal websites, but I could foresee us potentially ...
1
vote
0answers
62 views

Adding a permission layer on RSA keys?

Scenario: Imagine I want to create an app where users can share encrypted documents with other users, but have certain permissions with regards to what kind of permissions the user they are sharing ...
1
vote
0answers
84 views

key hierarchy management and master key

Now, I have this equation, {{K_ab}K_bs}K_as. K_ab is encrypted by K_bs then whole packet is encrypted by K_as I think the key structure is K_as is the master key, K_bs is under K_as and K_ab is the ...
1
vote
0answers
162 views

Key Hierarchy and key Encryption

If i have two 56-bit DES keys, and I use these two key to encrypt a 256-bit AES key. Like this: K_AT encrypts K_BT and K_BT encrypts K What is the effective security of key K? Is it 2 X 56 Bits?
1
vote
0answers
203 views

Mysql SSL handshake: symmetric key exchange with CA or server key?

I have my MySQL database set up to require server and client identify verification, with both presenting their certificates signed by the same CA (mysql user was set up with 'require X509'). ...