Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
0
votes
0answers
38 views

Is this a valid equation for determining certificate lifetimes in a PKI infrastructure?

I have an intuitive sense of how certificate lifetimes should work in a PKI infrastructure, but I don't consider myself an expert in this field so I would like someone to validate or critique my ...
0
votes
1answer
48 views

What are the changes in PKI when i move from TLS protocol to IPSec Protocol?

Currently i am using TLS protocol for a secure communication between my server and client. I use PKI for key/certificate Management. If i want to switch to IPsec for secure communication, how will the ...
1
vote
0answers
35 views

GPG - exported secret key with public too

I tried to export public key from my keyring. Then I imported my public key in another keyring. I find the private key too in the 2nd keyring and I can sign files from the 2nd keyring. Why is this ...
26
votes
3answers
62k views

How to get public key of a secure webpage?

How can I get the public key of a webpage like verisign , etc. using HTTPS protocol?
1
vote
0answers
26 views

Threema: Are received messages exposed, when sender's private key gets compromised?

Note: This question is specific to the Threema Messenger, and relates to their implementation of encryption (using the NaCl ECDH implementation as per their docs). I refer specifically to their "note ...
2
votes
1answer
159 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
0
votes
1answer
25 views

Server certificate authenticity validation process [duplicate]

I was reading this article about how the Server Authentication is being done During SSL Handshake https://docs.oracle.com/cd/E19693-01/819-0997/aakhc/index.html I do understand everything but I have ...
58
votes
4answers
91k views

How does the digital signature verification process work?

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
5
votes
1answer
4k views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...
2
votes
0answers
57 views

Why does GPG --recipient only pick one (arbitrary) key for identical names, instead of all of them?

I have a recipient with four hardware keys (HKs) that they use interchangeably. These HKs contain different GPG keys that have all been generated inside and have never left the HKs, thus resulting in ...
0
votes
2answers
438 views

Is IKE aggressive mode really less secure than main mode?

This guy argues it is not: https://www.youtube.com/watch?v=DuowFgNKAIg I really confused about this. According to him, the only purpose of main mode is to make the peers anonymous, but in order to ...
0
votes
1answer
68 views

When will CMP be part of OpenSSL? [closed]

CMP means Certificate Management Protocol. CMP for OpenSSL is currently a fork of OpenSSL. Do you know when it will be part of OpenSSL? https://github.com/mpeylo/cmpossl
0
votes
0answers
4 views

WebCrypto SubtleCrypto RSA sign/verify AND encrypt/decrypt? [migrated]

I have a project where I'd like to use public-key cryptography in both typical sign/verify situations and encrypt/decrypt situations. For example, I'd like to create a self-signed X.509 certificate ...
0
votes
1answer
109 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me their S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not ...
5
votes
4answers
539 views

What benefit is there to adding a password to your SSH key?

If you run the following command on a Linux/Unix machine, among other things, you get a prompt for a password: $ ssh-keygen -t dsa Enter passphrase (empty for no passphrase): What does adding a ...
8
votes
3answers
6k views

Export non-extractable private key from Keychain on OS X

I have a PKI certificate in Keychain Access.app on OS X 10.9, together with the private key. The manual page for /usr/bin/security indicates that there is a -x option for security import to specify ...
2
votes
2answers
68 views

Can I use the same truststore and keystore on the client and the server?

TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides? More info if helpful: I'm trying to test ...
2
votes
2answers
162 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
0
votes
1answer
76 views

Why generate dedicated issuer CA for TSU certificates?

I've observed the practice of generating dedicated issuer CAs for signing TSU (Time-Stamping Unit) certificates instead of just using another existing issuer CA, for example, one used to sign S/MIME ...
1
vote
1answer
879 views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
1
vote
1answer
108 views

What is “-srvcert” in OpenSSL cmp command line?

I use the following command to get a signed certificate from PKI. What is the content of the file srvcert.crt of the option -srvcert ? It seems the srvcert.crt file is not the public certificate of ...
0
votes
1answer
157 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
1
vote
1answer
74 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
0
votes
1answer
165 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
15
votes
3answers
36k views

Reset Windows trusted certificates store to its default [closed]

Over the time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, some other times for development and testing. Is there ...
95
votes
7answers
133k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
2
votes
1answer
83 views

Can I concatenate multiple x509 certificates?

I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. ...
1
vote
1answer
121 views

Encrypted log entries authorization

We have a database table of encrypted log entries, each encrypted entry containing information about the user who created the entry. The entry is encrypted with the encryption key of the particular ...
11
votes
1answer
471 views

Pin required for accessing (smartcard) Card Authentication Slot

So let me set the stage: I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html I made a couple ...
0
votes
1answer
58 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
0
votes
2answers
86 views

private key of SSL certificate

To create a certificate, first we need to fill a CSR and in CSR we have to place our public key and that key pair can be generated by different ways in different devices. To do ssh, we run command (...
38
votes
3answers
32k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
308
votes
6answers
245k views

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
1
vote
1answer
69 views

What is required to verify that an x509 cert matches a key?

Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it. How can I validate, that the cert certifies exactly that key? My impression is that it is ...
3
votes
3answers
967 views

Is it possible to do Public Private Key Encryption on a chip (hardware)?

Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely? The ultimate goal ...
3
votes
2answers
6k views

CSR with only public key with openssl

So I have been doing my research and haven't found anything specific enough to my problem. As the question title states, I want to make a CSR with only the public key. What I have been able to do is ...
24
votes
1answer
20k views

Which properties of a X.509 certificate should be critical and which not?

RFC5280's section 4.2 states Each extension in a certificate is designated as either critical or non-critical. A certificate-using system MUST reject the certificate if it encounters ...
1
vote
1answer
84 views

PKI - Hybrid - root ca in the Datacenter

PKI - Can we maintain root CA and HSM in the data center and have issuing CA on the cloud to issue certs, integrated with cloud HSM?
1
vote
1answer
127 views

RFC 5755 Attribute Certificate Validation

According to this explanation: Manually walking through the signature validation of a certificate I'd like to know how is the validation process of an RFC 5755 attribute certificates, because it ...
1
vote
1answer
85 views

Is it common for malwares to use public-key cryptography to authenticate their C2 commmunications?

I'm sure there are instances of this, but I ask it because malwares are often so makeshift that I could definitely see their authors purposely using weaker forms of authentication to perform ...
2
votes
1answer
76 views

How does an offline Root CA sign OCSP Response?

As Root CA are kept offline for security purposes, how does it sign OCSP Response sent by Client for Intermediate Certificate Status Check?
7
votes
1answer
487 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
0
votes
0answers
40 views

Root certificate installation and Server Certificate validation in Embedded Device

I have gone through articles on google for adding a root certificate on my Embedded Device to validate Server Certificate During Handshake. but still, I am not clear about a few topics 1) do we need ...
0
votes
0answers
59 views

Implementing PKI with Blockchain

In many current researches, ways of decentralizing PKI are proposed in which one of them is to implement PKI on blockchain but there is still a certification authority so isn't PKI still centralized ? ...
1
vote
0answers
31 views

How do I check if my key is updated in a keyserver after I resend it with new signatures?

I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures. The thing is that when ...
4
votes
4answers
1k views

How can we trust PKI, for example, Verisign?

We want to send an encrypted message to Alice. We can ask her a public key over the network, encrypt with it a message and send that message back. It is bad, because someone can pretend to be Alice ...
2
votes
2answers
98 views

Does Windows require the full certificate chain in order to trust a certificate?

I'm putting together a Root CA to sign multiple intermediate CAs which will then be used to sign VPN server and VPN user certificates. When I provide a user with their certificate, ideally I only ...
0
votes
1answer
22 views

gpg importing public key

I'm trying to follow this: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Step_by_Step_Guide/s1-gnupg-import.html to import a key.asc using gpg --import key.asc, so that ...
0
votes
3answers
133 views

Will it be safer to use self sign CA and client certification in the company for a private website?

Our company have 10+ private websites and 20+ person and need to open a different one automatic when the developers are testing some functional. We do not want anyone outside the company to view the ...
0
votes
2answers
118 views

Is there any way to send data securely from multiple As to B in the presence of eavesdropper, without losing anonymity like in a public key exchange?

Suppose I have n subordinates at work. Any subordinate should be able to submit his or her report anonymously to me via digital means. Also suppose that I have no means of broadcasting any form of ...

1 2 3 4 5 23