Questions tagged [public-key-infrastructure]

A public-key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). There are three main categories of PKI: Web / SSL certs, corporate networks, and Government ID / ePassport.

Filter by
Sorted by
Tagged with
16
votes
1answer
4k views

Renewing Microsoft Certificate Services Root Certificate

We currently have Microsoft Enterprise Certificate Server installed on a domain member machine which issues 1 year certificates to users for authenticating to VPN. We'd like to start issuing web ...
8
votes
1answer
2k views

Moving from a one tier to a two tier Microsoft Certificate Authority hierachy

Right now we have a single Microsoft Enterprise Root CA which issues certificates to our VPN users for two factor authentication. We're planning to extend use of the CA to issue certificates for RDP ...
9
votes
2answers
7k views

What is an intermediate certificate authority?

What is meant by an "intermediate certificate authority?"
6
votes
1answer
8k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
5
votes
2answers
229 views

How can a certificate be valid in the Hybrid Model but not in the Chain Model?

All dates in European format! I am learning about validity models, but the solution for this assignment confuses me. Translation: The relevant data for the applicable certificates are shown below....
4
votes
1answer
2k views

generating RSA keys through the browser

HTML5 has the element that sends an SPKAC to the server (as I understand it). But how do you do it in IE? One CA's websites gives me the following prompt: This Web site is attempting to perform a ...
3
votes
1answer
4k views

Does Java's implementation of OCSP and CRL checking handle intermediate CAs?

I've read that Java provides OCSP and CRL checking for CertPaths via: Security.setProperty("ocsp.enable", "true"); System.setProperty("com.sun.security.enableCRLDP", "true"); Do these implementations ...
4
votes
1answer
1k views

signatureAlgorithm vs. tbsCertificate -> signature

From the X.509 RFC: Certificate ::= SEQUENCE { tbsCertificate TBSCertificate, signatureAlgorithm AlgorithmIdentifier, signature BIT STRING } TBSCertificate ::= ...
10
votes
2answers
5k views

OCSP and CRLs: Specified in CA or client certificate?

Here's an example PKI setup: * Root CA (offline) * Issuing CA * Client 1 * Client 2 I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
3
votes
1answer
771 views

Internal CA for Digital Signature Solution - PKI Based

I'm trying to set up a digital signature solution which would work with a internal PKI. We have considered Microsoft Certificate Services, but we don't want to rule out any other option to set up a ...
-1
votes
1answer
218 views

XER encoded X.509 certs [closed]

Would anyone happen to have an example of an XER encoded X.509 certificate so I can play around with it? Thanks!
2
votes
3answers
3k views

Public key Infrastructure

Here the MD5 hash is being encrypted with the private key of the sender. But I read in a paper that private key is only used for signing and not encrypting. Is the image wrong or can private key also ...
1
vote
1answer
2k views

are organizations that receive certificates considered “end entities” in a PKI?

I am trying to understand the term end-entity. Does this term just mean anybody that plays a role in a PKI system that is not a CA? So if I request a certificate from A who is a CRL issuer for ...
5
votes
2answers
165 views

Is there a reason to encrypt an encryption key with a certificate before storing it?

Suppose my .Net application which is installed in the client encrypts a data. I want to use a different key generated randomly for each client so each client doesn't know the key of the other. Someone ...
4
votes
1answer
2k views

Can you make a digital signature using the receiver's public key?

My question is, can you make a digital signature using the receiver's public key and then have the receiver verify the signature using his private key? I always thought that in order to create a ...
3
votes
3answers
641 views

Two-way secure communication using two pairs of public/private keys?

Let's say I want to create a protocol to securely communicate between two endpoints - each of the two endpoints know the other's public key and all data exchanged is encryted using one's public key ...
7
votes
3answers
2k views

Safe implementation of sharing encryption secrets (username, password) in the cloud

I'm building a multi-tenant (cloud) environment that needs to push out (or make available for download) configuration files for agents (background services) that receive this information. One of the ...
4
votes
2answers
965 views

How safe is a PGP private key that has “escaped”, but without its password?

Assuming your PGP private key is protected with a password, and it "escapes", but the password does not, how worried should you be? Obviously in the real world, you would immediately revoke the key ...
6
votes
1answer
247 views

public key distribution from a central server

I'm trying to code up a encrypted communication program. Originally I was thinking that I would use public key cryptography and then I would keep the public keys in a database where users could query ...
14
votes
2answers
2k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
3
votes
2answers
1k views

Verifying the authenticity of a public key without manual intervention?

In RSA encryption it is said that ensuring the authenticity of the public key can be as important as the protection of the private key. An effective way of doing this is to have key custodians ...
6
votes
1answer
435 views

Design of system based on HTTPS, Client Certificates and custom CA

I have the following system: 2 application servers. At the beginning is installed the first server and later is installed the second one. A client access from a browser to both servers Application ...
2
votes
1answer
96 views

Remote network security option

I'm a bit confused with some different network security techniques. Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be ...
4
votes
1answer
601 views

PKI integration in MAC OS

I have setup an ejbca pki and integrated certificates in MAC OS for S/MIME signing and encrypting. I have also set up a CRL distribution point and put the CRL online available on an HTTP server. ...
5
votes
1answer
12k views

What is the difference between Key Escrow and a Recovery Agent?

From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later. But in the context of PKI, a Recovery Agent can also recover private keys. How ...
18
votes
2answers
9k views

Is ECDSA breakable by quantum computers?

Is ECDSA secure from quantum computers? Will quantum computers be able to calculate it's private keys from the knowledge of the public key once there are working quantum computers?
3
votes
1answer
238 views

Remote System Administration of an Encryption-Switch-Encrypted Infrastructure

I can't seem to find a decent explanation anywhere of the practicalities of remote system administration (e.g. SSH) of an encryption-switch-encrypted SAN-stored infrastructure. The environment will ...
11
votes
2answers
3k views

What does having an internal two-tier PKI protect against?

There are a lot of Best Practice documents that recommend having an offline Root CA and an Enterprise Subordinate CA that is signed by the root, for an internal Microsoft AD Certificate Services ...
6
votes
1answer
32k views

What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?

What root certificates are/are not updated when the following checkbox is checked? Additional questions If I manually remove a root certificate, will this service replace that very certificate? What ...
3
votes
1answer
557 views

How to have Thunderbird include a root certificate?

An eMail signed via S/MIME also contains the X.509 certificate chain containing the public key in order to directly verify the signature (assuming its issuing CA is deemed trustworthy). The chain does ...
1
vote
1answer
4k views

Can I use any ssl certificate to sign and encrypt AS2 message?

I'm absolutely new to this topic of ssl certificates, so please be patient with me. My task is to install an AS2 communication with some business partner. Therefore we need message signing and ...
2
votes
1answer
1k views

x509: must the signature algorithm and public key algorithm match?

I'm having trouble getting Firefox to send an encrypted message using a certificate, and I've found that the only difference between this one and others that work fine are that this one has a DSA ...
7
votes
1answer
18k views

Enhanced Key Usage vs. Extended Key Usage

I've seen both the terms Enhanced Key Usage and Extended Key Usage, and both were abbreviated as EKU. Do both refer to the same extension or property?
8
votes
1answer
4k views

Why do X.509 certificates have “Key Usage” attribute?

I can find their values and all details in the RFC, but I cannot find why it was decided to have this attribute in certificates, instead of leaving them to be multipurposes. Is there a reasoning ...
1
vote
1answer
1k views

How to troubleshoot why Thunderbird rejects a PKCS#12 certificate with “Could not verify this certificate for unknown reasons”?

After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a ...
1
vote
1answer
1k views

Behavior when validating an expired certificate chain

I have the following situation: A server certificate (CServ) is signed by self-signed certificate (C0) A client certificate (CCli) is signed by CServ Client's trust-store contains C0, so the client ...
2
votes
1answer
1k views

distribution mechanisms for CRLs

From the X.509 RFC: DistributionPoint ::= SEQUENCE { distributionPoint [0] DistributionPointName OPTIONAL, reasons [1] ReasonFlags OPTIONAL, cRLIssuer ...
8
votes
2answers
4k views

ASN.1: ENUMERATED vs INTEGER

From the X.509 specs: CRLReason ::= ENUMERATED { unspecified (0), keyCompromise (1), cACompromise (2), affiliationChanged (3), ...
1
vote
1answer
191 views

What audit procedures are applied to ENotaries and to the software they use?

From a theoretical standpoint, the very notion of an electronic notary - ENotary implies a host of problems related to biometrics, signature revocation, timestamping, keeping a reliable electronic ...
2
votes
1answer
5k views

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange? Can the server be configured to use weak key sizes for ...
6
votes
1answer
19k views

What is the difference between RSA1 & RSA in regards to SSH? Also when is the fingerprint & random art used?

I have searched this site for RSA1 with no results. From multiple google searches I have understood that RSA1 was used in SSH1 (which isn't recommended). However if its a single algorithm why are ...
91
votes
10answers
34k views

Why do we not trust an SSL certificate that expired recently?

Every SSL certificate has an expiration date. Now suppose some site's certificate expired an hour ago or a day ago. All the software by default will either just refuse to connect to the site or issue ...
-2
votes
1answer
3k views

GPG advantages / disadvantages, is it useful or secure? [closed]

I thinking about GPG, is very widely used, but is secure? Why and where we using GPG? I found an article from 2002, but is very old.
3
votes
1answer
11k views

What Enhanced Key Usages are required for PKI infrastructure tasks? (OIDs for OSPF and CRL signing, etc)

I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks. I understand that clients may not validate the ...
0
votes
3answers
425 views

Make the public key unrecoverable given the private key

OpenSSL seems to bundle the private key together with the public key when it produces .pem files. Is there a way to prevent this from happening; i.e. prevent OpenSSL from creating a .pem private key ...
1
vote
3answers
674 views

RSS Feeds: restrict access

"We are a bunch of journalists and we share much of the information via e-mails. This has become tedious now. Hence we found out a way to share, by just having to share our private blog posts via RSS(...
6
votes
4answers
5k views

Is it possible to create a self signed certificate authority?

Would it be possible to create a legitimate certificate with the CA bit set? I dont have a usecase associated with this, I'm merely curious. To explain my question : Suppose I sign a public key(...
6
votes
1answer
1k views

FIPS 140-1 and FIPS 140-2

I tried googling for this info but it's not easily available because FIPS 140-1 is now really old. Does FIPS 140-2 automatically cover FIPS 140-1 - i.e. if a device (in my case an HSM - Hardware ...
4
votes
3answers
4k views

Is a 512 bit RSA key secure when used temporary?

Is a 512 bit RSA key secure when a new key gets generated and used approximately once a week? The key is only used for signing messages, not for encrypting sensitive data. This is for a system where ...
8
votes
2answers
9k views

Extensions for SSL server certificate

I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?