People who code: we want your input. Take the Survey
10

The short answer is to use RS256, to be understood as SHA 256 with RSA 2048 bits keys. See RFC 7518 JSON Web Algorithms (JWA) for all supported algorithms. On signing algorithms There are two major signing algorithms supported by JWT: RSA and ECDSA. RSA (as in alg:RS256) is the classic asymmetric signing algorithm based on prime factorization. It's very ...


5

Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? No. The algorithm is inherent in the key. If not, how is a public key bound to a X.509 Certificate? It is not bound to the certificate, but it is part of the certificate. Presumably, you'd have to know the algorithmic choice before determine a public key,...


5

The former is correct, as verified by RFC 2986: PKCS #10: Certification Request Syntax Specification: The process by which a certification request is constructed involves the following steps: 1. A CertificationRequestInfo value containing a subject distinguished name, a subject public key, and optionally a set of attributes ...


4

This sentence is technically correct, but confusing. The CSR contains the public key. The CA does “create” a public key as an intermediate step in generating the certificate, but all it does is to copy it from the CSR, and then embed it in the certificate. It's true that the knowledge of the public key doesn't compromise the private key, but the CA never had ...


3

It is a bit oversimplified and mixed together here. We need to distinguish a few things: The CA issues a digital certificate with a digital signature to you You can use the signed digital certificate to sign other data (depending on the certificate, that can be TLS handshakes, e-mail signatures and so on). You can obtain a digital signature from a ...


3

Public keys vs signature algorithms RSA For simplicity, let's start with RSA. According to RFC 8017: 3.1. RSA Public Key For the purposes of this document, an RSA public key consists of two components: n the RSA modulus, a positive integer e the RSA public exponent, a positive integer Typical values will be like this: modulus = ...


2

The underlying protocols used for HTTPS are SSL3, TLS1.0, TLS1.1, TLS1.2, etc. Each of these have a different way of exchanging keys, so there is not a one-size fits all answer to this question. However, in symmetric encryption, the message is encrypted and decrypted using the same key. In asymmetric encryption, the message is encrypted using the public ...


2

WebAuthn essentially protects against phishing. An attacker can create a fake website (of your bank, for example) and convince you to enter your password on the fake website. Then, the attacker can freely replay it to the real website of the bank. Same applies for SMS One-Time Passwords (often used as a second factor). For instance, an attacker can ...


2

For TLS 1.3, you are limited to a few pre-selected named groups (RFC 7919) and you include the identifier of the group with your key share. See sections of the RFC. In previous versions of the protocol like TLS 1.2, the server sent the p and g together with the key share in ServerKeyExchange, again see the RFC. The server had to pick some values, either from ...


2

There are many ways that private key can be stored by the client in a web-based end-to-end encryption application. One way is not to store the key it at all, but instead, derive the key from a password. The user enters a password, then the private key is derived from the password using a key derivation function, such as PBKDF2. Another way is to use the Web ...


1

Note that it's the Authentication Service, not access service. Why wouldn't a password be capable of being a symmetric key? It just needs to be the right length. Since Kerberos doesn't require users passwords to be a certain length what actually happens is the password is passed through a key derivation function (KDF). This output is considered the user long ...


1

The seminal work of Shafi Goldwasser and Silvio Micali, Probabilistic Encryption, 1984, change the way we consider security. We no longer use/prefer/recommend non-probabilistic encryptions. For the security of the RSA encryption padding is required and there are two different paddings is definded PKCS#1v1.5 and OAEP padding, both can be found in rfc8017 ...


1

What you asking is known as Known-Plaintext Attack or in short KPA. When RSA has properly implemented the answer is NO!. Actually, the attackers don't need to capture and access the plaintext in public-key cryptography. In public-key cryptography, the encryption is free, since you know the public key of the target, that is the pair (e,n), then you can ...


1

No, that would make no sense. If a person could get the private key from encrypted data, that would be akin to locking something and leaving the key in the lock. Likewise, the decrypted message is the same - bit for bit - as the message before any encryption took place. Therefore, the message has no relation to the private key at all. A few more details ...


1

the certificate tracks a Signature hash and a Public key Hash. This is to validate the Certificate is form who ever claimed it was. while you can cross sign certificates with multiple keys I would advise against it.. it makes validation a hell. Better to use different (leaf) certificates for each key type. (and use an intermediate as the validation ...


1

Amazon has a couple of services that target this kind of use-case. Amazon KMS is a key storage platform that integrates with AWS. You can upload keys to it and have your applications sign stuff via the sign API. This keeps the actual keys off your servers. Another benefit is that it integrates with all of the security monitoring and alerting in the AWS ...


1

If the private key is compromised the whole key pair is compromised, i.e. the public key should not longer be trusted too. This means that you cannot simply change the private key but must change the whole key pair. You can still keep the old key pair though in order to deal with the old messages. But given that this key pair is considered compromised nobody ...


1

Suppose your web application needs to store your users' credit card information for automated recurring billing purposes. For PCI compliance, you might decide to offload the the storage of the credit card information to a service like Authorize.Net that stores and tokenizes the credit card information in a PCI-compliant way. However, you don't want to be ...


1

Your key exchange lacks authentication. That's why someone in a MitM position can easily establish encrypted sessions with both parties and they can't tell the difference from communicating directly with each other. With TLS it's typical that the server is authenticated using public-key cryptography with public key infrastructure (PKI), where the keys are ...


1

I need to check if the new software has been generated by a "trusted" source, ie me. This means you need a single key - your key. You embed your public key into each device. When later on you upload an update to each device, you sign the upload package with your private key. Each device verifies your signature using your public key that you have ...


1

For encrypted email, there's a few options. S/MIME (which uses the same sort of X.509 certificates used for TLS, etc.) clients typically attach the certificate to the signed message (for example, in Microsoft Outlook, this is the default behavior but it can be toggled off). For PGP / GPG (in any of its various forms), people sometimes attach their public key ...


1

Most externally signed files (such as authenticode, PDF, etc.) use embedded signed PKCS#7 container that contains signature and related data, such as signing certificate, chain, counter signatures (signed timestamps). Here is a top-level ASN.1 definition of signed PKCS#7 (RFC 2315): SignedData ::= SEQUENCE { version Version, digestAlgorithms ...


1

It's a typo. They meant to say "you can obtain a digital certificate" since the next line is talking about certificates. And the rest of the page sets up the correct understanding of how the process works. I googled the quote you provided and it appears that several small companies have copy/pasted the same basic page for themselves. It's just a ...


Only top voted, non community-wiki answers of a minimum length are eligible