Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now
34

CA A revokes CA B, does certificate C become invalid? Yes, revocation cascades down to the tree. If CA certificate is revoked, all certificates below (regardless of how many levels are below CA) are implicitly considered untrusted. Keep in mind that they become *untrusted*, not revoked. CA A gets revoked (somehow), does its revocation cascade all the way ...


9

"It depends". The most secure answer is "yes, it revokes the subtree", because once the "B" certificate has been revoked there's no reason to trust any certificate it claims to have issued (or any CRL it has signed, et cetera). But it really depends on what inputs are given to the chain builder (which means it won't be consistent from application to ...


2

For RSA and 'dss' hostkey pkalgs yes the server uses whatever key size it has; in general a client can fail the handshake if it considers the hostkey too small or otherwise cryptographically unsatisfactory, although I don't know any that does. (Whereas of course most do reject a hostkey that mismatches the pre-configured or previously-accepted one.) For ...


2

I'm coming from the assumption that you don't leave any backdoor open in either of the methods, and choose high-entropy passwords for Basic Auth. In that case, the biggest difference between the methods is that HTTPS will encrypt the traffic and prevent Man-in-the-Middle Attacks, making it impossible for anyone to eavesdrop, whereas Basic Auth will not. So ...


2

You can implement this scheme by doing the following: 1.1) Create a key pair. 1.2) Sign the key pair using your private key. 1.3) For each subordinate, encrypt the key pair using the subordinate's public key, and send the encrypted key pair to the subordinate along with the signature that you created in step 1.2. Note, you are sending the same key ...


1

if I understood that correctly, you are looking for something which can be achieved via anonymous signature schemes, group signature schemes or ring signature schemes. There's work to make known signature schemes anonymous (see Yang-Wong-Deng-Wang, PKC’06 / https://eprint.iacr.org/2005/407.pdf). The main difference between group and ring signature schemes ...


1

My guess would be that you are trying to use an ECC key (or subkey). The version of gnupg that comes with Amazon Linux is too old to support ECC cryptography. If you look at the output of gpg --list-key 40BXFE61, you can check for any pub or sub entries that have cv25519 or nistp256 in them, e.g.: pub rsa4096/E63EDCA9329DD07E 2011-11-07 [SC] ...


Only top voted, non community-wiki answers of a minimum length are eligible