New answers tagged public-key-infrastructure
0
@MechMK1 is absolutely correct. You are looking for a technical solution to a problem of policy, which is rarely something you want even if you can make it happen. I'd also think long and hard about why you feel that policy is necessary; there are a lot of bad reasons I can think of, and only a few good ones. After all, a VPN is a layer-3 solution, best ...
0
You can’t. As long as your VPN needs to be usable there is no feasible way to constrain it like that. As long as the profile or data exists on a disk that can be read and decrypted externally or in between boot stages no method will protect you.
The closest you might get is a firmware-to-OS level of MDM on company hardware, but that is basically exclusive ...
0
@gowenfawr's answer is correct, but I'd also like to chime in with a couple interesting ideas. Cloud providers are coming out with instances that do just what you need.
https://azure.microsoft.com/en-us/solutions/confidential-compute/
https://aws.amazon.com/cloudhsm/
These platforms leverage HSMs to safeguard data in-memory in hardware that encrypts its ...
2
What's the best method/solution for protecting the integrity and identity of end-user certs?
Install an HSM on their devices and use keys stored within it for VPN. Expensive and difficult to set up.
I want to make sure that users only able to use VPN with company provided devices.
Then instead of trying to control the keys, which is difficult, use VPN ...
1
Browsers will alert the user if they are presented with a self-signed certificate which they don't trust.
The browser user or system administrator should preempts this scenario and add the self-signed certificate to the browser's trust-anchor store beforehand. That way, the user won't see a warning.
Done this way, users can be informed that if they ever ...
2
Browsers will only accept an invalid certificate - and self-signed is one form of "invalid" - when the user acknowledges the risk and overrides the browser. The specific steps for doing so vary from browser to browser, but they're usually onerous by design - they want the decision to bypass security to be hard, not easy.
0
Reasons to use symmetric encryption in your case:
It is way faster then asymmetric encryption
Asymmetric encryption is quite expensive when it comes to computing time.
You already have everything in place to use symmetric encryption.
You are distributing Private Keys anyway so why not just distribute a symmetric key.
Asymmetric encryption is not well ...
3
Yes, there's a reason; public key encryption is very slow and CPU-intensive, and not at all suitable for encrypting chat data, which may well include images, audio or video as well as text. That's why wherever it's used, it's only used to transmit a shared symmetric encryption key which is then used to encrypt the actual content. But in any case, it's never ...
Top 50 recent answers are included
