Tag Info

Hot answers tagged

14

It seems we have aligned interests. I'm also a university student (although I am a math/comp sci double major) looking to pursue a career in cryptography. To that end, I have been self-studying it for a while now. So, take what I say with a grain of salt. As a forewarning, this post focuses specifically on what topics cryptographers often encounter and less ...


9

It has to do with optimizing RSA. It turns out that using the Chinese Remainder Theorem with $p$, $q$, $d\pmod{p-1}$, and $d\pmod{q-1}$ (i.e., prime1, prime2, exponent1, exponent2 from the data structure in the question) to run the decryption operation faster than if you only had $d,n$. For more information on how it is done, I found this reference ...


9

A non-random serial number does not imply, by itself, a security issue with the signature scheme, but, as @Jack points out, it can be used to leverage an attack. On a general basis, signature algorithms begin by hashing the input message with a given hash function; if the message or hashing process is fully controlled by the attacker, then collision ...


8

Predictable serial numbers were used (along with serious weaknesses in MD5) to create a rogue CA certificate in 2008. Randomizing the serial numbers would have prevented this attack. And, obviously using a sequential serial number reveals the number of certificates signed, and requires careful state management. In general I would say using a large (large ...


7

RSA is two algorithms, one for asymmetric encryption, the other for digital signatures. For asymmetric encryption, the main competitors of RSA would be: The Rabin cryptosystem ElGamal NTRUEncrypt Diffie-Hellman key exchange (in practice, key exchange is almost as good as asymmetric encryption, since most usages of asymmetric encryption are for sending a ...


7

Yes, obviously if the CA generated your private key, they might keep it and share it with anybody. Yes on both counts. In fact, the normal way to generate a certificate -- whether for a Web server (TLS) or for yourself (S/MIME or TLS client) -- is to create a "Certificate Signing Request" and send it to the CA. The CSR includes your public key, not your ...


7

Your question is only slightly ill-defined. The problem is that the word "cryptography" is horribly overloaded. I think there are at least three different regimes of cryptography: Cryptography in academia. As Reid said, academic cryptography mainly springs out of complexity theory. With very few exceptions, you don't need much math knowledge to succeed ...


6

If the KGC gets compromised it will break security, so why should a KGC generate private keys. Certificateless crypto tries to overcome the problem which exists in identity based crypto, i.e., that the KCG generates all the private keys of the users (that is necessary in IBE, see below) and thus knows all the private keys of users (which in turn enables ...


6

A lot of sleepless nights for the CA, their customers, web browser and OS developers, and Slashdot users, that's what. I don't know if a CA has ever had their private keys compromised, but there have been incidents where their systems were broken into and fraudulent certificates were issued. (There's a difference between a private key actually being taken, ...


5

Short version: SPKI links not only names, but authorizations to keys. Also, it uses a better syntax (S-expressions) than X.509 certificates. Long version: What problem does it solve? Both the traditional CA-based public-key infrastructure (PKI) and PGP's web of trust (and other similar systems) do mainly one thing: Linking names to public keys. The ...


5

This has more to do with how Microsoft decided to implemented their certificate inspection GUI, than about the actual fields of the certificate. Most signature algorithm identifiers present in contemporary certificates specify both the public key algorithm (RSA in this case) and the digest algorithm (SHA-1 in this case). The identifier "sha1RSA" is most ...


5

If the CA issued something with a CSR as the dominant part of the To-Be-Signed field, it wouldn't be a X.509 certificate and hardly any existing software would know what to do with it. I guess the original CSR could be added as an extension, though. Therefore, I suppose you are really asking why the X.509 certificate format wasn't originally specified to ...


4

The "Common Name" is part of a X.500 name; here, the one called "SubjectDN", which designates the owner of the public key which is contained in the certificate. That name is part of the certificate, in the part which is covered by the signature; as such, it is exactly as trustworthy as any other element in the certificate.


4

The answer is simple: The original signature of a CSR is not needed in a signed certificate issued by a CA. If a CA does somthing wrong (e.g. change attributes of the CSR), the CSR creator doesn't have to use the cert (since he's the only holder of the private key, he is also the only one who could use it -> create signatures).


4

If all the components share the same certificate, then they share the same private key. This raises the two following points: When a secret is shared by more than two people, can it still be considered really secret ? Secrecy dilutes fairly fast. If all components share the same secret value, then breakage of any single component reveals the private keys ...


4

That's correct. If this happens, then your PKI is doomed and you have to set it up again and roll out all the certificates again. Actually, then not all the certificates are "compromised" in the sense of key compromise, but you cannot longer trust them, since if someone is in possession of the root private key, this person can issue arbitratrily dated ...


4

If you use public key crypto in the correct way, then every user has it's own private key and corresponding public key (included in the certificate) and the keys of users are not related. Consequently, compromising the private key of one user does not affect any of the other users. So in the case of compromise of the private key of one user the remaining ...


4

To answer this question, we must have a look at how TLS/SSL works. I guess you know that the aim of TLS/SSL is to authenticate communicating parties before setting up an encrypted connection through which application data will flow. And as you may already know, an SSL handshake/session will use asymmetric crypto for authentication and session setup and ...


3

You've stumbled on the requirement for authentication. Recall that signature schemes have a private key and a public key. The private key is used to sign the document in question, and the public key is given to the verifying party so that they can verify that the signature is correct. You're correct that it is possible to strip a digital signature and ...


3

To sign a message $M$ under RSA, one should NOT build the signature as $\mathcal{Sign}(M)=M^d\bmod N$, for several reasons: either that limits to messages $M$ in range $[0..N-1]$, or that allows forgeries of the form $\hat M=M+k\cdot N$, because $\mathcal{Sign}(\hat M)=\mathcal{Sign}(M)$; that allows forgeries of the form $\hat M=R^e\cdot\prod{M_j}^{a_j}$ ...


3

Such certificates are basically just an implementation of digital signatures. One certificate is used to sign the data using a private key, and a corresponding verification certificate is given to the user along with the signature and the data. The user uses the verification certificate to verify that the file matches its signature. You can't reverse ...


3

Quote from http://www.digi-sign.com/node/10922 All Types of Digital Certificates Are Also a X509 Certificate A X509 certificate *refers to all types of digital certificates, regardless of how they are utilized, and implies the current standardization used to design and create digital certificates. This standardization recognizes that the ...


3

Although x.509 is the standard for PKIs with CAs, different certificate formats have been defined for the other 2 major PKI approaches: SPKI has defined its own certificate format , still (forever?) in draft status. Web-of-Trust models usually use the OpenPGP certificate format defined in RFC2440 RFC4212 "Alternative Certificate Formats for the ...


2

In Theory In theory, either method works and has its advantages and disadvantages. Sending the entire chain up to the root means the other party (e.g., web browser) has everything they need to do the validation. A disadvantage is that more bandwidth is used. Sending only the one certificate could yield better bandwidth usage (the verifying party still has ...


2

There was a post on security.stackexchange last week about this. SSL/TLS with Certificate Authorities for all intents and purposes is now completely insecure from governments and any organisation who has a CA pre-trusted inside the standard web browsers. DNSSEC will also fall under the same scenario because at the top level you have a particular government ...


2

I am a master's student in cryptography, and I have had a few summers worth of experience in applied cryptography. Cryptography is a broad field, and there are many aspects to it. If you are looking at cryptography in academia, I would definitely recommend having a strong background in mathematics and computer science, and as strong a ...


2

The revocation status of a certificate is application depended, meaning that if the application under which you perform the encryption or decryption does not check for revocation status with the CA, then you may still proceed and encrypt or decrypt the message. You should consider the loss of a private key of a certificate as a loss of your password in a ...


2

If you can put the entire PGP certificate in a proprietary non-critical extension then you don't need to find the PGP certificate in a store. This solution depends on the condition that you are able to create your own OID and insert the PGP certificate in the extension. Furthermore, the server should accept such a certificate and contain methods of ...


2

I still got the impression that you did not really have read my answer to a related question. But still, I try to briefly answer your questions here. First of all, private key extraction essentially means private key generation. Extraction, because the partial private key ($D_A$) is generated with repsect to an identity string $ID_A$ uniquely identifying ...


2

That depends on the concrete CRL. As long as you have access to your private key, you can sign the revocation request. This prevents anyone without access to the private key from issuing a faked revocation request. With access to the private key, a faked revocation request can be sent. But in this case the damage is already done, and a revocation is ...



Only top voted, non community-wiki answers of a minimum length are eligible