Tag Info

New answers tagged

0

The whole point of public key cryptography is that there is a secret key, which, if the system is to be any good, cannot be easily computed from the public key, but is known to the legitimate owner of the public (i.e. the one who generated and published it). And decryption uses the secret key, not the public one. Encryption only uses the public key. But ...


0

WITHDRAWN Bren2010's solution is a good one if you can choose your crypto primitives. However, if you're looking for a solution that uses stuff supported by existing X.509 implementations, you could issue the child CA a ECDSA key and a list of pre-approved nonces. A single re-use of a nonce is enough to allow the child CA key to be calculated, so the child ...


2

In short: The parent CA would sign the public key of an n-time signature scheme, as opposed to the public key of a signature scheme which is valid for an unbounded number of signatures (the current design). n-time signature schemes are usually just constructed by generating n instances of a one-time signature scheme and then accumulating their public keys ...


1

That scheme is effectively the same as having the parent CA counter-sign all issued certificates, since the parent will have to make a new signature (on a new accumulator) for each newly issued certificate. What are the features you want from such a scheme? To frame the question, here's a trivial scheme: client sends certificate request to child "CA"; ...


0

In a typical X.509 PKI implementation, the CA is somewhat heavyweight. Far more than just a special CA certification, running a CA typically implies running a web service to service certificate requests, perhaps an OCSP responder, publishing CRLs regularly, perhaps an SCEP server... This heavyweight notion works well for large enterprises, but somewhat less ...


0

In short, they retrieve the entropy directly from a source on the chip. From Wikipedia: In computing, a hardware random number generator (TRNG, True Random Number Generator) is an apparatus that generates random numbers from a physical process, rather than a computer program. Such devices are often based on microscopic phenomena that generate low-level, ...


1

This is a very interesting question, in the sense that every smart card provider claims the inviolability of its own process. Nowadays, Smart cards can generate their cryptographic keys on the card itself using appropriate hardware. Entropy is generally generated by an embedded random generator. The hardware of the generator is generally certified by ...



Top 50 recent answers are included