0
$\begingroup$

Where can we find the cryptosystems used to generate public key certificate? Are the cryptosystems under the signature algorithm and signature hash algorithm? Do I need to analyze the packets trasmitted between my computer and the server? For example, ciphersuite.

Suppose the following ciphersuites are transmitted from ClientHello to the server.

- TLS_RSA_WITH_AES_128_CBC_SHA256           (0x003c)   
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256     (0xc027)   
- TLS_ECDHE_ECDSA _WITH_AES_128_GCM_SHA256  (0xc02b)
- TLS_DHE_DSS_WITH_AES_128_CBC_SHA256       (0xc040)
- TLS_RSA_ WITH_RC4_128_MD5                 (0xc004)

Can I say that the cryptosystems used to protect the communication between my computer and the server are RSA, ECDHE_RSA, ECDHE_ECDSA and DHE_DSS?

Improve this question
$\endgroup$
3
  • $\begingroup$ The question might not ask what you really mean, but in it's current form the answer is no. RSA, ECDHE_RSA, ECDHE_ECDSA and DHE_DSS are what's been used for the key exchange phase. For any authentication to happen a certificate needs to already have been generated. For example during RSA key exchange, secrets generated are encrypted with an RSA public key and the public key is checked to belong to the other party by verifying a certificate provided by a CA. $\endgroup$
    – Edvard Fagerholm
    Nov 4, 2014 at 7:25
  • $\begingroup$ Then may i know where can I obtain the cryptosystems used to generate certificate? $\endgroup$
    – Idonknow
    Nov 5, 2014 at 2:45
  • $\begingroup$ Either you have generated your public/secret key in your computer with your software and a CA sign your public key or a CA generates your public/secret key and further signs your public key. I think you are talking for the latter. $\endgroup$
    – 111
    Feb 6, 2015 at 9:13

2 Answers 2

Reset to default
1
$\begingroup$

The ciphersuites only define the properties of the SSL channel that is to be created. The certificate - including the private key usage indicated in the certificate - should be consistent with the ciphersuite.

For instance if you have a ciphersuite starting with TLS_RSA then the certificate should allow encryption, and the public/private key should be RSA of course. If you have a TLS_DHE or TLS_ECDHE ciphersuite then the certificate should allow authentication with any supported authentication algorithm. Authentication is generally supported by the certificate of course, as that is the main use case for TLS certificates in the first place.

How the certificate was generated is outside the realm of TLS. Basically it doesn't care, as long as you can create a trust chain to a trusted certificate in the certificate store. For this it does need to be able to verify signatures though, so the algorithms used to sign certificates need to be supported.

Improve this answer
$\endgroup$
0
$\begingroup$

The certificate is simply a file containing your public key (RSA or DSA) together with some information on e.g. how the public key is allowed to be used (for example only to authenticate a TLS connection to foo.yourdomain.com). Additionally, the file has been signed using either an RSA, DSA or ECDSA signature. Therefore, you should look up RSA/DSA/ECDSA signatures.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.