0
$\begingroup$

X.509 has a structure which contains information like version number, serial number, signature algorithm, issuer, subject name, subject public key, signature of the issuer etc.

However, I'm having an argument between friends because according to them, the public key is the heart of the certificate.

On the other hand, I think issuer's signature (CA) is the most important attribute. This is because basically you can't do anything without having a valid certificate, whereas if public key for some reason is missing, I still think you can digitally sign documents (since it uses private key and not the public one).

Certificate here comes handy because you need the subject's name (signed by [email protected]") which you can access since you have a valid cert. If you don't have the CA's signature, you can't even digitally sign.

I need to know which is the right answer. Thanks!

Improve this question
$\endgroup$
4
  • 7
    $\begingroup$ What is the most important piece of a car? $\endgroup$
    – fgrieu ♦
    Commented Jun 18, 2017 at 13:46
  • 2
    $\begingroup$ (X.509) certs are the central part of a Public Key Infrastructure. 'nough said. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 18, 2017 at 14:05
  • $\begingroup$ The purpose of a certificate is to bind a public key to an identity: those are the two crucial components. $\endgroup$
    – gardenhead
    Commented Jun 18, 2017 at 19:12
  • 1
    $\begingroup$ @fgrieu My driving instructor used to ask that. The correct answer was: the brakes. $\endgroup$
    – not2savvy
    Commented May 19, 2021 at 9:18

2 Answers 2

Reset to default
6
$\begingroup$

As fgrieu says in his comment, the answer to this question is ambiguous; it depends on what you use the certificate for.

You can perfectly trust a certificate, without having a CA signature. A CA signature only signifies that whoever trusts the CA, will also trust your certificate.

The public key however is the way with which the owner of the certificate and key will identify their self with. Therefore, I would say that the public key is more important, because a certificate is useless without it.

This is because basically you can't do anything without having a valid certificate, whereas if public key for some reason is missing, I still think you can digitally sign documents (since it uses private key and not the public one).

Without the public key, nobody will be able to verify your signature, so your signature might as well be random noise.

I need to know which is the right answer. Thanks!

As I said, there is no "right" answer here; apart from that you actually need a public key to be in there.

Improve this answer
$\endgroup$
0
1
$\begingroup$

The public key and private key are equally essential and indispensable. The private key is necessary to sign, and the public key is necessary to verify the signature. All the other information could be made redundant or superseded if the relying party

  • meets in person with the signer,
  • verifies the signer's identity through personal recognition, an introduction by a reliable person, or examination of the signer's ID cards and
  • the signer verifies his or her public key.

Although inconvenient, the certificate verified this way will be useful for documents signed after the in-person meeting.

Improve this answer
$\endgroup$
1
  • 3
    $\begingroup$ "The public key and private key are equally essential and indispensable." There is no private key in a X.509 certificate; a X.509 certificate is a public key certificate. $\endgroup$
    – Ruben De Smet
    Commented Jun 18, 2017 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.