Questions tagged [certificates]
A certificate consists of a public key and information about the owner (e. g. the name of a person or server).
248
questions
0
votes
1answer
54 views
Authentication of certificates
In order to provide authenticity of a sent message, we use certificates as fingerprints. But how do I know that the certificate is not stolen by someone? If the certificates are made public, why cant ...
0
votes
0answers
36 views
Is it possible to extract a signature from a HTTPS webpage?
Let's say I want to prove to someone that a webpage claims X. I could take a screenshot, but it could easily be doctored. However, the webpage's contents are encrypted by the domain using its private ...
-1
votes
0answers
25 views
How to mirror a CT log and ensure its integrity
What is the best approach to mirror CT logs and ensure the integrity of the entries?
Are individual entries for a domain signed? Or is the whole log for a certain time period signed?
When the machine ...
0
votes
0answers
14 views
HPKP on OS or library level
Among the major operating systems (Windows, MacOS, Linux) or common TLS libraries (Schannel, openssl, boringssl) is their any way to pin certificates on a global level?
So not just per application but ...
1
vote
1answer
32 views
What is Cross signing of root certificates and how does it help at time of root certificate expiry?
I got to know that Root CA's are cross signed so that at the time of certificate expiry, there are no outages. However, I am unable to find any good docs explaining how cross signing works and how it ...
0
votes
0answers
39 views
certificate authority
hi guys,
is there a pseudonym in the certificate ? , I read papers that use the certificate authority, and between the components of the certificate, there is a pseudonym.
0
votes
1answer
40 views
Can I use a certificate authority with Elgamal encryption?
Can I use a certificate authority with Elgamal encryption? Is this type of keys in CA?
0
votes
1answer
29 views
Are end-entity certificates without basic constraints extension vulnerable?
Public certificate authorities seem to always include the basic constraints extension. Why is this a best practice? What is the risk for a PKI to issuing end-entity certificates that don't have ‘...
1
vote
2answers
169 views
Samsung .Cert File - Digging deeper
I don't know if I should ask this question in Android Stackexchange or here, but I am sure I am in a right place to ask.
My question is about following Samsung Certificate file:
File name: ...
1
vote
1answer
23 views
How to determine curve's field size in a ECDSA Signature
There is a bug in some firmware I'm working that states the following:
If individual coordinates are shorter or longer than the curve’s field size they are processed incorrectly.
So I can get the ...
0
votes
1answer
35 views
Required certificate key usage for signing document
What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc...
I am going to create a self-signed certificate that is needed to sign those documents. I ...
6
votes
2answers
2k views
Do certificates need to be stored as encrypted?
The titles says most of what we're confused with. Here's some details:
On an embedded device, we have a microcontroller and external flash memory. This memory can be easily read and written to in ...
0
votes
2answers
82 views
Automatic csr sending
In our project we have grpc server and clients which should satisfy mutual tls. So, there is CA and clients generate csr to sent to CA to signing it. Now I need to send csr manually to CA to sign it ...
0
votes
0answers
39 views
What is the difference of having to use a ca.crt to verify a signed file vs the .crt used to sign it?
This seemed like the most appropriate place to ask this question so here it goes:
I used to run a process that automatically generated a shim.key and ...
0
votes
0answers
38 views
Best model for client software encryption / decryption
I would like to develop a small solution (c#) that must secure data exchange with an untrusted server.
The model is that this software will run on a Windows client then Encrypt data before pushing it ...
0
votes
0answers
32 views
Any (proposed) internet standard (RFC) for trusted hosting of signed documents?
There's a problem with digitally signed documents - in particular that any print-out of them will be only a copy, not an original (by print-out I mean the print-out of the human readable form of the ...
1
vote
1answer
62 views
Different encryption standards and how they relate to auth and algorithms
The main confusion I have is around the different PKCS and relation with SSL (TLS). I have done a lot of research and have found bits and pieces but not necessarily how these relate, so let me explain ...
5
votes
2answers
463 views
Clarification on the TLS verification process
I am reading this article in my attempt to understand how the TLS verification and chain of trust works. In the piece I come across a section that I am not sure I understand.
In the simplified ...
1
vote
2answers
2k views
What exactly is Let's encrypts chain.pem file?
While trying to understand the use or meaning of the fullchain.pem file created by let's encrypt I stumbled upon this post in which ...
0
votes
3answers
69 views
What are the contents of a certificate and how can I view it?
I understand on a conceptual level that a certificate is nothing more than just a verified public key. The next question I have, is how exactly do I see the contents of a certificate? Apart from the ...
0
votes
0answers
27 views
CMS encryption application using Windows system certificate store
Hy!
I'm looking for an application, which can make cms encryption/decryption, but with the use of the windows certificate store.
I already found out, that openssl can't do it out of the box (just by ...
0
votes
0answers
31 views
How is the identitiy of a subject in a Public Key Certificate verified by the Certificate Authority (CA)?
A general digital certificate issued by a CA might contain information about the individual/organization to whom the certificate belongs. As an example, consider this sample scenario:
This PKC ...
0
votes
1answer
43 views
Where can I read about DER certificate structure - fields and its registered values?
Where is an official documentation for ASN1 structure and values of x509 certs?
Using OpenSSL command like openssl asn1parse -in server.der -inform DER I can see ...
0
votes
0answers
23 views
data transferred when certificates are used
I tried to find some information about how certificates work on a technical level but wasn't really able to find something that answered all my questions.
Can one explain which data is transferred ...
3
votes
1answer
87 views
Allowed key types in an SSL certificate
What are the valid key types which can get signed (or generated and signed) by a CA to constitute an SSL certificate?
For the keys used in TLS, the key types I have seen are RSA and EC. Anything else?
...
2
votes
0answers
52 views
How to prove document ownership at a specific time [duplicate]
Problem
Given any piece of data, I could sign it with public key and made available online. This proves I am in possession of given data, but it doesn't tell I am the creator. The only possibility (I'...
2
votes
2answers
545 views
openSSL created CSR signature size of 73 bytes but should't it be 70 bytes
after creating CSR using openSSL with secp256r1 curve
inspecting the file using openssl asn1parse -i -in ecTest.csr
the size of ...
12
votes
3answers
4k views
Smallest possible certificate for IoT device
I'm developing an IoT system that uses small nodes connected through RF. This allows messages under 250 bytes long. You can check it at https://github.com/gmag11/EnigmaIOT.
All messages are encrypted ...
0
votes
0answers
125 views
What's the meaning of cached certificate revocation list and online certificate revocation list in X509RevocationMode Enum?
In this article, there are cached certificate revocation list and online certificate revocation list terms used.
I tried to find ...
4
votes
0answers
525 views
RSASSA-PSS in TLS 1.2
I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3.
But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2?
Is it possible to use ...
1
vote
1answer
6k views
Difference Between PEM vs P12 vs CRT vs JKS vs keystore vs PKCS vs x509 certificates [duplicate]
Sorry noob here. I am so much confused about lot of files used client authentication certificates. Can anyone guide me on the difference between PEM vs P12 vs CRT vs JKS vs Keystore vs PKCS vs x509 ...
2
votes
0answers
52 views
Detecting revoked keys long after a document is signed
Scenario: A document is signed with a compromised private key, with a long-term time stamp. The normal expiration date of the key pair is D. The rightful owner of the key pair discovers the compromise ...
3
votes
1answer
158 views
Manually creating a GPG Public Key
I want to manually create a GPG public key that can be imported into GPG, i.e. I want to create a file with a Public-Key Packet, a User ID Packet and a Signature Packet (for an example see here). I ...
1
vote
0answers
99 views
Generate version 3 x509 certificate from version 1 CA
Please do forgive me for my naivety. I have inherited a legacy system wherein the CA which signs the certificate is of version 1. Is it possible to generate a x509 version 3 certificate which is ...
0
votes
1answer
74 views
What if the CSR is intercepted in transit while sending it to CA?
I was studying PKI the other day and I had a serious thinking about the following question.
What is CSR? - It is a block of encoded text that is given to the CA when applying for an SSL certificate ...
1
vote
0answers
115 views
is it possible to achieve authenticated key agreement without using PKI or pre-shared secret?
After reading different techniques to achieve authenticated key-agreement (X3DH, HMQV, Asynchronous Ratcheting tree, An efficient protocol for authenticated key agreement, I understood that all these ...
0
votes
1answer
95 views
OpenSSL - What Data Is Used To Create A Certificate's Digital Signature?
I am coming up-to-speed on OpenSSL certificates. In all of my research I see where "data" is hashed to create a hash value that is used as the basis for a certificate's digital signature. This hash ...
1
vote
1answer
225 views
How message digest hash is used in RSA digital certificate verification
This is how I understand digital signature verification to work in general:
Plaintext gets run through a hashing mechanism to make a message digest (IBM's terminology, there appear to be plenty of ...
1
vote
1answer
171 views
How to compute certificates using Diffie-Hellman key exchange with certificates and Elgamal signature scheme
We consider the Diffie–Hellman key exchange scheme with certificates. We have a system with the three users Alice, Bob and Charley. The Diffie–Hellman algorithm uses p = 61 and α = 18. The three ...
1
vote
0answers
58 views
Review: peer-to-peer encrypted communication
I'd like to ask you to review security of the following communication scheme:
network is strictly P2P, based on DHT (peer discovery)
root user can create a virtual private network (network private ...
1
vote
1answer
30 views
Is a Qualified Digital Certificate backward compatible with existing certificate code?
I'm trying to determine if our digital signature generation code will work without change using a European Qualified Digital Certificate in place of the RSA signing certificate that we normally use.
...
1
vote
0answers
45 views
Sorted merkle tree versus rsa accumulator
When compared to sorted merkle tree and rsa accumulator, which one is the best? Rsa accumulator has constant proof and it adds/deletes at constant cost. What is the verification cost for rsa ...
2
votes
0answers
60 views
Rsa accumulator storage size
Rsa accumulator's storage complexity is known as O(1). However, how can i calculate size of accumulator value in byte?
1
vote
0answers
230 views
certificate revocation list file size
Crl files are growing linearly. I wonder with 10 revoked certificate, what is the storage size of crl file and so on. For every revoke certificate, how much increase the size of the crl?
1
vote
1answer
96 views
X.509 ECDSA signature field in DER format includes '00' between bit string and sequence of r and s
I created a X.509 certificate with ECDSAwithSHA256(OID=1.2.840.10045.4.3.2) by openssl.
ECC parameter is secp256r1.
Following is the signatureAlgorithm and signatureValue.
...
0
votes
0answers
37 views
Implementing ESignature and digital certificate
I'm having some issue understanding the mechanism of electronic signature and how implementing it
Here what I understood, correct me if I'm wrong:
(Client is here an android or ios device. Server ...
3
votes
1answer
52 views
Enforce weak RSA in TLS
I'm going to give a small talk on the mathematical background of RSA. My audience will consist mostly of software engineers and to make the mathematical stuff tangible, I wanted to demonstrate how to ...
2
votes
1answer
5k views
PKCS12 password of container and private key
As I understand pkcs12 defines a container structure that can hold both a certificate and one or more private keys.
...
1
vote
0answers
32 views
Keeping a backup of asymmetric keys with the help of a certificate authority without losing the privacy
First I'll explain the problem, then I will also give a solution(it might be wrong) I've found for it, you let me know what you think about this solution and whether you have a better one.
Assume a ...
0
votes
1answer
53 views
How is a digital certificate generated?
I understand that the role of a Certificate Authority is to SIGN (not encrypt) a certificate. The signed certificate will theoretically contain:
Plain text of data, including the server's public key
...
Hot Network Questions
- Is the Magnus Lie algebra of a finitely presented group finitely presented
- Is it legal to write a software license if I'm not a licensed attorney?
- What does `\a` do?
- What is the point of moving a fallen PC in the initiative order?
- 2-of-3 multisig with Schnorr signatures
- Movie where a boy finds a talking alien powersuit and gets inside
- Is there a Latin translation of the Epic of Gilgamesh?
- The meaning of "for a million bucks" in this sentence
- I was popular in the 1970s
- Sleeping in unheated outbuilding for a prolonged period
- Does "vulnerability to piercing damage" from the Wild Magic table travel with the sorcerer?
- How would I know to use #1 versus ##1 in the function used in \seq_set_map?
- Atypical use of Sylow?
- Name for this ILP problem type
- A question regarding commutators in quantum mechanics
- How to characterize decoupling circuits?
- What led Guderian as far south as Gomel, in August, 1941?
- Which trees have their roots grow vertically with limited horizontal growth?
- Right angle between two lines
- What is an "octet" in the context of NASA's LunaNET Interoperability Standard? ("internet on the Moon")
- What ship class is the US Archimedes?
- Was the music used in the "You wouldn't steal a car" advertisements pirated?
- What are the names of these two sci-fi writers?
- Place of arrival when travelling to UK via connecting flights?