Questions tagged [certificates]
A certificate consists of a public key and information about the owner (e. g. the name of a person or server).
227
questions
0
votes
0answers
20 views
Issue with X509 login certificates
We issued about 5000 user login certificates while on a single node platform. These certificates have
...
2
votes
2answers
459 views
openSSL created CSR signature size of 73 bytes but should't it be 70 bytes
after creating CSR using openSSL with secp256r1 curve
inspecting the file using openssl asn1parse -i -in ecTest.csr
the size of ...
12
votes
3answers
4k views
Smallest possible certificate for IoT device
I'm developing an IoT system that uses small nodes connected through RF. This allows messages under 250 bytes long. You can check it at https://github.com/gmag11/EnigmaIOT.
All messages are encrypted ...
0
votes
0answers
25 views
What's the meaning of cached certificate revocation list and online certificate revocation list in X509RevocationMode Enum?
In this article, there are cached certificate revocation list and online certificate revocation list terms used.
I tried to find ...
4
votes
0answers
108 views
RSASSA-PSS in TLS 1.2
I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3.
But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2?
Is it possible to use ...
0
votes
1answer
458 views
Difference Between PEM vs P12 vs CRT vs JKS vs keystore vs PKCS vs x509 certificates [duplicate]
Sorry noob here. I am so much confused about lot of files used client authentication certificates. Can anyone guide me on the difference between PEM vs P12 vs CRT vs JKS vs Keystore vs PKCS vs x509 ...
2
votes
0answers
46 views
Detecting revoked keys long after a document is signed
Scenario: A document is signed with a compromised private key, with a long-term time stamp. The normal expiration date of the key pair is D. The rightful owner of the key pair discovers the compromise ...
3
votes
1answer
104 views
Manually creating a GPG Public Key
I want to manually create a GPG public key that can be imported into GPG, i.e. I want to create a file with a Public-Key Packet, a User ID Packet and a Signature Packet (for an example see here). I ...
0
votes
0answers
22 views
Generate version 3 x509 certificate from version 1 CA
Please do forgive me for my naivety. I have inherited a legacy system wherein the CA which signs the certificate is of version 1. Is it possible to generate a x509 version 3 certificate which is ...
0
votes
1answer
45 views
What if the CSR is intercepted in transit while sending it to CA?
I was studying PKI the other day and I had a serious thinking about the following question.
What is CSR? - It is a block of encoded text that is given to the CA when applying for an SSL certificate ...
0
votes
0answers
18 views
Digital signature from hashing encrypted webpage
I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...
1
vote
0answers
74 views
is it possible to achieve authenticated key agreement without using PKI or pre-shared secret?
After reading different techniques to achieve authenticated key-agreement (X3DH, HMQV, Asynchronous Ratcheting tree, An efficient protocol for authenticated key agreement, I understood that all these ...
0
votes
1answer
54 views
OpenSSL - What Data Is Used To Create A Certificate's Digital Signature?
I am coming up-to-speed on OpenSSL certificates. In all of my research I see where "data" is hashed to create a hash value that is used as the basis for a certificate's digital signature. This hash ...
0
votes
0answers
9 views
Extract Certificates from Package File on Mac
I would like to manually verify the certificate chain on a package from my MacOS Catalina. I know that you can use the codesign --extract-certificates to extract certificates from applications, but I ...
1
vote
1answer
86 views
How message digest hash is used in RSA digital certificate verification
This is how I understand digital signature verification to work in general:
Plaintext gets run through a hashing mechanism to make a message digest (IBM's terminology, there appear to be plenty of ...
1
vote
1answer
77 views
How to compute certificates using Diffie-Hellman key exchange with certificates and Elgamal signature scheme
We consider the Diffie–Hellman key exchange scheme with certificates. We have a system with the three users Alice, Bob and Charley. The Diffie–Hellman algorithm uses p = 61 and α = 18. The three ...
1
vote
0answers
45 views
Review: peer-to-peer encrypted communication
I'd like to ask you to review security of the following communication scheme:
network is strictly P2P, based on DHT (peer discovery)
root user can create a virtual private network (network private ...
1
vote
1answer
23 views
Is a Qualified Digital Certificate backward compatible with existing certificate code?
I'm trying to determine if our digital signature generation code will work without change using a European Qualified Digital Certificate in place of the RSA signing certificate that we normally use.
...
1
vote
0answers
23 views
Sorted merkle tree versus rsa accumulator
When compared to sorted merkle tree and rsa accumulator, which one is the best? Rsa accumulator has constant proof and it adds/deletes at constant cost. What is the verification cost for rsa ...
0
votes
0answers
16 views
Rsa accumulator verification cost gor nonmembership testing
What is the verification cost of rsa accumulator gor non-membership testing. Is it O(N) or O(1). Can somebody explain it to me?
0
votes
0answers
16 views
Merkle tree verification cost calculation
I am trying to understand how to calculate verification cost of sorted merkle tree in case of exclusion proof. For example 5 revoked certificate are kept in merkle tree. How can i calculate storage ...
2
votes
0answers
35 views
Rsa accumulator storage size
Rsa accumulator's storage complexity is known as O(1). However, how can i calculate size of accumulator value in byte?
1
vote
0answers
46 views
certificate revocation list file size
Crl files are growing linearly. I wonder with 10 revoked certificate, what is the storage size of crl file and so on. For every revoke certificate, how much increase the size of the crl?
1
vote
1answer
41 views
X.509 ECDSA signature field in DER format includes '00' between bit string and sequence of r and s
I created a X.509 certificate with ECDSAwithSHA256(OID=1.2.840.10045.4.3.2) by openssl.
ECC parameter is secp256r1.
Following is the signatureAlgorithm and signatureValue.
...
0
votes
0answers
28 views
Implementing ESignature and digital certificate
I'm having some issue understanding the mechanism of electronic signature and how implementing it
Here what I understood, correct me if I'm wrong:
(Client is here an android or ios device. Server ...
2
votes
1answer
43 views
Enforce weak RSA in TLS
I'm going to give a small talk on the mathematical background of RSA. My audience will consist mostly of software engineers and to make the mathematical stuff tangible, I wanted to demonstrate how to ...
2
votes
1answer
1k views
PKCS12 password of container and private key
As I understand pkcs12 defines a container structure that can hold both a certificate and one or more private keys.
...
1
vote
0answers
29 views
Keeping a backup of asymmetric keys with the help of a certificate authority without losing the privacy
First I'll explain the problem, then I will also give a solution(it might be wrong) I've found for it, you let me know what you think about this solution and whether you have a better one.
Assume a ...
0
votes
1answer
46 views
How is a digital certificate generated?
I understand that the role of a Certificate Authority is to SIGN (not encrypt) a certificate. The signed certificate will theoretically contain:
Plain text of data, including the server's public key
...
74
votes
12answers
15k views
Who verifies the trust of certificate authorities?
Background
I am a novice in the field of cryptography and cyber-security, and while studying asymmetric-key encryption, I learned about the potential of a man-in-the-middle attack.
To mitigate this ...
0
votes
0answers
28 views
Will CT (Certificate Transparency) override the use of CAA and/or DANE/TLSA records?
I'd want to know if some of these competing technologies has more chance to survive. It seems they are thought to solve a similar problem by different manners and I'd want to stick to the most ...
0
votes
0answers
68 views
How does DHE-RSA work and why is PFS guaranteed?
How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.
0
votes
1answer
127 views
Create self signed certificate from modulus, private and public exponents of RSA
I have the values of RSA public exponent $e$, the secret exponent $d$ and the modulus $n$.
How can I create (for example using openssl) a self-signed certificate using the RSA key $(n,d), (n,e)$? Is ...
0
votes
0answers
110 views
How to validate the authenticity and integrity of an XML document?
I am working on a C++ desktop application that reads an XML (also created by my org) from a public server (does not require authentication). I would like to make sure that the downloaded XML has not ...
0
votes
1answer
70 views
Observing cipher suites and certificate algorithms without man-in-the-middle
I manage a proxy server. Is it technically possible to observe and determine which cipher suite is selected between end points (client and server) without changing their SSL certificate, without ...
-2
votes
1answer
98 views
Why do we need HMAC?
AFAIK, HMAC solves the collision problem of hash algorithms by mixing in a pre shared secret.
Can't we just use the pre shared secret to symmetrically encrypt data and leave out the hashing?
2
votes
1answer
1k views
How android apk file signing works?
There are a number of pages on web to tell how to sign apk file for Android. But none I've found telling how it works under-the-...
1
vote
1answer
53 views
Is this pairing scheme for establishing trust between two devices with self-signed TLS certs secure from MITM?
Assume two devices (A and B) with self-signed TLS certificates (this part can't change). We want these devices to trust each other.
One way to do this is to simply copy A's cert over to B's allowed ...
1
vote
1answer
182 views
What does (06) in “CRL Signing (06)” mean?
In "Certificate details -> key usage -> CRL Signing (06)", what does "(06)" in "CRL Signing (06)" mean?
3
votes
0answers
70 views
Do people sign my subkey?
So, I've generated my GPG key pair. Created a subkey for signing and a subkey for encryption. Exported the whole thing, removed my master key pair to a secure place, re-imported only the subkeys. Now, ...
1
vote
1answer
53 views
How are certificate status obtained on browsers?
There are two ways of checking the status of a digital certificate:-
Offline Authentication (CRL)
Online Authentication (OCSP, SCVP)
Several browsers (like Mozilla Firefox) have given up the use of ...
0
votes
2answers
136 views
How are CRL implemented?
The source from where I learn states:-
CRL (Certificate Revocation List) is the primary means of checking status of certificates offline.
But I can't seem to understand how is it possible for a ...
5
votes
2answers
600 views
What is cryptographic sealing?
While revising my CAdES library I encountered some "sealing issue" in digital signatures.
The Win SDK signtool.exe has a /seal ...
1
vote
1answer
653 views
How is Cross-Certification implemented?
I am currently learning about Certificates in Public Key Infrastructure.
Cross-Certification exists as an alternative because the concept of a single monolithic CA certifying every possible user in ...
1
vote
1answer
216 views
CSR signature using elliptic curve [closed]
We've been asked to generate a certificate signing request using elliptic curve and we can't use any third-party library as it's an embedded application with very limited resources).
We are used to ...
2
votes
0answers
58 views
What security is provided by a certificate? [closed]
I've been working on the topic of certificates for a little while, and here is what I understand:
A certificate is basically a public key + some data about the owner of the certificate + a signature ...
0
votes
1answer
952 views
Windows certreq full response file [closed]
I'm using the Windows certreq command line tool to submit a CSR for signing to a Windows Server CA.
...
1
vote
1answer
75 views
Include TSA Certificate in Timestamp Request
I'm currently working on Timestamping and stumbled upon a parameter fRequestCerts/requestSignerCertificates/certReq that according to the documentation (1, 2) tells a TSA to include the certificate ...
1
vote
1answer
68 views
How are public keys securely and reliably obtained across the internet?
I've just decided to start learning all about PKIs, and I have come across what seems like a paradox.
When fetching a public key from either a server or a CA, how can we be sure that the public key ...
0
votes
1answer
215 views
Understanding hybrid cryptography's concepts: signing and CA
After learning about symmetric encryption, public-key encryption, one-way hash, digital signature and digital certificate, I was tasked to think of an imaginary hybrid cryptosystem. I was thinking ...
