Questions tagged [certificates]

A certificate consists of a public key and information about the owner (e. g. the name of a person or server).

Filter by
Sorted by
Tagged with
1 vote
0 answers
69 views

Can a user set his public key without knowing its corresponding private key? [closed]

I'm wondering if in public key infrastructure (PKI), a system user be able to set his public key without knowing its corresponding private key. Can this be done?
user avatar
  • 11
0 votes
0 answers
12 views

Make certificate and private key available only to a single app [migrated]

I want to make a smart card reader app, that sends read data to a server. In order to be certain in the integrity of the data, I want to use a client certificate to communicate with the server and I ...
user avatar
0 votes
0 answers
36 views

Multi key layered encryption verification

Is it possible to take some value text like “Hello World!” And encrypt it with a random key. Then take the encrypted message and encrypt it again with another random key. And so on… Then can you write ...
user avatar
0 votes
1 answer
43 views

Generating private keys based on the list of ciphersuites available

I am building my own MQTT based network for which I would generate my own ca/server/client certificates for authentication. The goal here is to keep the message sizes as small as possible so as to ...
user avatar
1 vote
3 answers
93 views

Understanding public key in certificate precisely

Certificates are used very often in crypto. From the search, I am a bit confused what exactly is the "public key" inside a certificate essentially? Is it always a signature verification key, ...
user avatar
  • 115
1 vote
0 answers
48 views

Self-blindable certificates + group signatures

I am searching for a scheme supporting group signatures and at the same time permitting the blinding of the message-signature pair. Let me explain. There is a certification scheme proposed by Verheul: ...
user avatar
0 votes
2 answers
59 views

the matching private key of a certificate -- how to get it?

If A has a certificate issued by a CA_X, certainly A should have the private key of the certificate. My question is, does A generate the private key by itself, or , the private key is generated by ...
user avatar
  • 31
2 votes
0 answers
31 views

Software signing with openSSL

The company I work for wants me to implement some C functions to automatically sign their software. After doing some research I've found that openSSL is great for doing so. Before starting the ...
user avatar
  • 21
1 vote
2 answers
47 views

IKEv1 Phase 1, authentication with signature, sending certificates "optionally"

At RFC2409, section 5.1, authentication header is like: HDR*, IDii, [ CERT, ] SIG_I HDR is an ISAKMP header whose exchange type is the mode. When writen as HDR* it indicates payload encryption. IDii ...
user avatar
  • 27
0 votes
0 answers
30 views

Validate Certificates on Ethereum blockchain

i have a function transferWithData(address to, uint256 amount, bytes data) it basically transfer ERC20 token but it has an additional 'data' field, in order to ...
user avatar
0 votes
0 answers
61 views

Comparing digital certification and blockchain certification

I am trying to understand the benefits of using blockchain technology in document certifications such as university diplomas. I would like to know the difference between digital certification and ...
user avatar
-1 votes
1 answer
78 views

Manually decrypt the signature in a digital certificate [closed]

I've exported the root CA cert (ISRG Root X1) used by StackOverflow's digital certificate, as a DER encoded binary X.509 (.cer) file and used openssl in cmd to find out the modulus/exponent: ...
user avatar
2 votes
1 answer
169 views

How to find the public key in a digital certificate

I can see what I think should be the public key in the Details tab for StackOverflow's certificate (see screenshot below). However, it is 2160 (num of chars (540) multiplied by 4 = 2160) bits long, ...
user avatar
1 vote
1 answer
373 views

Can Fixed–Diffie–Hellman be attacked?

Recently I'm studying Diffie-Hellman key exchange protocol and I've noticed that the basic Diffie-Hellman can be attacked by Man-In-The-Middle attack. I've also read about the Fixed Diffie-Hellman ...
user avatar
  • 113
0 votes
1 answer
135 views

OPENSSL CMS: Enveloped data's public key, Certificate's public key; Are they same?

I read the rfc5652, and I made enveloped data via openssl: openssl cms -encrypt -in plain -aes256 -recip certificate.pem -outform DER -out enveloped-data.ber Then, I check the public key. First, ...
user avatar
0 votes
0 answers
21 views

Key exchange with a property as certificate

I am searching for a key exchange protocol that makes use of certificates. I already came across protocols like Authenticated Diffie-Hellman key exchange, but this protocol use public/private key ...
user avatar
1 vote
1 answer
66 views

Revoke key without communication between the party who revoked it and the party who is validating

I received a very weird question from someone. I feel there is no solution, It would be great if you guys share your views. There are three people Alice, Bob and Sam and they all work for a high-...
user avatar
0 votes
1 answer
59 views

Authentication of certificates

In order to provide authenticity of a sent message, we use certificates as fingerprints. But how do I know that the certificate is not stolen by someone? If the certificates are made public, why cant ...
user avatar
0 votes
0 answers
41 views

Is it possible to extract a signature from a HTTPS webpage?

Let's say I want to prove to someone that a webpage claims X. I could take a screenshot, but it could easily be doctored. However, the webpage's contents are encrypted by the domain using its private ...
user avatar
  • 123
0 votes
0 answers
17 views

HPKP on OS or library level

Among the major operating systems (Windows, MacOS, Linux) or common TLS libraries (Schannel, openssl, boringssl) is their any way to pin certificates on a global level? So not just per application but ...
user avatar
1 vote
1 answer
218 views

What is Cross signing of root certificates and how does it help at time of root certificate expiry?

I got to know that Root CA's are cross signed so that at the time of certificate expiry, there are no outages. However, I am unable to find any good docs explaining how cross signing works and how it ...
user avatar
0 votes
0 answers
47 views

certificate authority

hi guys, is there a pseudonym in the certificate ? , I read papers that use the certificate authority, and between the components of the certificate, there is a pseudonym.
user avatar
0 votes
1 answer
88 views

Can I use a certificate authority with Elgamal encryption?

Can I use a certificate authority with Elgamal encryption? Is this type of keys in CA?
user avatar
0 votes
1 answer
59 views

Are end-entity certificates without basic constraints extension vulnerable?

Public certificate authorities seem to always include the basic constraints extension. Why is this a best practice? What is the risk for a PKI to issuing end-entity certificates that don't have ‘...
user avatar
1 vote
2 answers
238 views

Samsung .Cert File - Digging deeper

I don't know if I should ask this question in Android Stackexchange or here, but I am sure I am in a right place to ask. My question is about following Samsung Certificate file: File name: ...
user avatar
  • 111
1 vote
1 answer
33 views

How to determine curve's field size in a ECDSA Signature

There is a bug in some firmware I'm working that states the following: If individual coordinates are shorter or longer than the curve’s field size they are processed incorrectly. So I can get the ...
user avatar
  • 111
0 votes
1 answer
164 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
user avatar
  • 101
6 votes
2 answers
2k views

Do certificates need to be stored as encrypted?

The titles says most of what we're confused with. Here's some details: On an embedded device, we have a microcontroller and external flash memory. This memory can be easily read and written to in ...
user avatar
0 votes
2 answers
84 views

Automatic csr sending

In our project we have grpc server and clients which should satisfy mutual tls. So, there is CA and clients generate csr to sent to CA to signing it. Now I need to send csr manually to CA to sign it ...
user avatar
0 votes
0 answers
52 views

What is the difference of having to use a ca.crt to verify a signed file vs the .crt used to sign it?

This seemed like the most appropriate place to ask this question so here it goes: I used to run a process that automatically generated a shim.key and ...
user avatar
0 votes
0 answers
51 views

Best model for client software encryption / decryption

I would like to develop a small solution (in C#) that must secure data exchange with an untrusted server. The model is that this software will run on a Windows client then encrypt data before pushing ...
user avatar
0 votes
0 answers
36 views

Any (proposed) internet standard (RFC) for trusted hosting of signed documents?

There's a problem with digitally signed documents - in particular that any print-out of them will be only a copy, not an original (by print-out I mean the print-out of the human readable form of the ...
user avatar
1 vote
1 answer
88 views

Different encryption standards and how they relate to auth and algorithms

The main confusion I have is around the different PKCS and relation with SSL (TLS). I have done a lot of research and have found bits and pieces but not necessarily how these relate, so let me explain ...
user avatar
  • 13
5 votes
2 answers
497 views

Clarification on the TLS verification process

I am reading this article in my attempt to understand how the TLS verification and chain of trust works. In the piece I come across a section that I am not sure I understand. In the simplified ...
user avatar
4 votes
2 answers
4k views

What exactly is Let's encrypts chain.pem file?

While trying to understand the use or meaning of the fullchain.pem file created by let's encrypt I stumbled upon this post in which ...
user avatar
0 votes
3 answers
74 views

What are the contents of a certificate and how can I view it?

I understand on a conceptual level that a certificate is nothing more than just a verified public key. The next question I have, is how exactly do I see the contents of a certificate? Apart from the ...
user avatar
0 votes
0 answers
39 views

How is the identitiy of a subject in a Public Key Certificate verified by the Certificate Authority (CA)?

A general digital certificate issued by a CA might contain information about the individual/organization to whom the certificate belongs. As an example, consider this sample scenario: This PKC ...
user avatar
0 votes
1 answer
50 views

Where can I read about DER certificate structure - fields and its registered values?

Where is an official documentation for ASN1 structure and values of x509 certs? Using OpenSSL command like openssl asn1parse -in server.der -inform DER I can see ...
user avatar
  • 127
3 votes
1 answer
129 views

Allowed key types in an SSL certificate

What are the valid key types which can get signed (or generated and signed) by a CA to constitute an SSL certificate? For the keys used in TLS, the key types I have seen are RSA and EC. Anything else? ...
user avatar
2 votes
0 answers
56 views

How to prove document ownership at a specific time [duplicate]

Problem Given any piece of data, I could sign it with public key and made available online. This proves I am in possession of given data, but it doesn't tell I am the creator. The only possibility (I'...
user avatar
  • 121
2 votes
2 answers
680 views

openSSL created CSR signature size of 73 bytes but should't it be 70 bytes

after creating CSR using openSSL with secp256r1 curve inspecting the file using openssl asn1parse -i -in ecTest.csr the size of ...
user avatar
  • 143
12 votes
3 answers
4k views

Smallest possible certificate for IoT device

I'm developing an IoT system that uses small nodes connected through RF. This allows messages under 250 bytes long. You can check it at https://github.com/gmag11/EnigmaIOT. All messages are encrypted ...
user avatar
  • 121
0 votes
0 answers
185 views

What's the meaning of cached certificate revocation list and online certificate revocation list in X509RevocationMode Enum?

In this article, there are cached certificate revocation list and online certificate revocation list terms used. I tried to find ...
user avatar
5 votes
1 answer
763 views

RSASSA-PSS in TLS 1.2

I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3. But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2? Is it possible to use ...
user avatar
  • 53
1 vote
1 answer
10k views

Difference Between PEM vs P12 vs CRT vs JKS vs keystore vs PKCS vs x509 certificates [duplicate]

Sorry noob here. I am so much confused about lot of files used client authentication certificates. Can anyone guide me on the difference between PEM vs P12 vs CRT vs JKS vs Keystore vs PKCS vs x509 ...
user avatar
2 votes
0 answers
55 views

Detecting revoked keys long after a document is signed

Scenario: A document is signed with a compromised private key, with a long-term time stamp. The normal expiration date of the key pair is D. The rightful owner of the key pair discovers the compromise ...
user avatar
3 votes
1 answer
202 views

Manually creating a GPG Public Key

I want to manually create a GPG public key that can be imported into GPG, i.e. I want to create a file with a Public-Key Packet, a User ID Packet and a Signature Packet (for an example see here). I ...
user avatar
  • 193
1 vote
0 answers
122 views

Generate version 3 x509 certificate from version 1 CA

Please do forgive me for my naivety. I have inherited a legacy system wherein the CA which signs the certificate is of version 1. Is it possible to generate a x509 version 3 certificate which is ...
user avatar
  • 111
0 votes
1 answer
86 views

What if the CSR is intercepted in transit while sending it to CA?

I was studying PKI the other day and I had a serious thinking about the following question. What is CSR? - It is a block of encoded text that is given to the CA when applying for an SSL certificate ...
user avatar
1 vote
0 answers
135 views

is it possible to achieve authenticated key agreement without using PKI or pre-shared secret?

After reading different techniques to achieve authenticated key-agreement (X3DH, HMQV, Asynchronous Ratcheting tree, An efficient protocol for authenticated key agreement, I understood that all these ...
user avatar
  • 413

1
2 3 4 5 6