Questions tagged [certificates]

A certificate consists of a public key and information about the owner (e. g. the name of a person or server).

Filter by
Sorted by
Tagged with
1 vote
0 answers
34 views

TLS 1.3 key_share capture without certificate exchange

I am working on an investigation on TLS 1.3. I've came across an article of qacafe where they shared a TLS 1.3 handshake sequence. Wireshark capture. In this capture you see that in the Client Hello a ...
Arthur Timmermans's user avatar
1 vote
1 answer
67 views

X.509 CA bundle content

I recently looked into the subject of public key cryptography (especially with X.509 certificates). I am the administrator of a web server using HTTPS which uses 2 levels of certificates (in addition ...
hidigoudi's user avatar
1 vote
0 answers
33 views

Error to create PQ certificate in C - x509 certificate routines:X509_PUBKEY_set:unsupported algorithm

I'm learning OQS OpenSSL and I'd like to create a certificate with dilithium in C, using liboqs and OQS OpenSSL. This is my code (based on https://stackoverflow.com/questions/256405/programmatically-...
r4mpz0's user avatar
  • 33
1 vote
1 answer
35 views

How to authenticate multiple IOT devices having unique certificates (ECDSA)?

I'm relatively new to the field of security. I'm working on an IoT system with WiFi-connected nodes (Bio-sensing devices) communicating with a server for centralized monitoring. I need to authenticate ...
jh_sh's user avatar
  • 13
1 vote
3 answers
93 views

How do certificates add data to public key and how is this implemented into TLS?

I want to create a self signed PKI for a couple servers I am running. I am finding tutorials with copy paste commands from openssl, and hand waving explanations that describe the general purpose of ...
Damian Games's user avatar
1 vote
1 answer
54 views

X509 Client certificate - before - XEnroll / Certenroll / KEYGEN

IBM (now HCL) Domino has since way back a complete procedure to issue X509 client certificate as a login option to a webserver. Back in 2010-ish it worked fine in both Firefox and Internet Explorer. ...
Stefan K's user avatar
2 votes
1 answer
92 views

Self-contained digital certification device

Does it work if we try to construct a device (e.g., for counting purpose in several remote branches of a company) using a self-containing digital signature key enclosed in a tamper-proof hardware to ...
oCriptoPanquer's user avatar
2 votes
1 answer
56 views

Which service provider can create (claimable) accounts for managing Ed25519 keypairs (zero-knowledge fashion) by email

The title is a mouthful, allow me to explain my situation. I have a SaaS with many users. When new users join the platform, I want to create a cryptographic keypair for them (Ed25519). But I don't ...
Ilya Nevolin's user avatar
0 votes
1 answer
43 views

What type of certificate is this?

I have been reading papers about authentication in VANETS and some of them mention a certificate that a trusted authority generates for a vehicle and has the following form: $${C_{V_i}}=S_{TA}+H(PID_{...
Abol_Fa's user avatar
  • 73
0 votes
1 answer
147 views

What is a website's private signing key used to sign?

I am trying to understand digital signatures and digital certificates. I know that digital certificates verify a server's public verification key but what does the website's (client) private ...
CryptoGuru's user avatar
0 votes
2 answers
735 views

How does TLS 1.3 provide authentication without using the public key to verify that the server has a private key?

In the TLS 1.2 handshake, after checking the certificate, the public key from the certificate was used to encrypt the data to create a symmetric encryption key, hence the authentication took place on ...
Nikita Khodakovsky's user avatar
1 vote
2 answers
166 views

How do certificates help?

I am reading a networking book by Mike Meyers, and it says that a certificate is a file that contains A public key, and A signature (cryptographic hash of the public key, encrypted with the private ...
landau's user avatar
  • 113
0 votes
1 answer
55 views

Does code signing Certificates need a key Pair? or a single Certificate

I know that SSL Certificates use a private key on the server side and the public key for verifying it on the client side. I am wondering, is it the same for Code Signing Certificates? Or do they just ...
PixelPaul's user avatar
  • 141
2 votes
1 answer
1k views

How can a root CA be kept offline and function

Based on many suggestions I have seen around, this, that.etc. Best practice says to keep the root CA offline for very understandable reasons. But how can it be truly offline? Doesn't the root ca have ...
dobro's user avatar
  • 21
0 votes
1 answer
119 views

ChaCha Single-Use RNG with All Zero Plaintext + Nonce

I am creating an internal application that will be used to generate and manage self-signed certificates and certificate authorities. Its primary use will be for generating certificates used in SSL ...
Goodies's user avatar
  • 145
1 vote
0 answers
65 views

Comparison Hash, MAC, Signatures, Certificates

I saw a table comparing Hash/Mac/Signatures in this post. I was wondering if I can integrate digital certificates into it like this: Hash MAC Signature Certificate + Signature Integrity Yes Yes Yes ...
Fee's user avatar
  • 111
1 vote
0 answers
97 views

Can a user set his public key without knowing its corresponding private key? [closed]

I'm wondering if in public key infrastructure (PKI), a system user be able to set his public key without knowing its corresponding private key. Can this be done?
ali alizade's user avatar
0 votes
0 answers
47 views

Multi key layered encryption verification

Is it possible to take some value text like “Hello World!” And encrypt it with a random key. Then take the encrypted message and encrypt it again with another random key. And so on… Then can you write ...
James Dougan's user avatar
0 votes
1 answer
50 views

Generating private keys based on the list of ciphersuites available

I am building my own MQTT based network for which I would generate my own ca/server/client certificates for authentication. The goal here is to keep the message sizes as small as possible so as to ...
user1398593's user avatar
1 vote
3 answers
348 views

Understanding public key in certificate precisely

Certificates are used very often in crypto. From the search, I am a bit confused what exactly is the "public key" inside a certificate essentially? Is it always a signature verification key, ...
Curious's user avatar
  • 115
1 vote
0 answers
60 views

Self-blindable certificates + group signatures

I am searching for a scheme supporting group signatures and at the same time permitting the blinding of the message-signature pair. Let me explain. There is a certification scheme proposed by Verheul: ...
Karina Am's user avatar
0 votes
2 answers
104 views

the matching private key of a certificate -- how to get it?

If A has a certificate issued by a CA_X, certainly A should have the private key of the certificate. My question is, does A generate the private key by itself, or , the private key is generated by ...
oxear08's user avatar
  • 31
2 votes
0 answers
80 views

Software signing with openSSL

The company I work for wants me to implement some C functions to automatically sign their software. After doing some research I've found that openSSL is great for doing so. Before starting the ...
Xershy's user avatar
  • 21
1 vote
2 answers
73 views

IKEv1 Phase 1, authentication with signature, sending certificates "optionally"

At RFC2409, section 5.1, authentication header is like: HDR*, IDii, [ CERT, ] SIG_I HDR is an ISAKMP header whose exchange type is the mode. When writen as HDR* it indicates payload encryption. IDii ...
hadz's user avatar
  • 27
0 votes
0 answers
94 views

Comparing digital certification and blockchain certification

I am trying to understand the benefits of using blockchain technology in document certifications such as university diplomas. I would like to know the difference between digital certification and ...
Sangjin Kim's user avatar
-1 votes
1 answer
286 views

Manually decrypt the signature in a digital certificate [closed]

I've exported the root CA cert (ISRG Root X1) used by StackOverflow's digital certificate, as a DER encoded binary X.509 (.cer) file and used openssl in cmd to find out the modulus/exponent: ...
David Klempfner's user avatar
2 votes
1 answer
885 views

How to find the public key in a digital certificate

I can see what I think should be the public key in the Details tab for StackOverflow's certificate (see screenshot below). However, it is 2160 (num of chars (540) multiplied by 4 = 2160) bits long, ...
David Klempfner's user avatar
1 vote
1 answer
443 views

Can Fixed–Diffie–Hellman be attacked?

Recently I'm studying Diffie-Hellman key exchange protocol and I've noticed that the basic Diffie-Hellman can be attacked by Man-In-The-Middle attack. I've also read about the Fixed Diffie-Hellman ...
Benny's user avatar
  • 113
0 votes
1 answer
514 views

OPENSSL CMS: Enveloped data's public key, Certificate's public key; Are they same?

I read the rfc5652, and I made enveloped data via openssl: openssl cms -encrypt -in plain -aes256 -recip certificate.pem -outform DER -out enveloped-data.ber Then, I check the public key. First, ...
poiuy925's user avatar
1 vote
1 answer
80 views

Revoke key without communication between the party who revoked it and the party who is validating

I received a very weird question from someone. I feel there is no solution, It would be great if you guys share your views. There are three people Alice, Bob and Sam and they all work for a high-...
Chygo Runner's user avatar
0 votes
1 answer
71 views

Authentication of certificates

In order to provide authenticity of a sent message, we use certificates as fingerprints. But how do I know that the certificate is not stolen by someone? If the certificates are made public, why cant ...
user96467's user avatar
0 votes
0 answers
57 views

Is it possible to extract a signature from a HTTPS webpage?

Let's say I want to prove to someone that a webpage claims X. I could take a screenshot, but it could easily be doctored. However, the webpage's contents are encrypted by the domain using its private ...
Joel's user avatar
  • 123
4 votes
1 answer
4k views

What is Cross signing of root certificates and how does it help at time of root certificate expiry?

I got to know that Root CA's are cross signed so that at the time of certificate expiry, there are no outages. However, I am unable to find any good docs explaining how cross signing works and how it ...
Techievent.in's user avatar
0 votes
0 answers
55 views

certificate authority

hi guys, is there a pseudonym in the certificate ? , I read papers that use the certificate authority, and between the components of the certificate, there is a pseudonym.
omrani omaima's user avatar
0 votes
1 answer
111 views

Can I use a certificate authority with Elgamal encryption?

Can I use a certificate authority with Elgamal encryption? Is this type of keys in CA?
omrani omaima's user avatar
0 votes
1 answer
288 views

Are end-entity certificates without basic constraints extension vulnerable?

Public certificate authorities seem to always include the basic constraints extension. Why is this a best practice? What is the risk for a PKI to issuing end-entity certificates that don't have ‘...
278342304's user avatar
1 vote
2 answers
413 views

Samsung .Cert File - Digging deeper

I don't know if I should ask this question in Android Stackexchange or here, but I am sure I am in a right place to ask. My question is about following Samsung Certificate file: File name: ...
fWd82's user avatar
  • 111
1 vote
1 answer
142 views

How to determine curve's field size in a ECDSA Signature

There is a bug in some firmware I'm working that states the following: If individual coordinates are shorter or longer than the curve’s field size they are processed incorrectly. So I can get the ...
Loaf's user avatar
  • 111
1 vote
1 answer
594 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
CHOO YJ's user avatar
  • 121
6 votes
2 answers
2k views

Do certificates need to be stored as encrypted?

The titles says most of what we're confused with. Here's some details: On an embedded device, we have a microcontroller and external flash memory. This memory can be easily read and written to in ...
Ashley Duncan's user avatar
0 votes
2 answers
97 views

Automatic csr sending

In our project we have grpc server and clients which should satisfy mutual tls. So, there is CA and clients generate csr to sent to CA to signing it. Now I need to send csr manually to CA to sign it ...
user87968's user avatar
0 votes
0 answers
97 views

What is the difference of having to use a ca.crt to verify a signed file vs the .crt used to sign it?

This seemed like the most appropriate place to ask this question so here it goes: I used to run a process that automatically generated a shim.key and ...
user3161924's user avatar
0 votes
0 answers
63 views

Best model for client software encryption / decryption

I would like to develop a small solution (in C#) that must secure data exchange with an untrusted server. The model is that this software will run on a Windows client then encrypt data before pushing ...
Marc Alves's user avatar
0 votes
0 answers
37 views

Any (proposed) internet standard (RFC) for trusted hosting of signed documents?

There's a problem with digitally signed documents - in particular that any print-out of them will be only a copy, not an original (by print-out I mean the print-out of the human readable form of the ...
matthias_buehlmann's user avatar
2 votes
1 answer
159 views

Different encryption standards and how they relate to auth and algorithms

The main confusion I have is around the different PKCS and relation with SSL (TLS). I have done a lot of research and have found bits and pieces but not necessarily how these relate, so let me explain ...
Joe's user avatar
  • 23
5 votes
2 answers
553 views

Clarification on the TLS verification process

I am reading this article in my attempt to understand how the TLS verification and chain of trust works. In the piece I come across a section that I am not sure I understand. In the simplified ...
Finlay Weber's user avatar
5 votes
3 answers
9k views

What exactly is Let's encrypts chain.pem file?

While trying to understand the use or meaning of the fullchain.pem file created by let's encrypt I stumbled upon this post in which ...
Finlay Weber's user avatar
0 votes
3 answers
110 views

What are the contents of a certificate and how can I view it?

I understand on a conceptual level that a certificate is nothing more than just a verified public key. The next question I have, is how exactly do I see the contents of a certificate? Apart from the ...
Finlay Weber's user avatar
0 votes
0 answers
45 views

How is the identitiy of a subject in a Public Key Certificate verified by the Certificate Authority (CA)?

A general digital certificate issued by a CA might contain information about the individual/organization to whom the certificate belongs. As an example, consider this sample scenario: This PKC ...
Tabish Mir's user avatar
0 votes
1 answer
54 views

Where can I read about DER certificate structure - fields and its registered values?

Where is an official documentation for ASN1 structure and values of x509 certs? Using OpenSSL command like openssl asn1parse -in server.der -inform DER I can see ...
Iceman's user avatar
  • 137

1
2 3 4 5 6