Questions tagged [certificates]
A certificate consists of a public key and information about the owner (e. g. the name of a person or server).
0
votes
1answer
33 views
When a program using openssl library is using a certificate, does the server check if the issuer(s) are still valid
If I have a program acting as TLS server with a certificate signed by a CA, if one of the issuers in the chain becomes invalidated or the date expires, then how does the program using the certificate ...
1
vote
0answers
13 views
GlobalSign cert in Trusted root for Google Services shows Sha1. Security postures
"GlobalSign" certificate in Trusted Root Certification Authorities for Google Services shows Sha1. Security postures are different than just 2-3 yr ago. At my home, router bought 2016, networked; ...
0
votes
2answers
91 views
Why does curl need both root and intermediate certificates in order to securely connect to an HTTP server?
I have created a root certificate, an intermediate certificate, and a server certificate:
...
0
votes
1answer
44 views
Is the only use for the private key of a root certificate signing certificates issued by it?
A root certificate can be used to issue intermediate certificates.
The private key of the root certificate is needed in order to sign any intermediate certificates.
However, after that, we only need ...
1
vote
0answers
25 views
TPM 2.0 Reissued EK Cert
Unlike the TPM 1.2 module, the TPM 2.0 specification allows the platform user to create own ...
2
votes
1answer
40 views
How does a receiver treat X.509 self-certificate with unknown the Signature Algorithm ID?
As I know X.509 self-certificate is a mechanism that the host generates public and private keys, the public key will insert to a certification and the private key will be used to sign the ...
2
votes
1answer
51 views
Revoke a GPG key using previously generated revoke certificate after renewd (change expiration date)
I have few sub-questions
Do secret keys get expired, or just the public key gets expired?
Do I have to back up the master sec key each time I renew it?
For an ...
0
votes
1answer
45 views
-1
votes
1answer
38 views
I am new to digital certificate 509V3 concept. can some one please clarify the below points [closed]
I am using RSA 2048 with SHA 256 primitive in certificate:
How to verify the user certificate n + 1 with Root certificate n?
why it is required to perform Certificate chain verification?
How to ...
0
votes
1answer
111 views
Which algorithm should be used to replace SHA512withRSA? [closed]
We are working on the web application that is basically generating a self-signed certificate during the installation. It's a Java based app and for generation of the certificate we are using ...
27
votes
3answers
3k views
Does “Shattered” actually show SHA-1-signed certificates are “unsafe”?
Note: I am not advocating anyone continues using SHA1-signed certificates: they are dead as far as security is concerned and should no longer be used. I'm just trying to clarify my understanding of ...
1
vote
0answers
75 views
What exactly is the contents of the LDAP userSMIMECertificate attribute?
I'm trying to setup an LDAP with user certificates. I have already learned that certificates can be stored in either the userCertificate attribute in DER format, or ...
0
votes
0answers
42 views
Derive anonymous dsa key-pair from two certificate authorities
Is it possible to derive a dsa key-pair based on two private keys from different/independent "Certificate Authorities" (ca1 and ca2) to sign s.th. which then verifies only that the signature is a ...
0
votes
0answers
28 views
Proof of work using any computational puzzles
if we have a system in which any user can send arbitrary messages of his choice, and any one can receive that message. So a malicious user can send any messages which may lead to DOS attacks. Any ...
1
vote
1answer
35 views
Key derivation with implicit certificates
The big advantage of implicit certificate is their small size and fast processing. This article presents a way how to compute implicit certificates.
In the end Alice is able to derive both her ...
0
votes
2answers
38 views
Self signed certificate for mobile app and backend from same company
My company's product is Android and iOS mobile app which connects to our own backend. All interactions of the mobile app are with backend developed by our own company.
In such a situation, can the ...
0
votes
0answers
35 views
Is there anything out to generate certificates using VXEdDSA?
As the title says - Is there anything out to generate certificates using VXEdDSA?
And if there isn't what options do I have for hardening security on tls 1.3 with ed25519 certificate so that a ...
3
votes
1answer
262 views
How can Bob validate Alice’s certificate?
Suppose that Alice has a certificate CA1 << Alice >> issued by the certification authority CA1, and Bob has a ...
2
votes
1answer
27 views
Secure scheme to share symmetric key using asymmetric keys and certificates with N parties
I need to distribute symmetric AES key into number of end points which will use it to decrypt data. The AES key will be the same on all end points, it is not possible to generate unique on every end ...
1
vote
1answer
184 views
Secure Design and CRL?
I was at my College Security Lesson, the professor said that Certificate Revocation Lists (CRLs) violate some of the Secure Design principles.
Secure Design Principles:
Fail-Safe Defaults
Economy of ...
0
votes
1answer
279 views
RSA certificate needed in CVC format
I had a client requirement asking me to provide an existing base64 encoded certificate in a CVC format. Could someone point me in the right direction here to understand what this format is? How can I ...
3
votes
0answers
60 views
X.509 strong authentication protocols
Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the ...
1
vote
0answers
37 views
Benefits of using SSL certificate over a raw key pair for non-browser use?
For applications not involving CA signed certificates – or web browsers for that matter – it would seem to be easier to use a raw key pair if possible, rather than deal with potential formatting ...
2
votes
0answers
31 views
How is a Private Key Generator (PKG) better than a Certificate Authority (CA) in Mobile Ad-Hoc Networks (MANETs)?
I am doing research in Key Management solutions for a Mobile Ad-Hoc Network (MANET) and from reading papers, I found that traditional certificate-based cryptography (which use CAs for Public Key ...
0
votes
1answer
55 views
Link between openssl 'req' command and 'unable to get local issuer certificate'?
I was using the following command to build a self-signed certificate after creating a private key:
...
2
votes
1answer
62 views
CAs are pre-loaded on the system, but how is it able to get intermediate certs?
I have the following X509 certificate:
...
1
vote
2answers
280 views
Why is the signature field in X.509 a BIT STRING, despite there being ASN.1 (DER) data inside?
As can be seen from the following ASN.1 definition of an X.509 certificate, the Signature field is a BIT STRING.
...
0
votes
2answers
57 views
Should Bob trust a certificate issued by delegated party?
Consider this scenario:
Alice sends a message signed under her public key to Bob.
Bob has never exchanged a keys with Alice.
Alice's key is signed by a certain X.
X's key is signed by Y, an entity ...
1
vote
1answer
332 views
What happens when a root CA loses its private key?
Certificate Authorities normally keep their private keys inside dedicated Hardware Security Modules (HSMs).
What happens when such a device is lost (fire, electronic fault, stolen, etc)?
How would ...
1
vote
1answer
100 views
how to avoid attack on Certificate Revocation List by the owner of the private key?
suppose A owns the private key, and its correspondent certificate locates in site of CA.
B request for A's certificate from CA for verifying the signature sent to him/her.
There is an attack ...
4
votes
2answers
747 views
Why is the signatureAlgorithm field in X.509 certificates redundant?
See the ASN.1 description of an X.509 certificate below:
...
1
vote
1answer
229 views
How to sign a CRL file if I have offline keys?
I am generating a CA for internal use. When generating a CA, the best practice I have observed is to keep the root CA offline and emit an intermediate CA certificate that will in turn emit the end-...
0
votes
1answer
222 views
What does the PFX file extension stand for
PFX is commonly used as a synonym of PKCS#12 certificate stores. However, I've never seen an explanation why these stores are called PFX (on Microsoft platforms) in multiple articles, including those ...
0
votes
1answer
389 views
how to validate cert when signed cert has authority key id but signing cert doesn't?
Say I have the following signing cert:
...
0
votes
3answers
124 views
How to encrypt a message such when a certain condition is met it can be decrypted?
Assume, there is a certificate authority whose public key: $pk$, is known. Also, the certificate $c$ is known, but not the signed certificate.
I want to encrypt a message: $m$, such that whoever has ...
-3
votes
1answer
75 views
Are there stenography benefits to a “n-prime”?
As mentioned in this StackOverflow CodeGolf question, prime numbers can be redefined:
One of my favorite definitions of the prime numbers goes as follows:
2 is the smallest prime.
...
2
votes
1answer
533 views
Can I apply “encrypt with public key and decrypt with private key concept” using ECC certificate?
If Alice wants to send encrypted message to Bob, she can use Bob's public key to encrypt the plain message. Once Bob reliably gets encrypted message, he can decrypt it with his private key. In this ...
1
vote
1answer
60 views
What data Certificate Authority encrypt for CSR?
I have been searching for a detailed explanation but can’t seem to find a low level one.
1) When CA sign the data with its private key, the encrypted data is APPENED to the csr or the whole cert ...
2
votes
2answers
84 views
Transferable ownership certificate
Is there a crytpographic way to assert ownership of an asset (let's say a piece of stone)?
As an example, a number (public key) could be engraved in the stone, and the owner could keep a private key (...
0
votes
1answer
130 views
Digital certificate issuing man-in-the-middle attack
While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key).
To certify a domain ...
0
votes
1answer
63 views
Changing the public key in an MD5 certificate
Given a valid, signed X.509 certificate using the MD5 digest algorithm and an RSA public key, how feasible would it be to generate a public key which would, all other parts of the certificate being ...
0
votes
1answer
71 views
How can i verify a certificate to root? [closed]
I write some certificate Authority that has it's own private/public cert keys .
This CA signs public keys of user.
If for example i have user that has a public cert that signed by the CA.
How I can ...
1
vote
2answers
355 views
Is it safe to include the public certificate in xml digital signatures?
My understanding of XML Digital Signatures:
Let's use a SAML token as an example.
Note - for the sake of simplicity I'm omitting some details like CanonicalizationMethod, base64 encoding, etc.
In ...
-2
votes
1answer
98 views
Can two different CA's/End Entities in different PKI's have the same asymmetric key pair?
Example: $X$ and $Y$ have the same asymmetric key pair.
$X$ communicates with $A$ and gives it's PubKey to $A$.
So, $A$ has the PubKey of $X$ which also happens to be the PubKey/PrivKey of $Y$.
...
1
vote
1answer
77 views
Is allowing both digitalSignature and keyEncipherment certificate usages a bad practice?
From what I see, many server and client RSA certificates in the real deployments have the "key usage" mask containing both digitalSignature and keyEncipherment.
Isn't this a bad (that is, potentially ...
1
vote
2answers
2k views
Is there a complete list of Signature Algorithm names?
I need to analyze the output of rbsec's sslscan which reports a server's SSL/TLS configuration as reported by OpenSSL.
I'm interested in the Certificate's Signature Algorithm in particular, and I was ...
15
votes
1answer
467 views
Who issued the first SSL certificate?
When SSL was introduced in ~1996, there was only a few CAs issuing certificates for that specific use and a few sites which actually used SSL.
Which Certification Authority issued the first SSL ...
1
vote
0answers
77 views
Certificate Master Public Key with Pairing
I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(...
0
votes
1answer
52 views
Encrypted cerficiate signature for server certificate and intermediate certificate in packet capture
If we view the certificate chain using Firefox, we can see the certificate signature of "server certificate" and its "intermediate-CA" right after the "certificate signature algorithm" in the ...
1
vote
1answer
62 views
Direct Anonymous Attestation to replace CA
In term of authentication, I have the impression that to trust an entity it is mandatory to have a Certification Authority involve. Today I stumble upon an article something called Direct Anonymous ...
