Questions tagged [certificates]

A certificate consists of a public key and information about the owner (e. g. the name of a person or server).

Filter by
Sorted by
Tagged with
0
votes
0answers
29 views

Encryption for intranet site?

I am developing a web application which will be downloaded, installed and used by my customers on their intranet. The data in the application is confidential, so all requests and responses need to be ...
0
votes
0answers
23 views

What is the difference of having to use a ca.crt to verify a signed file vs the .crt used to sign it?

This seemed like the most appropriate place to ask this question so here it goes: I used to run a process that automatically generated a shim.key and ...
3
votes
2answers
368 views

Revoke a GPG key using previously generated revoke certificate after renewd (change expiration date)

I have few sub-questions Do secret keys get expired, or just the public key gets expired? Do I have to back up the master sec key each time I renew it? For an ...
3
votes
1answer
95 views

Do people sign my subkey?

So, I've generated my GPG key pair. Created a subkey for signing and a subkey for encryption. Exported the whole thing, removed my master key pair to a secure place, re-imported only the subkeys. Now, ...
0
votes
0answers
29 views

Best model for client software encryption / decryption

I would like to develop a small solution (c#) that must secure data exchange with an untrusted server. The model is that this software will run on a Windows client then Encrypt data before pushing it ...
0
votes
1answer
277 views

Understanding hybrid cryptography's concepts: signing and CA

After learning about symmetric encryption, public-key encryption, one-way hash, digital signature and digital certificate, I was tasked to think of an imaginary hybrid cryptosystem. I was thinking ...
2
votes
1answer
603 views

Reusing PGP key when generating SSL Certificate Authority?

Does it make sense to reuse some of the keys from my PGP (GnuPG, GPG) key block when generating my own SSL Certificate Authority (a toy one for myself and a few web services of mine)? In an ideal ...
0
votes
0answers
30 views

Any (proposed) internet standard (RFC) for trusted hosting of signed documents?

There's a problem with digitally signed documents - in particular that any print-out of them will be only a copy, not an original (by print-out I mean the print-out of the human readable form of the ...
1
vote
1answer
39 views

Different encryption standards and how they relate to auth and algorithms

The main confusion I have is around the different PKCS and relation with SSL (TLS). I have done a lot of research and have found bits and pieces but not necessarily how these relate, so let me explain ...
1
vote
1answer
123 views

How to compute certificates using Diffie-Hellman key exchange with certificates and Elgamal signature scheme

We consider the Diffie–Hellman key exchange scheme with certificates. We have a system with the three users Alice, Bob and Charley. The Diffie–Hellman algorithm uses p = 61 and α = 18. The three ...
5
votes
2answers
415 views

Clarification on the TLS verification process

I am reading this article in my attempt to understand how the TLS verification and chain of trust works. In the piece I come across a section that I am not sure I understand. In the simplified ...
1
vote
2answers
101 views

What exactly is Let's encrypts chain.pem file?

While trying to understand the use or meaning of the fullchain.pem file created by let's encrypt I stumbled upon this post in which ...
0
votes
3answers
59 views

What are the contents of a certificate and how can I view it?

I understand on a conceptual level that a certificate is nothing more than just a verified public key. The next question I have, is how exactly do I see the contents of a certificate? Apart from the ...
0
votes
0answers
16 views

CMS encryption application using Windows system certificate store

Hy! I'm looking for an application, which can make cms encryption/decryption, but with the use of the windows certificate store. I already found out, that openssl can't do it out of the box (just by ...
0
votes
0answers
26 views

How is the identitiy of a subject in a Public Key Certificate verified by the Certificate Authority (CA)?

A general digital certificate issued by a CA might contain information about the individual/organization to whom the certificate belongs. As an example, consider this sample scenario: This PKC ...
8
votes
2answers
9k views

What happens when a root CA has its private key compromised?

What happens when a root CA has its private key compromised? Then all children in the tree are compromised too? And then all certificates are compromised? What needs to happen then? Related: - How ...
2
votes
1answer
3k views

PKCS12 password of container and private key

As I understand pkcs12 defines a container structure that can hold both a certificate and one or more private keys. ...
3
votes
1answer
67 views

Allowed key types in an SSL certificate

What are the valid key types which can get signed (or generated and signed) by a CA to constitute an SSL certificate? For the keys used in TLS, the key types I have seen are RSA and EC. Anything else? ...
0
votes
1answer
39 views

Where can I read about DER certificate structure - fields and its registered values?

Where is an official documentation for ASN1 structure and values of x509 certs? Using OpenSSL command like openssl asn1parse -in server.der -inform DER I can see ...
0
votes
0answers
21 views

data transferred when certificates are used

I tried to find some information about how certificates work on a technical level but wasn't really able to find something that answered all my questions. Can one explain which data is transferred ...
2
votes
0answers
52 views

How to prove document ownership at a specific time [duplicate]

Problem Given any piece of data, I could sign it with public key and made available online. This proves I am in possession of given data, but it doesn't tell I am the creator. The only possibility (I'...
1
vote
1answer
85 views

Include TSA Certificate in Timestamp Request

I'm currently working on Timestamping and stumbled upon a parameter fRequestCerts/requestSignerCertificates/certReq that according to the documentation (1, 2) tells a TSA to include the certificate ...
12
votes
3answers
4k views

Smallest possible certificate for IoT device

I'm developing an IoT system that uses small nodes connected through RF. This allows messages under 250 bytes long. You can check it at https://github.com/gmag11/EnigmaIOT. All messages are encrypted ...
2
votes
2answers
473 views

openSSL created CSR signature size of 73 bytes but should't it be 70 bytes

after creating CSR using openSSL with secp256r1 curve inspecting the file using openssl asn1parse -i -in ecTest.csr the size of ...
0
votes
0answers
59 views

What's the meaning of cached certificate revocation list and online certificate revocation list in X509RevocationMode Enum?

In this article, there are cached certificate revocation list and online certificate revocation list terms used. I tried to find ...
4
votes
0answers
253 views

RSASSA-PSS in TLS 1.2

I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3. But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2? Is it possible to use ...
2
votes
3answers
4k views

X509 certificate

I am studying the X509 certificate structure and here is an OpenSSL configuration file for generating the certificate. ("sth" just mean the actual string is removed) ...
0
votes
1answer
2k views

Difference Between PEM vs P12 vs CRT vs JKS vs keystore vs PKCS vs x509 certificates [duplicate]

Sorry noob here. I am so much confused about lot of files used client authentication certificates. Can anyone guide me on the difference between PEM vs P12 vs CRT vs JKS vs Keystore vs PKCS vs x509 ...
2
votes
0answers
47 views

Detecting revoked keys long after a document is signed

Scenario: A document is signed with a compromised private key, with a long-term time stamp. The normal expiration date of the key pair is D. The rightful owner of the key pair discovers the compromise ...
3
votes
1answer
122 views

Manually creating a GPG Public Key

I want to manually create a GPG public key that can be imported into GPG, i.e. I want to create a file with a Public-Key Packet, a User ID Packet and a Signature Packet (for an example see here). I ...
0
votes
0answers
42 views

Generate version 3 x509 certificate from version 1 CA

Please do forgive me for my naivety. I have inherited a legacy system wherein the CA which signs the certificate is of version 1. Is it possible to generate a x509 version 3 certificate which is ...
0
votes
1answer
52 views

What if the CSR is intercepted in transit while sending it to CA?

I was studying PKI the other day and I had a serious thinking about the following question. What is CSR? - It is a block of encoded text that is given to the CA when applying for an SSL certificate ...
0
votes
0answers
19 views

Digital signature from hashing encrypted webpage

I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...
4
votes
1answer
962 views

What information is signed by a Certification Authority?

What data does a CA sign? I know that in a certificate there is plenty of information such a the serial number of the certificate itself, the X.509 version number, the user public key, the asymmetric ...
1
vote
0answers
100 views

is it possible to achieve authenticated key agreement without using PKI or pre-shared secret?

After reading different techniques to achieve authenticated key-agreement (X3DH, HMQV, Asynchronous Ratcheting tree, An efficient protocol for authenticated key agreement, I understood that all these ...
0
votes
1answer
57 views

OpenSSL - What Data Is Used To Create A Certificate's Digital Signature?

I am coming up-to-speed on OpenSSL certificates. In all of my research I see where "data" is hashed to create a hash value that is used as the basis for a certificate's digital signature. This hash ...
0
votes
0answers
17 views

Extract Certificates from Package File on Mac

I would like to manually verify the certificate chain on a package from my MacOS Catalina. I know that you can use the codesign --extract-certificates to extract certificates from applications, but I ...
1
vote
1answer
97 views

How message digest hash is used in RSA digital certificate verification

This is how I understand digital signature verification to work in general: Plaintext gets run through a hashing mechanism to make a message digest (IBM's terminology, there appear to be plenty of ...
5
votes
4answers
9k views

Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...
1
vote
0answers
49 views

Review: peer-to-peer encrypted communication

I'd like to ask you to review security of the following communication scheme: network is strictly P2P, based on DHT (peer discovery) root user can create a virtual private network (network private ...
1
vote
1answer
24 views

Is a Qualified Digital Certificate backward compatible with existing certificate code?

I'm trying to determine if our digital signature generation code will work without change using a European Qualified Digital Certificate in place of the RSA signing certificate that we normally use. ...
1
vote
0answers
33 views

Sorted merkle tree versus rsa accumulator

When compared to sorted merkle tree and rsa accumulator, which one is the best? Rsa accumulator has constant proof and it adds/deletes at constant cost. What is the verification cost for rsa ...
0
votes
0answers
21 views

Rsa accumulator verification cost gor nonmembership testing

What is the verification cost of rsa accumulator gor non-membership testing. Is it O(N) or O(1). Can somebody explain it to me?
0
votes
0answers
20 views

Merkle tree verification cost calculation

I am trying to understand how to calculate verification cost of sorted merkle tree in case of exclusion proof. For example 5 revoked certificate are kept in merkle tree. How can i calculate storage ...
2
votes
0answers
49 views

Rsa accumulator storage size

Rsa accumulator's storage complexity is known as O(1). However, how can i calculate size of accumulator value in byte?
1
vote
0answers
128 views

certificate revocation list file size

Crl files are growing linearly. I wonder with 10 revoked certificate, what is the storage size of crl file and so on. For every revoke certificate, how much increase the size of the crl?
1
vote
1answer
57 views

X.509 ECDSA signature field in DER format includes '00' between bit string and sequence of r and s

I created a X.509 certificate with ECDSAwithSHA256(OID=1.2.840.10045.4.3.2) by openssl. ECC parameter is secp256r1. Following is the signatureAlgorithm and signatureValue. ...
0
votes
0answers
31 views

Implementing ESignature and digital certificate

I'm having some issue understanding the mechanism of electronic signature and how implementing it Here what I understood, correct me if I'm wrong: (Client is here an android or ios device. Server ...
3
votes
1answer
48 views

Enforce weak RSA in TLS

I'm going to give a small talk on the mathematical background of RSA. My audience will consist mostly of software engineers and to make the mathematical stuff tangible, I wanted to demonstrate how to ...
1
vote
0answers
30 views

Keeping a backup of asymmetric keys with the help of a certificate authority without losing the privacy

First I'll explain the problem, then I will also give a solution(it might be wrong) I've found for it, you let me know what you think about this solution and whether you have a better one. Assume a ...

1
2 3 4 5