Questions tagged [certificates]

A certificate consists of a public key and information about the owner (e. g. the name of a person or server).

Filter by
Sorted by
Tagged with
0
votes
2answers
115 views

Self signed certificate for mobile app and backend from same company

My company's product is Android and iOS mobile app which connects to our own backend. All interactions of the mobile app are with backend developed by our own company. In such a situation, can the ...
2
votes
1answer
925 views

How can Bob validate Alice’s certificate?

Suppose that Alice has a certificate CA1 << Alice >> issued by the certification authority CA1, and Bob has a ...
2
votes
1answer
72 views

Secure scheme to share symmetric key using asymmetric keys and certificates with N parties

I need to distribute symmetric AES key into number of end points which will use it to decrypt data. The AES key will be the same on all end points, it is not possible to generate unique on every end ...
1
vote
1answer
199 views

Secure Design and CRL?

I was at my College Security Lesson, the professor said that Certificate Revocation Lists (CRLs) violate some of the Secure Design principles. Secure Design Principles: Fail-Safe Defaults Economy of ...
2
votes
1answer
892 views

RSA certificate needed in CVC format

I had a client requirement asking me to provide an existing base64 encoded certificate in a CVC format. Could someone point me in the right direction here to understand what this format is? How can I ...
2
votes
1answer
140 views

X.509 strong authentication protocols

Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the ...
1
vote
0answers
46 views

Benefits of using SSL certificate over a raw key pair for non-browser use?

For applications not involving CA signed certificates – or web browsers for that matter – it would seem to be easier to use a raw key pair if possible, rather than deal with potential formatting ...
0
votes
1answer
118 views

Link between openssl 'req' command and 'unable to get local issuer certificate'?

I was using the following command to build a self-signed certificate after creating a private key: ...
2
votes
1answer
75 views

CAs are pre-loaded on the system, but how is it able to get intermediate certs?

I have the following X509 certificate: ...
1
vote
2answers
808 views

Why is the signature field in X.509 a BIT STRING, despite there being ASN.1 (DER) data inside?

As can be seen from the following ASN.1 definition of an X.509 certificate, the Signature field is a BIT STRING. ...
0
votes
2answers
68 views

Should Bob trust a certificate issued by delegated party?

Consider this scenario: Alice sends a message signed under her public key to Bob. Bob has never exchanged a keys with Alice. Alice's key is signed by a certain X. X's key is signed by Y, an entity ...
2
votes
1answer
782 views

What happens when a root CA loses its private key?

Certificate Authorities normally keep their private keys inside dedicated Hardware Security Modules (HSMs). What happens when such a device is lost (fire, electronic fault, stolen, etc)? How would ...
1
vote
1answer
268 views

how to avoid attack on Certificate Revocation List by the owner of the private key?

suppose A owns the private key, and its correspondent certificate locates in site of CA. B request for A's certificate from CA for verifying the signature sent to him/her. There is an attack ...
4
votes
2answers
965 views

Why is the signatureAlgorithm field in X.509 certificates redundant?

See the ASN.1 description of an X.509 certificate below: ...
1
vote
1answer
526 views

How to sign a CRL file if I have offline keys?

I am generating a CA for internal use. When generating a CA, the best practice I have observed is to keep the root CA offline and emit an intermediate CA certificate that will in turn emit the end-...
1
vote
1answer
624 views

What does the PFX file extension stand for

PFX is commonly used as a synonym of PKCS#12 certificate stores. However, I've never seen an explanation why these stores are called PFX (on Microsoft platforms) in multiple articles, including those ...
0
votes
1answer
2k views

how to validate cert when signed cert has authority key id but signing cert doesn't?

Say I have the following signing cert: ...
0
votes
3answers
139 views

How to encrypt a message such when a certain condition is met it can be decrypted?

Assume, there is a certificate authority whose public key: $pk$, is known. Also, the certificate $c$ is known, but not the signed certificate. I want to encrypt a message: $m$, such that whoever has ...
-3
votes
1answer
89 views

Are there stenography benefits to a “n-prime”?

As mentioned in this StackOverflow CodeGolf question, prime numbers can be redefined: One of my favorite definitions of the prime numbers goes as follows: 2 is the smallest prime. ...
2
votes
1answer
798 views

Can I apply “encrypt with public key and decrypt with private key concept” using ECC certificate?

If Alice wants to send encrypted message to Bob, she can use Bob's public key to encrypt the plain message. Once Bob reliably gets encrypted message, he can decrypt it with his private key. In this ...
2
votes
2answers
150 views

What data Certificate Authority encrypt for CSR?

I have been searching for a detailed explanation but can’t seem to find a low level one. 1) When CA sign the data with its private key, the encrypted data is APPENED to the csr or the whole cert ...
3
votes
2answers
118 views

Transferable ownership certificate

Is there a crytpographic way to assert ownership of an asset (let's say a piece of stone)? As an example, a number (public key) could be engraved in the stone, and the owner could keep a private key (...
0
votes
1answer
216 views

Digital certificate issuing man-in-the-middle attack

While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key). To certify a domain ...
0
votes
1answer
133 views

Changing the public key in an MD5 certificate

Given a valid, signed X.509 certificate using the MD5 digest algorithm and an RSA public key, how feasible would it be to generate a public key which would, all other parts of the certificate being ...
0
votes
1answer
249 views

How can i verify a certificate to root? [closed]

I write some certificate Authority that has it's own private/public cert keys . This CA signs public keys of user. If for example i have user that has a public cert that signed by the CA. How I can ...
1
vote
2answers
621 views

Is it safe to include the public certificate in xml digital signatures?

My understanding of XML Digital Signatures: Let's use a SAML token as an example. Note - for the sake of simplicity I'm omitting some details like CanonicalizationMethod, base64 encoding, etc. In ...
-2
votes
1answer
117 views

Can two different CA's/End Entities in different PKI's have the same asymmetric key pair?

Example: $X$ and $Y$ have the same asymmetric key pair. $X$ communicates with $A$ and gives it's PubKey to $A$. So, $A$ has the PubKey of $X$ which also happens to be the PubKey/PrivKey of $Y$. ...
1
vote
1answer
112 views

Is allowing both digitalSignature and keyEncipherment certificate usages a bad practice?

From what I see, many server and client RSA certificates in the real deployments have the "key usage" mask containing both digitalSignature and keyEncipherment. Isn't this a bad (that is, potentially ...
3
votes
3answers
5k views

Is there a complete list of Signature Algorithm names?

I need to analyze the output of rbsec's sslscan which reports a server's SSL/TLS configuration as reported by OpenSSL. I'm interested in the Certificate's Signature Algorithm in particular, and I was ...
16
votes
1answer
901 views

Who issued the first SSL certificate?

When SSL was introduced in ~1996, there was only a few CAs issuing certificates for that specific use and a few sites which actually used SSL. Which Certification Authority issued the first SSL ...
1
vote
0answers
100 views

Certificate Master Public Key with Pairing

I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(...
0
votes
1answer
60 views

Encrypted cerficiate signature for server certificate and intermediate certificate in packet capture

If we view the certificate chain using Firefox, we can see the certificate signature of "server certificate" and its "intermediate-CA" right after the "certificate signature algorithm" in the ...
1
vote
1answer
81 views

Direct Anonymous Attestation to replace CA

In term of authentication, I have the impression that to trust an entity it is mandatory to have a Certification Authority involve. Today I stumble upon an article something called Direct Anonymous ...
1
vote
2answers
163 views

Create broken chain certificates for testing

In our software we receive certificates in binary DER format from our clients. They are in advance used to perform certain identity checks between server and client. To ensure the certificates are ...
0
votes
1answer
117 views

Questions about the certificate authority procedures

I am beginner in cryptography and now I try to understand certificate process. I read this answer and have some questions about the enrollment process: The general procedure to issue certificates ...
0
votes
1answer
129 views

signature reconstruction in X.509 certificate with root private key

I created a root CA, let's say A. I created the Certificate Signing Request (CSR) for B, and get the certificate signed by A. I would like to know of what exact content the signature is made. This ...
2
votes
1answer
182 views

Creating certificate: Where is my private key stored?

I have some problems to understand the storage of my private key when a CA generates my key pair. Let's assume the CA creates my key pair, issues the certificate with my public key and signs it with ...
1
vote
3answers
182 views

Digital Certificates genereted from Hardware Security Module

Software library without hardware based source of entropy will provide enough security to generate digital certificates. However Hardware security Modules provide hardware based source of entropy and ...
0
votes
2answers
542 views

Why is a certificate needed at client side

I was wondering why you need a certificate of the server at client side. Can't you just fetch it from the CA itself? I am using mbedtls to program some small client, and in all the client examples ...
1
vote
1answer
380 views

sign data and append certificate VS sign data and certificate

I am currently writing my masters thesis in which I need to develop a licensing module for an application. The license itself is a JSON Web Token which is signed using a RSA private key. Since we ...
0
votes
2answers
644 views

What is the most important piece of information in a X.509 certificate?

X.509 has a structure which contains information like version number, serial number, signature algorithm, issuer, subject name, subject public key, signature of the issuer etc. However, I'm having ...
5
votes
1answer
120 views

Signature verifying against multiple certified public keys?

I'm wondering if and how the current public key certificate infrastructure is guarded against the following scenario: Honest Alice obtains Eve's public key certificate Certe, made by honest CA Carol; ...
0
votes
0answers
56 views

Should a certificate be validated every time it is used?

In contrast to private keys, public keys don't need to be stored on a secure place. But what if somebody changes a certificate with a public key to just another one? To ensure certificate authenticity,...
2
votes
1answer
435 views

X509 CertificatePolicies, IssuerAlternativeNames, BasicConstraints extensions. What is done when Issuer signs?

I have got one theoretical question related to extensions of X509 Certificate. More precisely I have question about what is happening when issuer signs subject's certificate with has several ...
0
votes
1answer
91 views

How to change the policy value of a CA identity in apple keychain?

According to this guide, I made an intermediate CA, and successfully used it to sign app in Windows. However, after converted it into a Apple keychain (by this guide), this CA become having an "iChat" ...
0
votes
2answers
95 views

How to configure a client browser cert to be authenticated by a server?

I currently am being asked to partake in a strange authentication format while working with a client, and was hoping for clarification. The client is using HTTPS with client certificate ...
1
vote
1answer
641 views

Raw signature of public key vs full certificate

I'm working on an device that will have its own keypair to sign data that it acquires. The public key will be signed with a provisioning key to ensure authenticity of the device. I want to put the ...
0
votes
1answer
678 views

How can I verify a client's identity by requesting a digital certificate?

So I am registering users and I need to know they really are who they say they are. More importantly that they represent the company they say they represent. I was told I can ask them to send me a ...
1
vote
1answer
518 views

Best practice to create certificate by CA

I suppose that I have this scenario: Root CA Intermediate CA Practice 1: The Root CA generates her own $PK_r$ and $PB_r$ key, and after it makes her certificate $Cert_r$. The Intermediate CA ...
2
votes
1answer
955 views

What is the maximum length of a X.509 OID?

I'm working on a feature for a project to determine if a given X.509 certificate is an EV Certificate, and if so, who is the authority behind that certificate. To do this, I grabbed the list of EV ...