Questions tagged [certificates]

A certificate consists of a public key and information about the owner (e. g. the name of a person or server).

Filter by
Sorted by
Tagged with
1
vote
0answers
61 views

Benefits of using SSL certificate over a raw key pair for non-browser use?

For applications not involving CA signed certificates – or web browsers for that matter – it would seem to be easier to use a raw key pair if possible, rather than deal with potential formatting ...
0
votes
1answer
207 views

Link between openssl 'req' command and 'unable to get local issuer certificate'?

I was using the following command to build a self-signed certificate after creating a private key: ...
2
votes
1answer
90 views

CAs are pre-loaded on the system, but how is it able to get intermediate certs?

I have the following X509 certificate: ...
1
vote
2answers
1k views

Why is the signature field in X.509 a BIT STRING, despite there being ASN.1 (DER) data inside?

As can be seen from the following ASN.1 definition of an X.509 certificate, the Signature field is a BIT STRING. ...
0
votes
2answers
71 views

Should Bob trust a certificate issued by delegated party?

Consider this scenario: Alice sends a message signed under her public key to Bob. Bob has never exchanged a keys with Alice. Alice's key is signed by a certain X. X's key is signed by Y, an entity ...
2
votes
1answer
1k views

What happens when a root CA loses its private key?

Certificate Authorities normally keep their private keys inside dedicated Hardware Security Modules (HSMs). What happens when such a device is lost (fire, electronic fault, stolen, etc)? How would ...
1
vote
1answer
375 views

how to avoid attack on Certificate Revocation List by the owner of the private key?

suppose A owns the private key, and its correspondent certificate locates in site of CA. B request for A's certificate from CA for verifying the signature sent to him/her. There is an attack ...
4
votes
2answers
1k views

Why is the signatureAlgorithm field in X.509 certificates redundant?

See the ASN.1 description of an X.509 certificate below: ...
1
vote
1answer
807 views

How to sign a CRL file if I have offline keys?

I am generating a CA for internal use. When generating a CA, the best practice I have observed is to keep the root CA offline and emit an intermediate CA certificate that will in turn emit the end-...
1
vote
1answer
856 views

What does the PFX file extension stand for

PFX is commonly used as a synonym of PKCS#12 certificate stores. However, I've never seen an explanation why these stores are called PFX (on Microsoft platforms) in multiple articles, including those ...
0
votes
1answer
5k views

how to validate cert when signed cert has authority key id but signing cert doesn't?

Say I have the following signing cert: ...
0
votes
3answers
178 views

How to encrypt a message such when a certain condition is met it can be decrypted?

Assume, there is a certificate authority whose public key: $pk$, is known. Also, the certificate $c$ is known, but not the signed certificate. I want to encrypt a message: $m$, such that whoever has a ...
-3
votes
1answer
99 views

Are there stenography benefits to a "n-prime"?

As mentioned in this StackOverflow CodeGolf question, prime numbers can be redefined: One of my favorite definitions of the prime numbers goes as follows: 2 is the smallest prime. ...
2
votes
1answer
1k views

Can I apply "encrypt with public key and decrypt with private key concept" using ECC certificate?

If Alice wants to send encrypted message to Bob, she can use Bob's public key to encrypt the plain message. Once Bob reliably gets encrypted message, he can decrypt it with his private key. In this ...
2
votes
2answers
228 views

What data Certificate Authority encrypt for CSR?

I have been searching for a detailed explanation but can’t seem to find a low level one. 1) When CA sign the data with its private key, the encrypted data is APPENED to the csr or the whole cert ...
3
votes
2answers
190 views

Transferable ownership certificate

Is there a crytpographic way to assert ownership of an asset (let's say a piece of stone)? As an example, a number (public key) could be engraved in the stone, and the owner could keep a private key (...
0
votes
1answer
248 views

Digital certificate issuing man-in-the-middle attack

While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key). To certify a domain ...
0
votes
1answer
143 views

Changing the public key in an MD5 certificate

Given a valid, signed X.509 certificate using the MD5 digest algorithm and an RSA public key, how feasible would it be to generate a public key which would, all other parts of the certificate being ...
0
votes
1answer
696 views

How can i verify a certificate to root? [closed]

I write some certificate Authority that has it's own private/public cert keys . This CA signs public keys of user. If for example i have user that has a public cert that signed by the CA. How I can ...
1
vote
2answers
878 views

Is it safe to include the public certificate in xml digital signatures?

My understanding of XML Digital Signatures: Let's use a SAML token as an example. Note - for the sake of simplicity I'm omitting some details like CanonicalizationMethod, base64 encoding, etc. In ...
-2
votes
1answer
134 views

Can two different CA's/End Entities in different PKI's have the same asymmetric key pair?

Example: $X$ and $Y$ have the same asymmetric key pair. $X$ communicates with $A$ and gives it's PubKey to $A$. So, $A$ has the PubKey of $X$ which also happens to be the PubKey/PrivKey of $Y$. ...
1
vote
1answer
348 views

Is allowing both digitalSignature and keyEncipherment certificate usages a bad practice?

From what I see, many server and client RSA certificates in the real deployments have the "key usage" mask containing both digitalSignature and keyEncipherment. Isn't this a bad (that is, potentially ...
5
votes
3answers
11k views

Is there a complete list of Signature Algorithm names?

I need to analyze the output of rbsec's sslscan which reports a server's SSL/TLS configuration as reported by OpenSSL. I'm interested in the Certificate's Signature Algorithm in particular, and I was ...
16
votes
1answer
1k views

Who issued the first SSL certificate?

When SSL was introduced in ~1996, there was only a few CAs issuing certificates for that specific use and a few sites which actually used SSL. Which Certification Authority issued the first SSL ...
1
vote
0answers
115 views

Certificate Master Public Key with Pairing

I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(...
0
votes
1answer
77 views

Encrypted cerficiate signature for server certificate and intermediate certificate in packet capture

If we view the certificate chain using Firefox, we can see the certificate signature of "server certificate" and its "intermediate-CA" right after the "certificate signature algorithm" in the ...
1
vote
1answer
99 views

Direct Anonymous Attestation to replace CA

In term of authentication, I have the impression that to trust an entity it is mandatory to have a Certification Authority involve. Today I stumble upon an article something called Direct Anonymous ...
1
vote
2answers
197 views

Create broken chain certificates for testing

In our software we receive certificates in binary DER format from our clients. They are in advance used to perform certain identity checks between server and client. To ensure the certificates are ...
0
votes
1answer
138 views

Questions about the certificate authority procedures

I am beginner in cryptography and now I try to understand certificate process. I read this answer and have some questions about the enrollment process: The general procedure to issue certificates ...
0
votes
1answer
192 views

signature reconstruction in X.509 certificate with root private key

I created a root CA, let's say A. I created the Certificate Signing Request (CSR) for B, and get the certificate signed by A. I would like to know of what exact content the signature is made. This ...
2
votes
1answer
199 views

Creating certificate: Where is my private key stored?

I have some problems to understand the storage of my private key when a CA generates my key pair. Let's assume the CA creates my key pair, issues the certificate with my public key and signs it with ...
1
vote
3answers
233 views

Digital Certificates genereted from Hardware Security Module

Software library without hardware based source of entropy will provide enough security to generate digital certificates. However Hardware security Modules provide hardware based source of entropy and ...
0
votes
2answers
576 views

Why is a certificate needed at client side

I was wondering why you need a certificate of the server at client side. Can't you just fetch it from the CA itself? I am using mbedtls to program some small client, and in all the client examples ...
1
vote
1answer
428 views

sign data and append certificate VS sign data and certificate

I am currently writing my masters thesis in which I need to develop a licensing module for an application. The license itself is a JSON Web Token which is signed using a RSA private key. Since we ...
0
votes
2answers
809 views

What is the most important piece of information in a X.509 certificate?

X.509 has a structure which contains information like version number, serial number, signature algorithm, issuer, subject name, subject public key, signature of the issuer etc. However, I'm having ...
5
votes
1answer
137 views

Signature verifying against multiple certified public keys?

I'm wondering if and how the current public key certificate infrastructure is guarded against the following scenario: Honest Alice obtains Eve's public key certificate Certe, made by honest CA Carol; ...
0
votes
0answers
59 views

Should a certificate be validated every time it is used?

In contrast to private keys, public keys don't need to be stored on a secure place. But what if somebody changes a certificate with a public key to just another one? To ensure certificate authenticity,...
2
votes
1answer
711 views

X509 CertificatePolicies, IssuerAlternativeNames, BasicConstraints extensions. What is done when Issuer signs?

I have got one theoretical question related to extensions of X509 Certificate. More precisely I have question about what is happening when issuer signs subject's certificate with has several ...
0
votes
1answer
96 views

How to change the policy value of a CA identity in apple keychain?

According to this guide, I made an intermediate CA, and successfully used it to sign app in Windows. However, after converted it into a Apple keychain (by this guide), this CA become having an "iChat" ...
0
votes
2answers
132 views

How to configure a client browser cert to be authenticated by a server?

I currently am being asked to partake in a strange authentication format while working with a client, and was hoping for clarification. The client is using HTTPS with client certificate ...
1
vote
1answer
784 views

Raw signature of public key vs full certificate

I'm working on an device that will have its own keypair to sign data that it acquires. The public key will be signed with a provisioning key to ensure authenticity of the device. I want to put the ...
0
votes
1answer
848 views

How can I verify a client's identity by requesting a digital certificate?

So I am registering users and I need to know they really are who they say they are. More importantly that they represent the company they say they represent. I was told I can ask them to send me a ...
1
vote
1answer
604 views

Best practice to create certificate by CA

I suppose that I have this scenario: Root CA Intermediate CA Practice 1: The Root CA generates her own $PK_r$ and $PB_r$ key, and after it makes her certificate $Cert_r$. The Intermediate CA ...
4
votes
1answer
1k views

What is the maximum length of a X.509 OID?

I'm working on a feature for a project to determine if a given X.509 certificate is an EV Certificate, and if so, who is the authority behind that certificate. To do this, I grabbed the list of EV ...
4
votes
1answer
86 views

Why are some websites seemingly immune to self-signed certificate MitM attacks?

I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and ...
3
votes
1answer
108 views

How can I validate a given Server-Certificate behind a HTTPS-connection?

I know more or less about how TLS works in principle. But how can I be sure, that the certificate behind a server's web site (e.g. tele-banking from my bank) has been issued to my bank and not to ...
1
vote
1answer
10k views

What is the correct format for a CRLF in a SSL certificate's pem

Currently I am working with SSL certificates inside a Ruby on Rails application. I am storing the certificates in a database along with the corresponding dhparam, and chain. At some point I want to ...
4
votes
3answers
2k views

Deduce modulus N from public exponent and encrypted data

This is an RSA question, given data encrypted with a public key from an unknown RSA certificate of 2048 bit, let $X$ be the encrypted data, $M$ the unencrypted data, $c$ the public exponent and $N$ it'...
1
vote
1answer
1k views

How can a company have its own Certificate Authority for internal use?

It is possible for a company to deploy its own CA ? How would browsers accept the certificates ? Supposing a company does not want to use the role of a commercial server like Windows Server or any ...
3
votes
3answers
456 views

Does the Shappening mean HTTPS can be broken?

For years we've been warned that SHA-1 is weaker than originally thought and should not be used. This reached its peak with the Shappening and experts from Schneier on down have been warning that we ...