Questions tagged [certificates]

A certificate consists of a public key and information about the owner (e. g. the name of a person or server).

Filter by
Sorted by
Tagged with
1
vote
0answers
101 views

Certificate Master Public Key with Pairing

I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(...
1
vote
2answers
123 views

Are there example certificates available for test purposes?

Are there example certificates (PEM format) for testing available somewhere ? For test purposes I would need a certificate signed with SHAS256/ECDSA P-256, together with a complete chain to test ...
1
vote
1answer
152 views

Can I discard a specific X509 signature from file?

I'm writing a program to sign files using X.509 certificates and .NET framework classes. My users can sign the same file more than once without any problem (like a revision process). So, a file may ...
1
vote
0answers
51 views

Direct Anonymous Attestation

Could anyone explain me Direct Anonymous Attestation in general terms. I have been trying to read the paper but I really cannot seem to get my head around it. It may seem like a dumb question but I am ...
1
vote
0answers
89 views

IX509Extension XCN encoding?

I understand from reading MSDN that the X509 v3 extensions must be handcrafted. This involves the CRL, AIA, name and policy constraints, policy mapping, private key usage period, and subject ...
1
vote
1answer
145 views

Why rogued certificate from hash collision is harmful

I cannot understand why rogued certificate is thought harmful though It can be used to impersonate some website. The attacker can craft a rogued certificate with different identities and public key ...
1
vote
1answer
1k views

Meaning of Signature hash algorithm field in certificate

I'd like to understand what is the meaning of this field, especially considering that when calling a crypto library to sign data the digest method is specified by the caller. For example, this simple ...
1
vote
1answer
497 views

Unique assignment of X.509 certificate to each client

I'm trying to implement a short scale electronic voting application in a domain comprised of no more than 100 clients. System administrator is able to create new election instances and each client is ...
1
vote
0answers
1k views

RSA - Why should we sign hash rather than raw content? [duplicate]

Apart from obvious performance considerations, is there any mathematical or crypto reasons that imply that we sign a hash rather than a raw content ? I read that it was because the hash must fit in ...
0
votes
2answers
665 views

What is the most important piece of information in a X.509 certificate?

X.509 has a structure which contains information like version number, serial number, signature algorithm, issuer, subject name, subject public key, signature of the issuer etc. However, I'm having ...
0
votes
2answers
119 views

How are CRL implemented?

The source from where I learn states:- CRL (Certificate Revocation List) is the primary means of checking status of certificates offline. But I can't seem to understand how is it possible for a ...
0
votes
1answer
303 views

Is the only use for the private key of a root certificate signing certificates issued by it?

A root certificate can be used to issue intermediate certificates. The private key of the root certificate is needed in order to sign any intermediate certificates. However, after that, we only need ...
0
votes
1answer
1k views

Which algorithm should be used to replace SHA512withRSA? [closed]

We are working on the web application that is basically generating a self-signed certificate during the installation. It's a Java based app and for generation of the certificate we are using ...
0
votes
1answer
6k views

where should private and public keys be stored? [closed]

I am kind of confused whether should a newly generated key pair be stored in a keystore or in just a normal plain text file? From what I read from online source, there are serveral explainations ...
0
votes
1answer
136 views

Understanding hybrid cryptography's concepts: signing and CA

After learning about symmetric encryption, public-key encryption, one-way hash, digital signature and digital certificate, I was tasked to think of an imaginary hybrid cryptosystem. I was thinking ...
0
votes
1answer
44 views

Why CA does not have to be online?

I'm learning publick key infrastructure and certificate authority. But I cannot understand below conecepts. Unlike KDC or public key authority, CA does not have to be online to provide keys to ...
0
votes
1answer
2k views

how to validate cert when signed cert has authority key id but signing cert doesn't?

Say I have the following signing cert: ...
0
votes
2answers
548 views

Why is a certificate needed at client side

I was wondering why you need a certificate of the server at client side. Can't you just fetch it from the CA itself? I am using mbedtls to program some small client, and in all the client examples ...
0
votes
1answer
727 views

How can I verify a client's identity by requesting a digital certificate?

So I am registering users and I need to know they really are who they say they are. More importantly that they represent the company they say they represent. I was told I can ask them to send me a ...
0
votes
1answer
106 views

Is there a way to inercept encrypted https connections by mimicking a cert authority?

In this video, it is shown how encryption can be theoretically intercepted without the client noticing it. In short something in between the connection could make a handshake with the requested ...
0
votes
1answer
45 views

How is a digital certificate generated?

I understand that the role of a Certificate Authority is to SIGN (not encrypt) a certificate. The signed certificate will theoretically contain: Plain text of data, including the server's public key ...
0
votes
2answers
130 views

Self signed certificate for mobile app and backend from same company

My company's product is Android and iOS mobile app which connects to our own backend. All interactions of the mobile app are with backend developed by our own company. In such a situation, can the ...
0
votes
1answer
128 views

Certificate revocation

When someone claims that the private key corresponding to the public key has been stolen, and sends to the CA a statement of this fact signed with respect to public key pk. Why doesn't the CA need ...
0
votes
1answer
103 views

Create self signed certificate from modulus, private and public exponents of RSA

I have the values of RSA public exponent $e$, the secret exponent $d$ and the modulus $n$. How can I create (for example using openssl) a self-signed certificate using the RSA key $(n,d), (n,e)$? Is ...
0
votes
1answer
65 views

Observing cipher suites and certificate algorithms without man-in-the-middle

I manage a proxy server. Is it technically possible to observe and determine which cipher suite is selected between end points (client and server) without changing their SSL certificate, without ...
0
votes
1answer
620 views

Windows certreq full response file [closed]

I'm using the Windows certreq command line tool to submit a CSR for signing to a Windows Server CA. ...
0
votes
1answer
252 views

How can I verify certificate signature algorithm in TLS 1.3 using PSS?

I've read this post but I'm still unable to understand some things. I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's ...
0
votes
1answer
43 views

When a program using openssl library is using a certificate, does the server check if the issuer(s) are still valid

If I have a program acting as TLS server with a certificate signed by a CA, if one of the issuers in the chain becomes invalidated or the date expires, then how does the program using the certificate ...
0
votes
1answer
126 views

Link between openssl 'req' command and 'unable to get local issuer certificate'?

I was using the following command to build a self-signed certificate after creating a private key: ...
0
votes
2answers
68 views

Should Bob trust a certificate issued by delegated party?

Consider this scenario: Alice sends a message signed under her public key to Bob. Bob has never exchanged a keys with Alice. Alice's key is signed by a certain X. X's key is signed by Y, an entity ...
0
votes
1answer
219 views

Digital certificate issuing man-in-the-middle attack

While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key). To certify a domain ...
0
votes
1answer
136 views

Changing the public key in an MD5 certificate

Given a valid, signed X.509 certificate using the MD5 digest algorithm and an RSA public key, how feasible would it be to generate a public key which would, all other parts of the certificate being ...
0
votes
1answer
287 views

How can i verify a certificate to root? [closed]

I write some certificate Authority that has it's own private/public cert keys . This CA signs public keys of user. If for example i have user that has a public cert that signed by the CA. How I can ...
0
votes
1answer
61 views

Encrypted cerficiate signature for server certificate and intermediate certificate in packet capture

If we view the certificate chain using Firefox, we can see the certificate signature of "server certificate" and its "intermediate-CA" right after the "certificate signature algorithm" in the ...
0
votes
1answer
122 views

Questions about the certificate authority procedures

I am beginner in cryptography and now I try to understand certificate process. I read this answer and have some questions about the enrollment process: The general procedure to issue certificates ...
0
votes
1answer
136 views

signature reconstruction in X.509 certificate with root private key

I created a root CA, let's say A. I created the Certificate Signing Request (CSR) for B, and get the certificate signed by A. I would like to know of what exact content the signature is made. This ...
0
votes
1answer
92 views

How to change the policy value of a CA identity in apple keychain?

According to this guide, I made an intermediate CA, and successfully used it to sign app in Windows. However, after converted it into a Apple keychain (by this guide), this CA become having an "iChat" ...
0
votes
1answer
7k views

What is the correct format for a CRLF in a SSL certificate's pem

Currently I am working with SSL certificates inside a Ruby on Rails application. I am storing the certificates in a database along with the corresponding dhparam, and chain. At some point I want to ...
0
votes
1answer
75 views

Method to verify a signed archive's X.509 CoT

I am trying to understand the key high level details behind verifying trust when downloading an archive. This is my understanding of how it could be done: On the Software Developer side: Obtain a ...
0
votes
1answer
63 views

Same certificate for server authentication and authorizatoin in other system

I have a program which acts as a node in a larger system. Those nodes can be connected to form a tree. TLS with mutual authentication is required, which means that each node has it's own certificate. ...
0
votes
1answer
225 views

X509 Cert exploit CA check

Assumptions Let's theoretically assume that a browser skips the check that a certificate it receives belongs to the stated CA (that's an exercise). How could I exploit this in order to impersonate ...
0
votes
2answers
130 views

Certificate Path Verification of X509 Certificate

I have the trusted root certificate which I am validating using the self signed key. I also have the intermediate certificate, which i am validating using the root certificate. Now when i am ...
0
votes
1answer
105 views

Workaround to implementing Forward Secrecy

In the case where I am self-signing my digital certificates, if I just change my certificate (generate a new one) every week or month, will this have (sort of similar to) the same effect as ...
0
votes
0answers
8 views

Extract Certificates from Package File on Mac

I would like to manually verify the certificate chain on a package from my MacOS Catalina. I know that you can use the codesign --extract-certificates to extract certificates from applications, but I ...
0
votes
0answers
13 views

Rsa accumulator verification cost gor nonmembership testing

What is the verification cost of rsa accumulator gor non-membership testing. Is it O(N) or O(1). Can somebody explain it to me?
0
votes
0answers
13 views

Merkle tree verification cost calculation

I am trying to understand how to calculate verification cost of sorted merkle tree in case of exclusion proof. For example 5 revoked certificate are kept in merkle tree. How can i calculate storage ...
0
votes
0answers
25 views

Implementing ESignature and digital certificate

I'm having some issue understanding the mechanism of electronic signature and how implementing it Here what I understood, correct me if I'm wrong: (Client is here an android or ios device. Server ...
0
votes
0answers
26 views

Will CT (Certificate Transparency) override the use of CAA and/or DANE/TLSA records?

I'd want to know if some of these competing technologies has more chance to survive. It seems they are thought to solve a similar problem by different manners and I'd want to stick to the most ...
0
votes
0answers
57 views

How does DHE-RSA work and why is PFS guaranteed?

How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.
0
votes
0answers
81 views

How to validate the authenticity and integrity of an XML document?

I am working on a C++ desktop application that reads an XML (also created by my org) from a public server (does not require authentication). I would like to make sure that the downloaded XML has not ...