52
votes
Accepted
Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?
Yes, SHA1-signed certificates are unsafe.
The SHAttered paper is instructive. From the introduction:
The MD-SHA family of hash functions is the most well-known hash function family, which ...
- 49.5k
49
votes
Accepted
Who is responsible for ensuring the trustworthiness of certificate authorities?
Maarten Bodewes answer is correct but I think the heart of your question is a major hurdle people face in understanding certificates and CAs. I think it's worth elaborating on the part of how this ...
- 616
34
votes
Who is responsible for ensuring the trustworthiness of certificate authorities?
There has to be some point where you trust something. Operating system come with 'root' certificate authorities. Those certificates are either installed when you install the operating system, or ...
- 529
32
votes
Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?
The existence of the SHAttered result is not, I think, in itself a surprise: everyone knows that in theory you can create two streams of bytes that hash to the same value. Google's achievements (which ...
- 94.5k
17
votes
Accepted
Do certificates need to be stored as encrypted?
What is not so obvious is if the certificates used to verify a TLS connection should be stored as encrypted to. It is likely that the root level certificates will be self signed and have no chain back ...
- 151k
12
votes
Who is responsible for ensuring the trustworthiness of certificate authorities?
No because the browser that you use has a build in security store, so it is perfectly possible to create a secure connection to the CA.
Generally you can only request certs for your specific domain, ...
- 94.5k
12
votes
Smallest possible certificate for IoT device
What is the minimum, secure enough, certificate that you can build? How could I generate it using OpenSSL?
Generally you'd need to flatten certificates if you want to go below 256 bytes. X.509 ...
- 94.5k
12
votes
Accepted
Clarification on the TLS verification process
The article is wrong, but not there. It's the previous sentence that's incorrect. "The first process is to take the signature on the bottom of the certificate and decrypt it with the CA's public ...
- 5,899
11
votes
Do certificates need to be stored as encrypted?
Certificates that contains public-keys don't need to be encrypted, as the public-key algorithm ensures that nobody can "decrypt" public-key into private keys.
However, there's a special type ...
- 9,795
11
votes
What is Cross signing of root certificates and how does it help at time of root certificate expiry?
No, cross certificates and cross signing are not really different things, and it is true that both intermediate CAs and what we normally call root CAs can be cross-certified.
Your confusion may be due ...
- 6,474
10
votes
Accepted
Why is a CSR signed and which key is used for signing?
[Why] is the CSR istself signed?
The CSR is signed to ensure consistency of the data in it in a similar way to how root certificates are also self-signed. Additionally signing the CSR proves ...
- 46.4k
8
votes
Accepted
openSSL created CSR signature size of 73 bytes but should't it be 70 bytes
The "extra" octet is needed because ASN.1 uses two's complement notation for integers, per section 8.3.3 of X.690:
The contents octets shall be a two's complement binary number equal to
the ...
- 1,583
7
votes
Accepted
What is the maximum length of a X.509 OID?
OIDs don't have a maximal length / depth specified. There is no real value where you can safely cut them off - or rather reject them (raise an exception or error). Anything over 20 bytes seems ...
- 94.5k
7
votes
Deduce modulus N from public exponent and encrypted data
Given a message $M$, define the corresponding RSA ciphertext as $C = M^e \bmod N$. We assume that the value of $N$ is kept secret. However, the attacker is given oracle access to the encryption: on ...
- 1,779
7
votes
Accepted
Creating certificate: Where is my private key stored?
Typically you send a Certificate Signing Request (CSR) to the CA. The CSR contains everything you want to be inside your certificate, including your public key. The CA takes a look, and if it likes it,...
- 2,627
7
votes
Who is responsible for ensuring the trustworthiness of certificate authorities?
This is a very good question.
Public-key certificates have the purpose to authenticate an assertion, namely that you are communicating with the entity that you intend to communicate with. ...
- 281
7
votes
Smallest possible certificate for IoT device
There are two questions here: What's the minimum, and what's the minimum standard certificate you can build. The former is shorter than the latter, as noted in Maarten Bodewes' answer.
If you're ...
- 5,899
7
votes
How can a root CA be kept offline and function
An offline root ca setup could look like this:
Create the root CA
This should be done on an PC disconnected from any external network and in most cases is done on an HSM.
This part is sometimes done ...
6
votes
Accepted
What information is signed by a Certification Authority?
The information that is signed may differ by certificate, but basically the procedure can be found by looking at RFC 5280 and working downward:
4.1.1.3. signatureValue
The signatureValue field ...
- 94.5k
6
votes
What does "G2" mean when used with X509 certficates and certificate authorities?
Yes, G stands for "Generation". When CA needs to get a new chain they just increment the generation number.
For example GoDaddy's signatures:
G3 - ...
- 161
6
votes
Accepted
What is the most important piece of information in a X.509 certificate?
As fgrieu says in his comment, the answer to this question is ambiguous; it depends on what you use the certificate for.
You can perfectly trust a certificate, without having a CA signature. A CA ...
- 2,480
6
votes
Accepted
Why is the signatureAlgorithm field in X.509 certificates redundant?
From RFC 5280 r.e TBSCertificate.signature
This field contains the algorithm identifier for the algorithm used
by the CA to sign the certificate.
This field MUST contain the same algorithm ...
- 819
6
votes
Why is the signatureAlgorithm field in X.509 certificates redundant?
There is no difference. RFC 5280 even requires $\tt signatureAlgorithm$ and $\tt signature$ to be the same.
According to this discussion on the PKIX mailing list, the reason for the redundancy is that ...
- 1,323
6
votes
Accepted
What happens when a root CA loses its private key?
What happens when such a device is lost (fire, electronic fault,
stolen, etc)?
Assuming the HSM is stolen: The CA will likely inform the police so they can hunt the thief down, then they will ...
- 46.4k
6
votes
Accepted
Which algorithm should be used to replace SHA512withRSA?
In standard Java libraries, SHA512withRSA designates signature per RSASSA-PKCS1-v1_5 with SHA-512. There is no known attack when used with a sufficient RSA modulus ...
- 145k
6
votes
Accepted
Why does curl need both root and intermediate certificates in order to securely connect to an HTTP server?
(0) this isn't really about crypto and would probably be better on security.SX, which has lots of Qs about certificate chaining and HTTPS browser and server usage, but ...
(1) while AIA is used more ...
- 6,474
6
votes
Who is responsible for ensuring the trustworthiness of certificate authorities?
One idea I find useful in this context is looking at cryptographic systems not as absolute ways of achieving guaranteed security, but rather, as ways of reducing bigger problems to other problems that ...
- 14.7k
6
votes
Accepted
How does TLS 1.3 provide authentication without using the public key to verify that the server has a private key?
... the public key from the certificate was used to encrypt the data to create a symmetric encryption key, hence the authentication took place on the factor of knowing the private key, as it is needed ...
- 1,613
5
votes
Why is a CSR signed and which key is used for signing?
There are several benefits for enforcing signature on the CSR.
Signing of the CSR provides strong proof that the public key that will end up in the certificate is a valid public key for which there ...
- 311
5
votes
Accepted
Certificate Authority RSA key expiration?
To understand why CAs need to rotate their RSA keys less often, let's first investigate why end-users have to rotate their keys / certificate every few years.
There are three main reasons why end-...
- 46.4k
Only top scored, non community-wiki answers of a minimum length are eligible