53
Yes, SHA1-signed certificates are unsafe.
The SHAttered paper is instructive. From the introduction:
The MD-SHA family of hash functions is the most well-known hash function family, which includes MD5, SHA-1, and SHA-2 that have all found widespread use. This family originally started with MD4 in 1990, which was quickly replaced by MD5 in 1992 due to ...
48
Maarten Bodewes answer is correct but I think the heart of your question is a major hurdle people face in understanding certificates and CAs. I think it's worth elaborating on the part of how this works that I think you are missing.
As stated in Maarten's answer, your computer/browser has been preconfigured with a set of trusted CAs. If you are running ...
32
The existence of the SHAttered result is not, I think, in itself a surprise: everyone knows that in theory you can create two streams of bytes that hash to the same value. Google's achievements (which I don't wish to downplay) are (a) that they mustered enough resources to actually do this, and (b) they did so while keeping the colliding file a valid PDF (...
30
There has to be some point where you trust something. Operating system come with 'root' certificate authorities. Those certificates are either installed when you install the operating system, or could be downloaded over a secure connection from at least one certificate installed with the operating system.
You can (and many developers do) add your own root ...
29
It seems we have aligned interests. I'm also a university student (although I am a math/comp sci double major) looking to pursue a career in cryptography. To that end, I have been self-studying it for a while now. So, take what I say with a grain of salt. As a forewarning, this post focuses specifically on what topics cryptographers often encounter and less ...
14
The question's bytestring 2a 86 48 86 f7 0d 01 01 01 is the Value field of an ASN.1 BER/DER TLV with type 6, which is the Object IDentifier for an RSA key (the Type and Length just before are coded as 06 09, and won't be further discussed).
In order to parse that Value bytestring, we first separate the bytes into blocks ending after each byte which high-...
13
So is PKCS7 a signature format or a certificate format or both?
Neither. PKCS7 is now Cryptographic Message Syntax(CMS). From the RFC 5652:
This
syntax is used to digitally sign, digest, authenticate, or encrypt
arbitrary message content.
CMS enables interoperability between different products which can operate on the same document without ...
12
Your question is only slightly ill-defined. The problem is that the word "cryptography" is horribly overloaded. I think there are at least three different regimes of cryptography:
Cryptography in academia. As Reid said, academic cryptography mainly springs out of complexity theory. With very few exceptions, you don't need much math knowledge to succeed here;...
12
What is the minimum, secure enough, certificate that you can build? How could I generate it using OpenSSL?
Generally you'd need to flatten certificates if you want to go below 256 bytes. X.509 version 3 certificates have a certain overhead due to the ASN.1 tree structure. So those are not as efficient as they could be.
For smart card systems generally so ...
11
No because the browser that you use has a build in security store, so it is perfectly possible to create a secure connection to the CA.
Generally you can only request certs for your specific domain, e.g. by using a domain specific mail address. Generally you should also pay for the services which provider a small amount if traceability.
Of course you ...
10
Although x.509 is the standard for PKIs with CAs, different certificate formats have been defined for the other 2 major PKI approaches:
SPKI has defined its own certificate
format , still (forever?) in
draft status.
Web-of-Trust models usually use the OpenPGP certificate format defined in RFC2440
RFC4212 "Alternative Certificate Formats for the Public-Key ...
9
Yes, obviously if the CA generated your private key, they might keep it and share it with anybody.
Yes on both counts.
In fact, the normal way to generate a certificate -- whether for a Web server (TLS) or for yourself (S/MIME or TLS client) -- is to create a "Certificate Signing Request" and send it to the CA. The CSR includes your public key, not your ...
9
If the KGC gets compromised it will break security, so why should a KGC generate private keys.
Certificateless crypto tries to overcome the problem which exists in identity based crypto, i.e., that the KCG generates all the private keys of the users (that is necessary in IBE, see below) and thus knows all the private keys of users (which in turn enables the ...
9
All the answers can be found in RFC 5280 which defines the X.509 certificate format.
1. What does req_distinguished_name mean and how is this being used?
It looks like OpenSSL is spitting this out in .ini format, so I would guess that
distinguished_name = req_distinguished_name
means that the required distinguished name info can be found in tho[...
8
A lot of sleepless nights for the CA, their customers, web browser and OS developers, and Slashdot users, that's what.
I don't know if a CA has ever had their private keys compromised, but there have been incidents where their systems were broken into and fraudulent certificates were issued. (There's a difference between a private key actually being taken, ...
8
ECC is indeed used by CloudFlare's website but only for the session key agreement. The authentication is performed using an RSA 2048 bit private key. The corresponding RSA public key is in the certificate. In other words, although ECC is being used, it is not used for authentication and therefore not part of the certificate.
The ciphersuite is:
...
8
Among the reason why root public keys are often expressed as a self-signed certificate are:
It cryptographically protects against a deliberate alteration of an attribute of the public key (e.g. extension of validity period, or of what the key can be used for).
It strongly protects against accidental alteration of the public key value.
It is a reasonably ...
8
The "extra" octet is needed because ASN.1 uses two's complement notation for integers, per section 8.3.3 of X.690:
The contents octets shall be a two's complement binary number equal to
the integer value
In two's complement, the highest bit indicates a negative number. Since none of our numbers are actually negative, the correct notation needs to ...
7
$ openssl genrsa | openssl rsa -text -noout
Private-Key: (512 bit)
modulus:
00:e7:be:c0:b7:7a:8a:e6:58:c3:dc:3e:eb:ed:bc:
a7:15:04:78:8d:9d:fe:a2:83:aa:ca:85:5f:4b:ae:
5c:fa:3d:bd:2b:a9:91:58:e1:da:d8:8a:bd:25:6d:
07:10:74:52:2f:ee:ce:bd:3c:c6:89:01:2e:ff:9a:
3b:61:4d:e7:81
publicExponent: 65537 (0x10001)
privateExponent:
00:8d:b9:23:...
answered Dec 19 '13 at 19:32
Gilles 'SO- stop being evil'
13.4k3 gold badges36 silver badges69 bronze badges
7
You are looking for Proxy Re-Encryption. From a high-level viewpoint, a proxy re-encryption scheme is an asymmetric encryption scheme that permits a proxy to transform ciphertexts under Alice's public key into ciphertexts decryptable by Bob's secret key. In order to do this, the delegator $A$ gives a special re-encryption key $rk_{A \rightarrow B}$ to the ...
7
[Why] is the CSR istself signed?
The CSR is signed to ensure consistency of the data in it in a similar way to how root certificates are also self-signed. Additionally signing the CSR proves ownership of the private key corresponding to the public key in the CSR.
[Which] key is typically used?
The private key which is associated with the public key ...
7
Typically you send a Certificate Signing Request (CSR) to the CA. The CSR contains everything you want to be inside your certificate, including your public key. The CA takes a look, and if it likes it, creates a certificate and signs it and sends it back to you. The CA never has to see your private key.
7
There are two questions here: What's the minimum, and what's the minimum standard certificate you can build. The former is shorter than the latter, as noted in Maarten Bodewes' answer.
If you're willing to go beyond what OpenSSL supports, you can modify the client and server to only send/receive the non-constant bits of the certificate, and hard-code the ...
6
That's correct. If this happens, then your PKI is doomed and you have to set it up again and roll out all the certificates again.
Actually, then not all the certificates are "compromised" in the sense of key compromise, but you cannot longer trust them, since if someone is in possession of the root private key, this person can issue arbitratrily dated ...
6
As fgrieu says in his comment, the answer to this question is ambiguous; it depends on what you use the certificate for.
You can perfectly trust a certificate, without having a CA signature. A CA signature only signifies that whoever trusts the CA, will also trust your certificate.
The public key however is the way with which the owner of the certificate ...
6
From RFC 5280 r.e TBSCertificate.signature
This field contains the algorithm identifier for the algorithm used
by the CA to sign the certificate.
This field MUST contain the same algorithm identifier as the
signatureAlgorithm field in the sequence Certificate (Section 4.1.1.2).
I think it's because the authoritative signature is on the ...
6
There is no difference. RFC 5280 even requires $\tt signatureAlgorithm$ and $\tt signature$ to be the same.
According to this discussion on the PKIX mailing list, the reason for the redundancy is that it allows to consistently process signatures independent of the signed data, e.g., verifying the signature without knowing about the structure of $\tt ...
6
What happens when such a device is lost (fire, electronic fault,
stolen, etc)?
Assuming the HSM is stolen: The CA will likely inform the police so they can hunt the thief down, then they will ensure that the thief has actually only stolen a brick (that is, they can't do anything useful with the HSM) and finally they will just continue business as usual ...
6
This is a very good question.
Public-key certificates have the purpose to authenticate an assertion, namely that you are communicating with the entity that you intend to communicate with. Specifically, guarding against a Man-in-the-Middle attack (MitM) is done by authenticating the key material that is used.
Your issue is the following. Say A and B want to ...
6
One idea I find useful in this context is looking at cryptographic systems not as absolute ways of achieving guaranteed security, but rather, as ways of reducing bigger problems to other problems that are hopefully smaller but still potentially substantial. Seen from this angle, you're basically grasping the following points:
Public key cryptography is a ...
Only top voted, non community-wiki answers of a minimum length are eligible
