52 votes
Accepted

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

Yes, SHA1-signed certificates are unsafe. The SHAttered paper is instructive. From the introduction: The MD-SHA family of hash functions is the most well-known hash function family, which ...
user avatar
48 votes
Accepted

Who verifies the trust of certificate authorities?

Maarten Bodewes answer is correct but I think the heart of your question is a major hurdle people face in understanding certificates and CAs. I think it's worth elaborating on the part of how this ...
user avatar
32 votes

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

The existence of the SHAttered result is not, I think, in itself a surprise: everyone knows that in theory you can create two streams of bytes that hash to the same value. Google's achievements (which ...
user avatar
  • 85.1k
32 votes

Who verifies the trust of certificate authorities?

There has to be some point where you trust something. Operating system come with 'root' certificate authorities. Those certificates are either installed when you install the operating system, or ...
user avatar
17 votes
Accepted

Is PKCS7 a signature format or a certificate format?

So is PKCS7 a signature format or a certificate format or both? Neither. PKCS7 is now Cryptographic Message Syntax(CMS). From the RFC 5652: This syntax is used to digitally sign, digest, ...
user avatar
  • 770
17 votes
Accepted

Do certificates need to be stored as encrypted?

What is not so obvious is if the certificates used to verify a TLS connection should be stored as encrypted to. It is likely that the root level certificates will be self signed and have no chain back ...
user avatar
  • 132k
15 votes
Accepted

How is OID 2a 86 48 86 f7 0d parsed as 1.2.840.113549?

The question's bytestring 2a 86 48 86 f7 0d 01 01 01 is the Value field of an ASN.1 BER/DER TLV with type 6, which is the Object IDentifier for an RSA key (the Type ...
user avatar
  • 124k
12 votes

Smallest possible certificate for IoT device

What is the minimum, secure enough, certificate that you can build? How could I generate it using OpenSSL? Generally you'd need to flatten certificates if you want to go below 256 bytes. X.509 ...
user avatar
  • 85.1k
12 votes
Accepted

Clarification on the TLS verification process

The article is wrong, but not there. It's the previous sentence that's incorrect. "The first process is to take the signature on the bottom of the certificate and decrypt it with the CA's public ...
user avatar
11 votes

Who verifies the trust of certificate authorities?

No because the browser that you use has a build in security store, so it is perfectly possible to create a secure connection to the CA. Generally you can only request certs for your specific domain, ...
user avatar
  • 85.1k
11 votes

Do certificates need to be stored as encrypted?

Certificates that contains public-keys don't need to be encrypted, as the public-key algorithm ensures that nobody can "decrypt" public-key into private keys. However, there's a special type ...
user avatar
  • 6,621
9 votes
Accepted

Must root certificates be self signed?

Among the reason why root public keys are often expressed as a self-signed certificate are: It cryptographically protects against a deliberate alteration of an attribute of the public key (e.g. ...
user avatar
  • 124k
9 votes
Accepted

X509 certificate

All the answers can be found in RFC 5280 which defines the X.509 certificate format. 1. What does req_distinguished_name mean and how is this being used? It looks ...
user avatar
9 votes
Accepted

Why is a CSR signed and which key is used for signing?

[Why] is the CSR istself signed? The CSR is signed to ensure consistency of the data in it in a similar way to how root certificates are also self-signed. Additionally signing the CSR proves ...
user avatar
  • 44.6k
8 votes
Accepted

Trying to understand the use of ECC in TLS certificates

ECC is indeed used by CloudFlare's website but only for the session key agreement. The authentication is performed using an RSA 2048 bit private key. The corresponding RSA public key is in the ...
user avatar
  • 85.1k
8 votes
Accepted

openSSL created CSR signature size of 73 bytes but should't it be 70 bytes

The "extra" octet is needed because ASN.1 uses two's complement notation for integers, per section 8.3.3 of X.690: The contents octets shall be a two's complement binary number equal to the ...
user avatar
  • 1,573
7 votes
Accepted

how to let other people respond to emails only decrypt-able with my private key

You are looking for Proxy Re-Encryption. From a high-level viewpoint, a proxy re-encryption scheme is an asymmetric encryption scheme that permits a proxy to transform ciphertexts under Alice's public ...
user avatar
  • 4,832
7 votes

Deduce modulus N from public exponent and encrypted data

Given a message $M$, define the corresponding RSA ciphertext as $C = M^e \bmod N$. We assume that the value of $N$ is kept secret. However, the attacker is given oracle access to the encryption: on ...
user avatar
  • 1,699
7 votes
Accepted

Creating certificate: Where is my private key stored?

Typically you send a Certificate Signing Request (CSR) to the CA. The CSR contains everything you want to be inside your certificate, including your public key. The CA takes a look, and if it likes it,...
user avatar
  • 2,572
7 votes

Smallest possible certificate for IoT device

There are two questions here: What's the minimum, and what's the minimum standard certificate you can build. The former is shorter than the latter, as noted in Maarten Bodewes' answer. If you're ...
user avatar
6 votes

What does "G2" mean when used with X509 certficates and certificate authorities?

Yes, G stands for "Generation". When CA needs to get a new chain they just increment the generation number. For example GoDaddy's signatures: G3 - ...
user avatar
  • 161
6 votes
Accepted

How does a certificate authority issue a digital certificate?

Great question. I'll answer it in several parts. Which Keys does Alice send? There are two cryptographic operations that Alice may want to do: encryption/decryption, and signing/validation. You can ...
user avatar
6 votes
Accepted

What information is signed by a Certification Authority?

The information that is signed may differ by certificate, but basically the procedure can be found by looking at RFC 5280 and working downward: 4.1.1.3. signatureValue The signatureValue field ...
user avatar
  • 85.1k
6 votes
Accepted

What is the maximum length of a X.509 OID?

OIDs don't have a maximal length / depth specified. There is no real value where you can safely cut them off - or rather reject them (raise an exception or error). Anything over 20 bytes seems ...
user avatar
  • 85.1k
6 votes
Accepted

What is the most important piece of information in a X.509 certificate?

As fgrieu says in his comment, the answer to this question is ambiguous; it depends on what you use the certificate for. You can perfectly trust a certificate, without having a CA signature. A CA ...
user avatar
6 votes
Accepted

Why is the signatureAlgorithm field in X.509 certificates redundant?

From RFC 5280 r.e TBSCertificate.signature This field contains the algorithm identifier for the algorithm used by the CA to sign the certificate. This field MUST contain the same algorithm ...
user avatar
  • 789
6 votes

Why is the signatureAlgorithm field in X.509 certificates redundant?

There is no difference. RFC 5280 even requires $\tt signatureAlgorithm$ and $\tt signature$ to be the same. According to this discussion on the PKIX mailing list, the reason for the redundancy is that ...
user avatar
  • 1,293
6 votes
Accepted

What happens when a root CA loses its private key?

What happens when such a device is lost (fire, electronic fault, stolen, etc)? Assuming the HSM is stolen: The CA will likely inform the police so they can hunt the thief down, then they will ...
user avatar
  • 44.6k
6 votes

Who verifies the trust of certificate authorities?

This is a very good question. Public-key certificates have the purpose to authenticate an assertion, namely that you are communicating with the entity that you intend to communicate with. ...
user avatar
6 votes

Who verifies the trust of certificate authorities?

One idea I find useful in this context is looking at cryptographic systems not as absolute ways of achieving guaranteed security, but rather, as ways of reducing bigger problems to other problems that ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible