45
Yes, SHA1-signed certificates are unsafe.
The SHAttered paper is instructive. From the introduction:
The MD-SHA family of hash functions is the most well-known hash function family, which includes MD5, SHA-1, and SHA-2 that have all found widespread use. This family originally started with MD4 in 1990, which was quickly replaced by MD5 in 1992 due to ...
29
It seems we have aligned interests. I'm also a university student (although I am a math/comp sci double major) looking to pursue a career in cryptography. To that end, I have been self-studying it for a while now. So, take what I say with a grain of salt. As a forewarning, this post focuses specifically on what topics cryptographers often encounter and less ...
29
The existence of the SHAttered result is not, I think, in itself a surprise: everyone knows that in theory you can create two streams of bytes that hash to the same value. Google's achievements (which I don't wish to downplay) are (a) that they mustered enough resources to actually do this, and (b) they did so while keeping the colliding file a valid PDF (...
19
A non-random serial number does not imply, by itself, a security issue with the signature scheme, but, as @Jack points out, it can be used to leverage an attack. On a general basis, signature algorithms begin by hashing the input message with a given hash function; if the message or hashing process is fully controlled by the attacker, then collision ...
16
Short version: SPKI links not only names, but authorizations to keys. Also, it uses a better syntax (S-expressions) than X.509 certificates.
Long version:
What problem does it solve?
Both the traditional CA-based public-key infrastructure (PKI) and PGP's web of trust (and other similar systems) do mainly one thing: Linking names to public keys.
The idea ...
14
It has to do with optimizing RSA.
It turns out that using the Chinese Remainder Theorem with $p$, $q$, $d\pmod{p-1}$, and $d\pmod{q-1}$ (i.e., prime1, prime2, exponent1, exponent2 from the data structure in the question) to run the decryption operation faster than if you only had $d,n$.
For more information on how it is done, I found this reference http://...
14
The question's bytestring 2a 86 48 86 f7 0d 01 01 01 is the Value field of an ASN.1 BER/DER TLV with type 6, which is the Object IDentifier for an RSA key (the Type and Length just before are coded as 06 09, and won't be further discussed).
In order to parse that Value bytestring, we first separate the bytes into blocks ending after each byte which high-...
12
This has more to do with how Microsoft decided to implemented their certificate inspection GUI, than about the actual fields of the certificate. Most signature algorithm identifiers present in contemporary certificates specify both the public key algorithm (RSA in this case) and the digest algorithm (SHA-1 in this case). The identifier "sha1RSA" is most ...
11
Your question is only slightly ill-defined. The problem is that the word "cryptography" is horribly overloaded. I think there are at least three different regimes of cryptography:
Cryptography in academia. As Reid said, academic cryptography mainly springs out of complexity theory. With very few exceptions, you don't need much math knowledge to succeed here;...
11
Predictable serial numbers were used (along with serious weaknesses in MD5) to create a rogue CA certificate in 2008. Randomizing the serial numbers would have prevented this attack.
And, obviously using a sequential serial number reveals the number of certificates signed, and requires careful state management.
In general I would say using a large (large ...
10
RSA is two algorithms, one for asymmetric encryption, the other for digital signatures.
For asymmetric encryption, the main competitors of RSA would be:
The Rabin cryptosystem
ElGamal
NTRUEncrypt
Diffie-Hellman key exchange (in practice, key exchange is almost as good as asymmetric encryption, since most usages of asymmetric encryption are for sending a ...
10
Although x.509 is the standard for PKIs with CAs, different certificate formats have been defined for the other 2 major PKI approaches:
SPKI has defined its own certificate
format , still (forever?) in
draft status.
Web-of-Trust models usually use the OpenPGP certificate format defined in RFC2440
RFC4212 "Alternative Certificate Formats for the Public-Key ...
9
Yes, obviously if the CA generated your private key, they might keep it and share it with anybody.
Yes on both counts.
In fact, the normal way to generate a certificate -- whether for a Web server (TLS) or for yourself (S/MIME or TLS client) -- is to create a "Certificate Signing Request" and send it to the CA. The CSR includes your public key, not your ...
9
If the KGC gets compromised it will break security, so why should a KGC generate private keys.
Certificateless crypto tries to overcome the problem which exists in identity based crypto, i.e., that the KCG generates all the private keys of the users (that is necessary in IBE, see below) and thus knows all the private keys of users (which in turn enables the ...
7
A lot of sleepless nights for the CA, their customers, web browser and OS developers, and Slashdot users, that's what.
I don't know if a CA has ever had their private keys compromised, but there have been incidents where their systems were broken into and fraudulent certificates were issued. (There's a difference between a private key actually being taken, ...
7
$ openssl genrsa | openssl rsa -text -noout
Private-Key: (512 bit)
modulus:
00:e7:be:c0:b7:7a:8a:e6:58:c3:dc:3e:eb:ed:bc:
a7:15:04:78:8d:9d:fe:a2:83:aa:ca:85:5f:4b:ae:
5c:fa:3d:bd:2b:a9:91:58:e1:da:d8:8a:bd:25:6d:
07:10:74:52:2f:ee:ce:bd:3c:c6:89:01:2e:ff:9a:
3b:61:4d:e7:81
publicExponent: 65537 (0x10001)
privateExponent:
00:8d:b9:23:...
7
You are looking for Proxy Re-Encryption. From a high-level viewpoint, a proxy re-encryption scheme is an asymmetric encryption scheme that permits a proxy to transform ciphertexts under Alice's public key into ciphertexts decryptable by Bob's secret key. In order to do this, the delegator $A$ gives a special re-encryption key $rk_{A \rightarrow B}$ to the ...
7
ECC is indeed used by CloudFlare's website but only for the session key agreement. The authentication is performed using an RSA 2048 bit private key. The corresponding RSA public key is in the certificate. In other words, although ECC is being used, it is not used for authentication and therefore not part of the certificate.
The ciphersuite is:
...
7
So is PKCS7 a signature format or a certificate format or both?
Neither. PKCS7 is now Cryptographic Message Syntax(CMS). From the RFC 5652:
This
syntax is used to digitally sign, digest, authenticate, or encrypt
arbitrary message content.
CMS enables interoperability between different products which can operate on the same document without ...
7
Typically you send a Certificate Signing Request (CSR) to the CA. The CSR contains everything you want to be inside your certificate, including your public key. The CA takes a look, and if it likes it, creates a certificate and signs it and sends it back to you. The CA never has to see your private key.
6
Among the reason why root public keys are often expressed as a self-signed certificate are:
It cryptographically protects against a deliberate alteration of an attribute of the public key (e.g. extension of validity period, or of what the key can be used for).
It strongly protects against accidental alteration of the public key value.
It is a reasonably ...
6
[Why] is the CSR istself signed?
The CSR is signed to ensure consistency of the data in it in a similar way to how root certificates are also self-signed. Additionally signing the CSR proves ownership of the private key corresponding to the public key in the CSR.
[Which] key is typically used?
The private key which is associated with the public key ...
6
As fgrieu says in his comment, the answer to this question is ambiguous; it depends on what you use the certificate for.
You can perfectly trust a certificate, without having a CA signature. A CA signature only signifies that whoever trusts the CA, will also trust your certificate.
The public key however is the way with which the owner of the certificate ...
6
From RFC 5280 r.e TBSCertificate.signature
This field contains the algorithm identifier for the algorithm used
by the CA to sign the certificate.
This field MUST contain the same algorithm identifier as the
signatureAlgorithm field in the sequence Certificate (Section 4.1.1.2).
I think it's because the authoritative signature is on the ...
6
What happens when such a device is lost (fire, electronic fault,
stolen, etc)?
Assuming the HSM is stolen: The CA will likely inform the police so they can hunt the thief down, then they will ensure that the thief has actually only stolen a brick (that is, they can't do anything useful with the HSM) and finally they will just continue business as usual ...
5
The "Common Name" is part of a X.500 name; here, the one called "SubjectDN", which designates the owner of the public key which is contained in the certificate. That name is part of the certificate, in the part which is covered by the signature; as such, it is exactly as trustworthy as any other element in the certificate.
5
If the CA issued something with a CSR as the dominant part of the To-Be-Signed field, it wouldn't be a X.509 certificate and hardly any existing software would know what to do with it. I guess the original CSR could be added as an extension, though.
Therefore, I suppose you are really asking why the X.509 certificate format wasn't originally specified to ...
5
I believe the SignatureAlgorithm is the algorithm used to sign the content using the private key, while the SignatureHashAlgorithm is used to hash the content before signing (so as to not sign as much data, which is a relatively slow process). In this case, it's easy enough to figure out that the SignatureHashAlgorithm is SHA1 because it's in the name of the ...
5
That's correct. If this happens, then your PKI is doomed and you have to set it up again and roll out all the certificates again.
Actually, then not all the certificates are "compromised" in the sense of key compromise, but you cannot longer trust them, since if someone is in possession of the root private key, this person can issue arbitratrily dated ...
5
Yes, G stands for "Generation". When CA needs to get a new chain they just increment the generation number.
For example GoDaddy's signatures:
G3 - sha256WithRSAEncryption
G4 - ecdsa-with-SHA384
Only top voted, non community-wiki answers of a minimum length are eligible
