52
Yes, SHA1-signed certificates are unsafe.
The SHAttered paper is instructive. From the introduction:
The MD-SHA family of hash functions is the most well-known hash function family, which includes MD5, SHA-1, and SHA-2 that have all found widespread use. This family originally started with MD4 in 1990, which was quickly replaced by MD5 in 1992 due to ...
47
Maarten Bodewes answer is correct but I think the heart of your question is a major hurdle people face in understanding certificates and CAs. I think it's worth elaborating on the part of how this works that I think you are missing.
As stated in Maarten's answer, your computer/browser has been preconfigured with a set of trusted CAs. If you are running ...
31
The existence of the SHAttered result is not, I think, in itself a surprise: everyone knows that in theory you can create two streams of bytes that hash to the same value. Google's achievements (which I don't wish to downplay) are (a) that they mustered enough resources to actually do this, and (b) they did so while keeping the colliding file a valid PDF (...
29
It seems we have aligned interests. I'm also a university student (although I am a math/comp sci double major) looking to pursue a career in cryptography. To that end, I have been self-studying it for a while now. So, take what I say with a grain of salt. As a forewarning, this post focuses specifically on what topics cryptographers often encounter and less ...
29
There has to be some point where you trust something. Operating system come with 'root' certificate authorities. Those certificates are either installed when you install the operating system, or could be downloaded over a secure connection from at least one certificate installed with the operating system.
You can (and many developers do) add your own root ...
14
It has to do with optimizing RSA.
It turns out that using the Chinese Remainder Theorem with $p$, $q$, $d\pmod{p-1}$, and $d\pmod{q-1}$ (i.e., prime1, prime2, exponent1, exponent2 from the data structure in the question) to run the decryption operation faster than if you only had $d,n$.
For more information on how it is done, I found this reference http://...
14
The question's bytestring 2a 86 48 86 f7 0d 01 01 01 is the Value field of an ASN.1 BER/DER TLV with type 6, which is the Object IDentifier for an RSA key (the Type and Length just before are coded as 06 09, and won't be further discussed).
In order to parse that Value bytestring, we first separate the bytes into blocks ending after each byte which high-...
12
This has more to do with how Microsoft decided to implemented their certificate inspection GUI, than about the actual fields of the certificate. Most signature algorithm identifiers present in contemporary certificates specify both the public key algorithm (RSA in this case) and the digest algorithm (SHA-1 in this case). The identifier "sha1RSA" is most ...
12
Your question is only slightly ill-defined. The problem is that the word "cryptography" is horribly overloaded. I think there are at least three different regimes of cryptography:
Cryptography in academia. As Reid said, academic cryptography mainly springs out of complexity theory. With very few exceptions, you don't need much math knowledge to succeed here;...
11
No because the browser that you use has a build in security store, so it is perfectly possible to create a secure connection to the CA.
Generally you can only request certs for your specific domain, e.g. by using a domain specific mail address. Generally you should also pay for the services which provider a small amount if traceability.
Of course you ...
10
Although x.509 is the standard for PKIs with CAs, different certificate formats have been defined for the other 2 major PKI approaches:
SPKI has defined its own certificate
format , still (forever?) in
draft status.
Web-of-Trust models usually use the OpenPGP certificate format defined in RFC2440
RFC4212 "Alternative Certificate Formats for the Public-Key ...
9
Yes, obviously if the CA generated your private key, they might keep it and share it with anybody.
Yes on both counts.
In fact, the normal way to generate a certificate -- whether for a Web server (TLS) or for yourself (S/MIME or TLS client) -- is to create a "Certificate Signing Request" and send it to the CA. The CSR includes your public key, not your ...
9
If the KGC gets compromised it will break security, so why should a KGC generate private keys.
Certificateless crypto tries to overcome the problem which exists in identity based crypto, i.e., that the KCG generates all the private keys of the users (that is necessary in IBE, see below) and thus knows all the private keys of users (which in turn enables the ...
9
So is PKCS7 a signature format or a certificate format or both?
Neither. PKCS7 is now Cryptographic Message Syntax(CMS). From the RFC 5652:
This
syntax is used to digitally sign, digest, authenticate, or encrypt
arbitrary message content.
CMS enables interoperability between different products which can operate on the same document without ...
8
A lot of sleepless nights for the CA, their customers, web browser and OS developers, and Slashdot users, that's what.
I don't know if a CA has ever had their private keys compromised, but there have been incidents where their systems were broken into and fraudulent certificates were issued. (There's a difference between a private key actually being taken, ...
7
$ openssl genrsa | openssl rsa -text -noout
Private-Key: (512 bit)
modulus:
00:e7:be:c0:b7:7a:8a:e6:58:c3:dc:3e:eb:ed:bc:
a7:15:04:78:8d:9d:fe:a2:83:aa:ca:85:5f:4b:ae:
5c:fa:3d:bd:2b:a9:91:58:e1:da:d8:8a:bd:25:6d:
07:10:74:52:2f:ee:ce:bd:3c:c6:89:01:2e:ff:9a:
3b:61:4d:e7:81
publicExponent: 65537 (0x10001)
privateExponent:
00:8d:b9:23:...
answered Dec 19 '13 at 19:32
Gilles 'SO- stop being evil'
12.1k3 gold badges33 silver badges64 bronze badges
7
You are looking for Proxy Re-Encryption. From a high-level viewpoint, a proxy re-encryption scheme is an asymmetric encryption scheme that permits a proxy to transform ciphertexts under Alice's public key into ciphertexts decryptable by Bob's secret key. In order to do this, the delegator $A$ gives a special re-encryption key $rk_{A \rightarrow B}$ to the ...
7
ECC is indeed used by CloudFlare's website but only for the session key agreement. The authentication is performed using an RSA 2048 bit private key. The corresponding RSA public key is in the certificate. In other words, although ECC is being used, it is not used for authentication and therefore not part of the certificate.
The ciphersuite is:
...
7
Typically you send a Certificate Signing Request (CSR) to the CA. The CSR contains everything you want to be inside your certificate, including your public key. The CA takes a look, and if it likes it, creates a certificate and signs it and sends it back to you. The CA never has to see your private key.
6
That's correct. If this happens, then your PKI is doomed and you have to set it up again and roll out all the certificates again.
Actually, then not all the certificates are "compromised" in the sense of key compromise, but you cannot longer trust them, since if someone is in possession of the root private key, this person can issue arbitratrily dated ...
6
Among the reason why root public keys are often expressed as a self-signed certificate are:
It cryptographically protects against a deliberate alteration of an attribute of the public key (e.g. extension of validity period, or of what the key can be used for).
It strongly protects against accidental alteration of the public key value.
It is a reasonably ...
6
All the answers can be found in RFC 5280 which defines the X.509 certificate format.
1. What does req_distinguished_name mean and how is this being used?
It looks like OpenSSL is spitting this out in .ini format, so I would guess that
distinguished_name = req_distinguished_name
means that the required distinguished name info can be found in tho[...
6
[Why] is the CSR istself signed?
The CSR is signed to ensure consistency of the data in it in a similar way to how root certificates are also self-signed. Additionally signing the CSR proves ownership of the private key corresponding to the public key in the CSR.
[Which] key is typically used?
The private key which is associated with the public key ...
6
As fgrieu says in his comment, the answer to this question is ambiguous; it depends on what you use the certificate for.
You can perfectly trust a certificate, without having a CA signature. A CA signature only signifies that whoever trusts the CA, will also trust your certificate.
The public key however is the way with which the owner of the certificate ...
6
From RFC 5280 r.e TBSCertificate.signature
This field contains the algorithm identifier for the algorithm used
by the CA to sign the certificate.
This field MUST contain the same algorithm identifier as the
signatureAlgorithm field in the sequence Certificate (Section 4.1.1.2).
I think it's because the authoritative signature is on the ...
6
There is no difference. RFC 5280 even requires $\tt signatureAlgorithm$ and $\tt signature$ to be the same.
According to this discussion on the PKIX mailing list, the reason for the redundancy is that it allows to consistently process signatures independent of the signed data, e.g., verifying the signature without knowing about the structure of $\tt ...
6
What happens when such a device is lost (fire, electronic fault,
stolen, etc)?
Assuming the HSM is stolen: The CA will likely inform the police so they can hunt the thief down, then they will ensure that the thief has actually only stolen a brick (that is, they can't do anything useful with the HSM) and finally they will just continue business as usual ...
6
This is a very good question.
Public-key certificates have the purpose to authenticate an assertion, namely that you are communicating with the entity that you intend to communicate with. Specifically, guarding against a Man-in-the-Middle attack (MitM) is done by authenticating the key material that is used.
Your issue is the following. Say A and B want to ...
6
One idea I find useful in this context is looking at cryptographic systems not as absolute ways of achieving guaranteed security, but rather, as ways of reducing bigger problems to other problems that are hopefully smaller but still potentially substantial. Seen from this angle, you're basically grasping the following points:
Public key cryptography is a ...
5
The "Common Name" is part of a X.500 name; here, the one called "SubjectDN", which designates the owner of the public key which is contained in the certificate. That name is part of the certificate, in the part which is covered by the signature; as such, it is exactly as trustworthy as any other element in the certificate.
Only top voted, non community-wiki answers of a minimum length are eligible
