Hot answers tagged

12

The article is wrong, but not there. It's the previous sentence that's incorrect. "The first process is to take the signature on the bottom of the certificate and decrypt it with the CA's public key." Emphasis mine: signatures aren't encryption, decrypting them isn't what the client does, the client verifies the signature. This is unrelated to your ...


11

No, there is no known efficient method to find an RSA private key from public key, ciphertext and plaintext, including when no padding is used and $e=3$. The best known method is factoring the public modulus, which then trivially allows to find a working private key. Factoring is considered brute force, or tantamount to that. The best known factoring method ...


10

First an important point of terminology: the real question should be phrased "Why not just sign the whole message with the private key of Bob, send it to Alice, and verify it with Bob's public key?". Signature and encryption are very different things. We use "encryption" only when the goal is confidentiality; and encryption is performed with the public key ...


9

Among the reason why root public keys are often expressed as a self-signed certificate are: It cryptographically protects against a deliberate alteration of an attribute of the public key (e.g. extension of validity period, or of what the key can be used for). It strongly protects against accidental alteration of the public key value. It is a reasonably ...


8

Public key crypto vs. identity-based crypto made short: In traditional public key cryptography, a user $A$ generates a private/public key pair $(sk_A,pk_A)$ and since this key pair has absolutely no indication to which indentity (user $A$) it belongs, it is necessary to certify the public key, i.e., bind the public key $pk_A$ to the user $A$'s identity. This ...


8

A lot of sleepless nights for the CA, their customers, web browser and OS developers, and Slashdot users, that's what. I don't know if a CA has ever had their private keys compromised, but there have been incidents where their systems were broken into and fraudulent certificates were issued. (There's a difference between a private key actually being taken, ...


6

Great question. I'll answer it in several parts. Which Keys does Alice send? There are two cryptographic operations that Alice may want to do: encryption/decryption, and signing/validation. You can either use the same keypair for both, or have two separate pairs of keys. 1 keypair method: Here Alice would sign outgoing messages, and decrypt incoming messages ...


6

That's correct. If this happens, then your PKI is doomed and you have to set it up again and roll out all the certificates again. Actually, then not all the certificates are "compromised" in the sense of key compromise, but you cannot longer trust them, since if someone is in possession of the root private key, this person can issue arbitratrily dated ...


6

None. You don't trust the Root CA certificate because it was signed by anything - you trust the Root CA because you (or someone on your behalf) placed it in your trust anchor store. A Root CA certificate has a signature simply because it is mandatory within the X509 specification - it serves no other purpose. Technically, the trust anchor doesn't have to ...


6

What happens when such a device is lost (fire, electronic fault, stolen, etc)? Assuming the HSM is stolen: The CA will likely inform the police so they can hunt the thief down, then they will ensure that the thief has actually only stolen a brick (that is, they can't do anything useful with the HSM) and finally they will just continue business as usual ...


6

Current commonly used public key cryptography systems are based on the hardness assumption of factorization and/or discrete lograrithm. Both these problems are solved efficiently using Shor's algorithm using a quantum computer. Should someone build a quantum computer capable of running the algorithm with thousands of qbits and the ability to apply enough ...


6

Signature generation is not encryption with the private key. Still, the basic flow of what you describe is correct for signature generation. However, the verification step is where everything derails. As indicated in the comments, it is impossible to reverse a cryptographic hash. However, for signature verification, it is assumed that the verifying party ...


6

Index calculus is based on two simple ideas: Every integer can be written as a product of primes. A system of linear equations in a small number of variables can be solved with enough independent equations. Take for example the cyclic group $\mathbb{Z}/p$ with $p$ a prime and primitive root c. The elements $c^i$ (for $i=0,1,2,...,p-1$) are congruent modulo ...


5

No, this is not correct. Your fallacy here is to assume that a public-key infrastructure implies RSA. RSA is just a way of implementing an PKI. There are other cryptographic schemes out there that do not reduce to the problem of factoring large numbers.


5

Is HIMMO For Real? ... I've not been able to find any critiques of the approach. First up, let me quote the HIMMO website itself which described it as broken at the time you asked your question: HIMMO has been shown to have limited collusion resistance capabilities... Beyond that, several papers - describing potentials but also weaknesses - have been ...


5

Can public key cryptography survive quantum computers? Yes. All current PKC implementations might sooner or later be insecure due to sufficiently powerful quantum computer running Shor's algorithm. But there already exists an algorithm for post-quantum-PKC: Supersingular isogeny key exchange. This is a likely candidate for post-quantum-PKC, probably this ...


4

Under a chosen-plaintext attack, the adversary has the power to encrypt polynomially-many chosen plaintexts. In the symmetric world, since only the valid parties hold the encryption key, only the valid parties can "grant" the adversary access to an encryption oracle. So, it isn't assumed that an eavesdropper necessarily has access to an encryption oracle. ...


4

There was a post on security.stackexchange last week about this. SSL/TLS with Certificate Authorities for all intents and purposes is now completely insecure from governments and any organisation who has a CA pre-trusted inside the standard web browsers. DNSSEC will also fall under the same scenario because at the top level you have a particular government ...


4

There is "PGP network of trust" (also implemented by other OpenPGP-compatible systems like GnuPG) which does exactly that. You start off with nobody to trust except yourself. You decide to trust some friends of yours and hand your public key to them to have it signed. This signed public key will be automatically trusted by anyone else who trust your friends....


4

It is not safe at all since Factoring as a service project (https://github.com/eniac/faas) together with Amazon EC2 allows the factorization of a 512-bit key for less than $100 in only a few hours.


4

Alice sends a CSR (certificate signing request) to the CA, which contains her public key, her name and usually her location. This CSR is then signed to prove ownership of the associated private key. The CA uses the data in the CSR to derive a certificate which will be handed to the user afterwards. The user can then prove his identity. The CA needs to "know" ...


4

Since I stumbled on this checking something else, a few minor points A CA doesn't sign a CSR; it signs (issues) a cert that has some important data taken from the CSR but much data different. The Subject names of the CA cert and all server and client certs it issues should be unique, and preferably mnemonic. The CA and client names don't need to be FQDNs, ...


4

But if Server’s certificate is checked sucessfully by Client, how is it possible to consider that Server has been authenticated by Client, while at this time none message signed with Server’s private key has been sent to the Client and verified by it ? If only consider the key exchange to be what the RFC says it is, then yes this key-exchange can be ...


4

There is no need for a trust anchor to be distributed as a certificate at all, let alone a self-signed one. The certificate path validation requirements in RFC5280 make this reasonably clear; it even says in §6.2: The path validation algorithm presented in Section 6.1 does not assume that trust anchor information is provided in self-signed certificates ...


4

In order to find private exponent D we need to calculate the factors of N. e.g Finding the factors of a 64bit N ↷ 9D73032BDEDCD671 takes almost a second. Prime 1: 10ECD8623 Prime 2: 94D7B85B Knowing that we can calculate the private exponent D. D:59683910DF25978D Since C is: C=M^E MOD N we can decrypt any given ciphertext now. Number factorization is ...


4

The purpose of the bitcoin block chain is to provide an imitable public ledger. If you read the original bitcoin paper you will see that the block chain is but one component of a larger whole that provides public trust that coins were not double spent. See section 2 "Transactions" that states this explicitly. Within a traditional bank the ledger is ...


4

Spelunking through https://crt.sh, one finds a CA certificate for RSA Data Security, Inc., from 1994, but the oldest certificate it has issued has a validity period starting only on 1998-02-13. That doesn't mean that that CA didn't issue certificates before—maybe the records in crt.sh are incomplete. Indeed, pursuing the PostgresQL interface doesn't reveal ...


4

In a public-key infrastructure, there are two ways a public key can be trusted: either because it's signed by a certificate authority that you trust, or because you already have it in a list of trusted public keys. That's where the chain of signatures ends: in a list of pre-trusted public keys. These pre-trusted public keys are usually called “root CAs” or “...


4

ASN.1 is a way of defining structures for data, and DER is a binary encoding of those structures. But they aren't describing any structures by themselves. Saying that something needs to be ASN.1 / DER encoded is like saying that the key needs to be represented in XML without specifying the tags or tree structure. What you are required to generate is a PKCS#...


4

I understand that the CRS model refers to a setting where a common reference string is provided to all parties. How can this help in computation? (any pointer to a concrete protocol that uses such setup would be welcome). One typical approach is that the parties will treat the CRS as the public key of an encryption scheme, and encrypt their inputs under ...


Only top voted, non community-wiki answers of a minimum length are eligible