Cryptography Stack Exchange
Cryptography Stack Exchange

Questions tagged [certificates]

A certificate consists of a public key and information about the owner (e. g. the name of a person or server).

A certificate consists of a public key and information about the owner (e. g. the name of a person or server).

Certificates are usually signed by a certification authority to proof the correctness of the owner information.

284 questions
79
votes
13 answers

Who is responsible for ensuring the trustworthiness of certificate authorities?

Background I am a novice in the field of cryptography and cyber-security, and while studying asymmetric-key encryption, I learned about the potential of a man-in-the-middle attack. To mitigate this threat, people came up with certificate authorities…
AlanSTACK
  • 1,315
  • 2
  • 14
  • 14
37
votes
3 answers

Does "Shattered" actually show SHA-1-signed certificates are "unsafe"?

Note: I am not advocating anyone continues using SHA1-signed certificates: they are dead as far as security is concerned and should no longer be used. I'm just trying to clarify my understanding of the theoretical implications of Shattered as they…
TripeHound
  • 473
  • 8
  • 15
29
votes
4 answers

Recommended skills for a job in cryptology

First let me apologize if this is an ill posed question. Let me also note that I do not in any way seek a comprehensive answer, simply your thoughts on what makes for a valuable asset to a company like the NSA. I am a Maths student in the US, and I…
Moderat
  • 419
  • 1
  • 5
  • 6
29
votes
2 answers

Unpredictability of X.509 serial numbers

About X.509 certificates serial numbers the RFC 5280 says: The serial number MUST be a positive integer assigned by the CA to each certificate. It MUST be unique for each certificate issued by a given CA (i.e., the issuer name and serial number…
Jcs
  • 521
  • 1
  • 7
  • 12
20
votes
1 answer

Is PKCS7 a signature format or a certificate format?

I always though PKCS7 was a signature format. However, on the net I find several references to PKCS7 being a certificate format - for example, this talks about PKCS7 certificate: Extract raw certificate from PKCS#7 file in JAVA Or: What's the…
user93353
  • 2,348
  • 3
  • 28
  • 49
20
votes
2 answers

Difference between "Signature Algorithm" and "Signature Hash Algorithm" in X.509

What's the difference between the "Signature Algorithm" and the "Signature Hash Algorithm" found in an X.509 certificate? Why does it need a "Signature Hash Algorithm"? Edit: I'm creating the X.509 cert with PHP 5.2. When I change the 'digest_alg'…
HomeCoder
  • 343
  • 1
  • 2
  • 9
16
votes
1 answer

Who issued the first SSL certificate?

When SSL was introduced in ~1996, there was only a few CAs issuing certificates for that specific use and a few sites which actually used SSL. Which Certification Authority issued the first SSL certificate and whom was it issued to?
Mark
  • 835
  • 7
  • 24
15
votes
3 answers

Are there other digital certificate formats than X.509?

Hi I am a little new to security, but in researching digital certificates it seems the only format people describe is X.509. Are there other formats? If so what are they and where can I find information on them?
user3137124
  • 253
  • 2
  • 5
13
votes
2 answers

Why is a CSR signed and which key is used for signing?

I know that a CSR includes a public key from which a signed certificate shall be generated. But why is the CSR istself signed and which key is typically used? For signing I need a private key, so the user of the CSR's signature must have the…
MichaelW
  • 1,517
  • 1
  • 14
  • 26
12
votes
3 answers

Smallest possible certificate for IoT device

I'm developing an IoT system that uses small nodes connected through RF. This allows messages under 250 bytes long. You can check it at https://github.com/gmag11/EnigmaIOT. All messages are encrypted using ChaCha20+Poly with a dynamic key obtained…
gmag11
  • 121
  • 1
  • 3
12
votes
4 answers

How does a client verify a server certificate?

As far as I know, when I request a certificate from Verisign (for example), and after they approved that I is me, they create a certificate (for me) that contains the digital signature and public key. The digital signature is data that was created…
Royi Namir
  • 263
  • 1
  • 2
  • 8
12
votes
2 answers

How does a certificate authority issue a digital certificate?

I am new to cryptography and I want to know the details of how a Certificate Authority issues a digital certificate. From what I know (please correct me if I'm wrong at any parts of my explanation): If Alice wants to request a digital certificate,…
user2935569
  • 135
  • 2
  • 6
12
votes
1 answer

Why does the PKCS1 RSA private key structure contain more than just exponent and modulus?

The ASN.1 spec for the PKCS1 RSA private key format is as follows: RSAPrivateKey ::= SEQUENCE { version Version, modulus INTEGER, -- n publicExponent INTEGER, -- e privateExponent INTEGER, -- d prime1 …
user1449
10
votes
1 answer

Need an introduction to SPKI (or "SPKI for dummies")

I am familiar with concepts such as the following: PKI and CAs ID based cryptography Certificateless cryptography PGP web of trust more or less anything in basic Crypto that is taught in a college course I need to quickly understand the main…
Jus12
  • 1,679
  • 1
  • 12
  • 21
10
votes
2 answers

Must root certificates be self signed?

Root certificates are normally self-signed. What is the reason behind that convention? I mean, one must trust the root certificate in a non cryptographic way anyhow.
user27950
1
2 3
…
18 19