Questions tagged [public-key]
The public-key tag has no summary.
55 questions
2 votes
1 answer
139 views
Do (OpenSSL generated) RSA 4096bit Public Modulus values always have 1 for the most significant bit?
Background For reasons of code size and education, I've added functionality to my codebase to extract the raw data for RSA 4096bit public keys from the .pub files created by OpenSSL. During this, I ...
- 123
3 votes
1 answer
213 views
Understanding and Troubleshooting TAG IC Signature Verification Failure
I have a number of NFC tags with the following metadata: [usb] pm3 --> hf mfu info [=] --- Tag Information -------------------------- [+] TYPE: NTAG 215 504bytes (NT2H1511G0DU) [+] ...
- 131
1 vote
1 answer
676 views
Why is JWT claim x5t (thumbprint) useful?
If I sign JWT (as per JWS spec) with a private key, the receiver of JWT will want to validate the signature and they need public key to do that. The public key can be "baked" into the app ...
- 111
2 votes
1 answer
722 views
How does JWE secure the Content Encryption Key
I apologise in advance if this is a dumb question. But this seems like one of those straight forward things that are so straight forward that its not even mentioned and I am not getting it. Perhaps I ...
- 123
0 votes
1 answer
976 views
mTLS set up - Does it require any offline certificates exchange?
My company is exposing a few APIs to one of our partner systems (external). We're looking at mTLS authentication here than any credentials based Auth schemes. My understanding is, My system (server) ...
- 101
0 votes
2 answers
99 views
Infer information of private key from public key / CSR
is it possible to infer information like: algorithm, key length, mode etc. of the private key from the public key or CSR?
- 1
0 votes
1 answer
205 views
Will sky fall if I don't verify `AuthenticatorAttestationResponse`?
Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
- 402
1 vote
1 answer
499 views
How to implement public key encryption for a webapp?
I'm making a web app where users will upload sensitive data (private financial records), so I want to encrypt one column in one table that holds the value. If I understood correctly, I need to use a ...
- 111
0 votes
0 answers
149 views
Is a Certificate Signing Request a concatenation of public key and metadata?
From this question, it is said that when creating a CSR, we attach the public key and fill in other data. When creating a CSR, you attach your public key to it and fill in other needed data; you then ...
- 101
4 votes
1 answer
280 views
GPG allows importing an invalid secp256k1 public key
I came across a PGP public key that seems invalid. The key is a secp256k1 public key that supported by GPG. In fact, GPG allows importing that key even if it has an invalid secp256k1 public key inside....
- 143
0 votes
1 answer
272 views
WebAuthn does not guarantee public-key integrity other than trough attestation?
I've been reading about WebAuthn and try to write some code to exercise. One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
- 402
0 votes
1 answer
104 views
Is create a key to access resources than send it to client instead of login/password system , a good idea?
I would like to make a key/string/token encrypted string to send it to the user via email. This encrypted KEY would have encrypted data (resource id) and would be stored in the database along with ...
- 11
9 votes
6 answers
7k views
Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?
Lets say Bob wishes to communicate with Alice. Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to ...
- 599
2 votes
1 answer
3k views
PGP key pair - How to set up for multiple users to decrypt messages with Kleopatra
This is my first project of this nature, and I am hoping this is a basic use case for PGP encryption. Please forgive my ignorance! There is a server being configured by a service provider (SP). The SP ...
- 131
3 votes
2 answers
1k views
TPM - ECC based encryption / decryption using the public key
Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly ...
- 271