Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

7
  • Not totally sure of your question. I think you may be confused with how public/private keys work. Private keys are NEVER distributed under ANY circumstance. Also, you sign with a private key and the public key is used to validate the authenticity of the message. As only the private key holder can sign the message. Commented Aug 22, 2019 at 20:04
  • Our customer wants to sign with only a x509 certificate. What you say is how it is really supossed to work. You sign with your private key that's correct. My question is if it is possible to sign only with the public key in the x509 or if it is necessary to embed your private key in the certificate. In that case, I agree with you that you're implicitly distributing your private key and that you should't do that, right? Commented Aug 22, 2019 at 20:36
  • NEVER distribute the private key. Otherwise you are destroying ANY purpose of using it. You can sign with x509 certificates, that’s common, but it’s the private key that is used to sign. It sounds like you are not totally sure on how it works, no rudeness mentioned at all, so I would seek to only implement something from the advice of an expert in this case. You don’t want to risk getting it wrong. All the best Commented Aug 22, 2019 at 20:48
  • If you sign with a private key it provides evidence of the source of the signed data. That is, only you have the private key, so the signed data came from you. If, on the other hand, you sign with the public key, you are stating absolutely nothing about the data. As a public key is, by definition, public knowledge, I could get hold of it and sign data in your name. The whole idea is completely pointless. Commented Aug 23, 2019 at 5:25
  • There is a very simple argument as to why "only" having the certificate and nothing else is not enough for a signature: The certificate is presented to everybody to prove the identity of the one holding the certificate. If it were enough, then everybody could forge every signature. Commented Aug 23, 2019 at 10:53