RE: integrity and mail encryption

From: Adrian Floarea (adrian.floarea_at_uti.ro)
Date: 11/07/05

  • Next message: Nick Owen: "Re: sites for publishing sec related whitepapers?" 
    To: "'Pranav Lal'" <pranav.lal@gmail.com>, <security-basics@securityfocus.com>
Date: Mon, 7 Nov 2005 14:43:28 +0200

    Yes, you need a certification authority for that. But, this is a problem of
    trust.

    As far as I know a public key infrastructure (technical terms) implies and a
    certification authority.

    More details about this you can find on this link
    http://csrc.nist.gov/pki/PKIResearch.html

    I hope to help you.

    Regards,

    Adi Floarea

    -----Original Message-----
    From: Pranav Lal [mailto:pranav.lal@gmail.com]
    Sent: Saturday, November 05, 2005 6:03 PM
    To: security-basics@securityfocus.com
    Subject: RE: integrity and mail encryption

    Hi Adrian,

    How do you establish ownership of a private key? As others have said you
    need a certifying authority to establish this so a public key
    infra-structure by itself does not provide non-repudiation.

    Pranav
    on Friday 11/4/2005 02:40 PM, Adrian Floarea said:

    In fact the public key digital signature provide non-repudiation which means
    that only the person which has the corresponding private key can make a
    digital signature. Shortly, the process is: you have a private key and a
    public key. The private key is secret. When you make a digital signature,
    first you make a hash of electronic data and after that, you encrypt this
    hash with your private key. When someone wants to verify your signature,
    make again the hash on the data, decrypt the original hash using your public
    key and after that, compare them. Because, you are the only person which has
    the private key, you can't deny that you are the person who make the
    original digital signature.

    Actually the process is much complicated, but the essence is that what I
    explain bottom.

    Regards,

    Security Product Team Leader
    Adrian Floarea, CISA
    Information Security Department
    Bucharest, Romania
    Email: adrian.floarea@uti.ro

    -----Original Message-----
    From: Pranav Lal [mailto:pranav.lal@gmail.com]
    Sent: Wednesday, November 02, 2005 11:21 PM
    To: security-basics@securityfocus.com
    Subject: RE: integrity and mail encryption

    Hi Bob,

    How does public key encryption provide non-repudiation

    Pranav

  • Next message: Nick Owen: "Re: sites for publishing sec related whitepapers?"

    Relevant Pages

    • Re: very basic quextions: public key encryption
      ... is allowed to know your public key ... ... encode the secure hash with my private key. ... i combine the message and the digital signature ... ... possible to simply encrypt the data w/o a digital signature. ...
      (comp.security.ssh)
    • Re: Digital Singatures question
      ... a business process is defined called public key; ... there is a business process called digital signature. ... "something you have" authentication ... ... has access to and use of the corresponding private key. ...
      (comp.security.misc)
    • RE: integrity and mail encryption
      ... I gave my private key to somebody else. ... > so a public key infra-structure by itself does not provide ... > the corresponding private key can make a digital signature. ... you encrypt this hash with your private key. ...
      (Security-Basics)
    • Re: RSACryptoServiceProvider usage question
      ... > private key is not to know what the public key is. ... I wanted to somehow unify encryption and digital signature ... Client application can potentially be hacked so it must not contain the key ...
      (microsoft.public.dotnet.security)
    • RE: PGP scripting...
      ... cryptosystems, ... In these systems divulging your private key compromises the public ... Here is a quick over view of the public key encryption routines (the ...
      (SecProg)