English 中文(简体)
为什么需要证书才能签署,而不是仅仅需要私人/公共钥匙?
原标题:Why certificate is needed for signing instead of just private/public key pair?

Newbie question: some vendors propose solution like generating dynamic certificates to allow user who haven t classic certificate to sign documents. But why not just generate private/public keys alone instead of bothering with certificate format ?

最佳回答

证书(公用钥匙)的目的是对公关钥匙的特性(即与钥匙配对相关的所有人/实体)进行约束,并可能具有各种特征,告诉你证书可能用于什么。 https://security.stack Exchange.com/a/14486/2435” SE。

您总是与私人钥匙(而不是公用钥匙或证书)签署,但公用钥匙或证书往往附在已签署的文件中。

如果你有公开钥匙的明确清单,你知道并且可以与用户独立联系,那么你就不需要证书。

证书允许第三方(已签署证书的)在识别符号与公用钥匙之间主张具有约束力的。 即使你事先不知道身份,只要你信任签署证书的实体,你也可以把签名与签名人的身份联系起来。

动态生成的证书在这种情况下可能不会非常有用,除非你相信能够动态生成证书的当事人(我不相信你指的是工具本身,或者也许你也知道的网站)。

通常,X.509证书将仅用于附上该签名,因为该工具要求该签字,而你可能能够与你直接掌握在你核实签名工具上的公用钥匙相匹配。 有时,它也只是为了预见一个有益一天的情况。

例如,如果你向Maven中央存放处发表自己的作品,你将被要求用你的PGP证书(通常只称为PGP公共钥匙)签署。 然而,在这一过程期间,根本没有对证书进行核查(只有自己签字的PGP证书是充分的)。 这使得这一过程在本案中相对毫无意义,但如果你能够稍后核实这些证书,则有可能更严格地表明你想要使用。

问题回答

同样,但你需要第三方同意,私人钥匙属于你认为属于谁。

Signing proves first of all authorship (or approval) of the document by some person. And the key alone won t prove anything. This is what the certificate is needed for - some certificate authority signs the certificate of the user and certifies that the keypair belongs to the person (or legal entity) to which the certificate is issued. The reader of the document can ensure that the signature is valid not by just computing the signature itself, but also by validating the certificate and seeing the name of the certificate owner.

我不理解供应商能够动态签发证书——签发证书的方式是不是自签(自签证书在签署文件时意义不大)要求私人钥匙,用于签署证书,应当纳入这些供应商的软件,因此也容易被滥用。





相关问题
Signed executables under Linux

For security reasons, it is desirable to check the integrity of code before execution, avoiding tampered software by an attacker. So, my question is How to sign executable code and run only trusted ...

MALICIOUS_CODE EI_EXPOSE_REP Medium

I run findbugs against all of my code and only tackle the top stuff. I finally got the top stuff resolved and now am looking at the details. I have a simple entity, say a user: public class User ...

XSS on jsbin.com

Anyone know if jsbin.com implements any protection for XSS or other javascript attacks? I see jsbin links used fairly regularly on sites like this one and I can t find any indication from the site ...

Make md5 strong

Im making a website that will intergrate with game that only support md5 hashing metod (atm). Which ofc is not especially safe anymore. But how could i make it stronger? Should I just generate long ...

Why running a service as Local System is bad on windows?

I am trying to find out the difference between difference service account types. I tumbled upon this question. The answer was because it has powerful access to local resources, and Network Service ...

Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...

热门标签