Skip to content

Cryptographic Token Interface Standard, Encrypt and Sign Confidential Emails

Jump to bottom
Yash edited this page Jul 24, 2019 · 1 revision

Cryptographic Token Interface Standard

PKCS #1 v1.5 RSA signature with MD2, MD5, SHA-1, SHA-256, SHA-384, SHA-512, RIPE-MD 128 or RIPE-MD 160

Function Key type Input length (bits) Output length (bits)
C_Sign RSA private key any k
C_Verify RSA public key any, k 2 N/A

Comparison of cryptographic hash functions

SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA).

Signature Algorithms sha-256RSA or sha-512RSA, hash Functions and their respective object identifiers.

Hash Functions
Signature Hash Algorithm		 Object Identifier
Signature Algorithm
SHA-256 sha256WithRSAEncryption
SHA-384 sha384WithRSAEncryption
SHA-512 sha384WithRSAEncryption

NOTE: These certificates can be used up to the maximum certificate validity (max. three years) in market communication.

Encrypt and Sign Confidential Emails Zertificon

Certificate signatures (vs) email signatures

German Energy Sector: All newly issued certificates from 01/01/2019 onwards must be signed with RSASSA-PSS. In compliance with these regulations, email signatures may also be issued with certificates the certification authority signed with RSASSA-PKCS1-v1_5.

PKI Solutions

The following encoding applies to the exchange of public certificates:

  1. DER-encoded-binary X.509 (with file extension: .cer) or
  2. Base-64-encoded X.509 (with file extension: .cer).

When a certificate has been signed with PKCS #1 v2.1 signatures, you will see the Signature Algorithm listed as RSASSA-PSS.

Basic Certificate FieldsRFC5280 signatureAlgorithm : AlgorithmIdentifier[RSASSA-PSS]

Standalone CAs such as Root and Policy CAs CAPolicy.inf

PKI and password based encryption

Z1 Gateway is highly scalable and simple to integrate into existing email infrastructures with anti-spam and anti-virus solutions. The high-speed real-time processing and fail-over capabilities support mission critical environments & dovetail with business continuity planning.

PKI Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication. PKI client authentication

Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files UnlimitedJCEPolicyJDK8C:\Softwares\JDK\jdk1.8.0_121\jre\lib\security

we need to extract the zipped file into a directory of our choice – which contains two jar files: local_policy.jar, US_export_policy.jar
Finally, we need to look for the {JAVA_HOME}/lib/security folder and replace the existing policy files with the ones that we’ve extracted here.

Java KeyStores (*.jks, *.keystore, *.jceks, *.ks) PKCS #12 Keystores (*.pfx, *.p12) Bouncy Castle Keystores (*.bks, *.uber)

Baeldung.com Preparing Certificate And Private Key Baeldung.cer, Baeldung.p12 (password = “password”)

W3C Symmetric Key encryption: The private keys and corresponding certificates are stored in files ending with ".p12". These are PKCS12 files with password passwd.

KeyStore Explorer @kaikramer github KeyStore Explorer is an open-source GUI replacement for the Java command-line utilities keytool and jarsigner.

Clone this wiki locally