# private key Published articles for private key. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## JDK 27 Security Enhancements DevFeed: [JDK 27 Security Enhancements]() Original publisher: [Read original article]() Author: Sean Mullan Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Inside Java]() Topics: [JDK 27](), [Security](), [Cryptography](), [Encryption](), [TLS (Transport Layer Security)](), [Post-Quantum](), [Release notes]() Tags: [certificates](), [cryptographic](), [encryption](), [jdk-27](), [notes](), [password](), [post-quantum](), [private-key](), [release-notes](), [security](), [tls]() ### AI overview This article reviews selected security enhancements in JDK 27, released on September 15, 2026. It highlights TLS 1.3 support for post-quantum hybrid key exchange mechanisms and the third preview of the PEM API for encoding and decoding cryptographic objects. ### Source excerpt JDK 27 was released on September 15, 2026! As with my previous blogs, I have compiled a list of what I think are the most interesting and useful security enhancements in this release. I have also grouped them into appropriate categories (crypto, TLS, etc) which should make it easier to find out what has changed in each specific area. The JDK 27 release notes also contain further details on these and other enhancements. ## Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption DevFeed: [Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption]() Original publisher: [Read original article]() Author: Ivan Groenewold Published: 2026-08-31T11:48:11Z Content type: tutorial Language: en Sources: [Blog - Percona]() Topics: [MongoDB](), [TLS (Transport Layer Security)](), [Authentication](), [configuration]() Tags: [authentication](), [certificates](), [insight-for-dbas](), [mongodb](), [private-key](), [rotation](), [security](), [tls](), [x509]() ### AI overview This tutorial explains how to renew same-CA X.509 certificates in Percona Server for MongoDB with minimal service interruption. It covers reloading TLS material with rotateCertificates, certificate and private-key configuration, limitations, validation, and cases where hot reload should not be used. ### Source excerpt Expired TLS certificates can prevent new client connections and, when X.509 is used for Percona Server for MongoDB internal authentication, also prevent members of a replica set or sharded cluster from authenticating to one another. In this post we will discuss performing a same-CA renewal: replacement certificates for server, member, and client leaf are issued ... Continued The post Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption appeared first on Percona. ## REST API Authentication Methods Clearly Explained DevFeed: [REST API Authentication Methods Clearly Explained]() Original publisher: [Read original article]() Author: Nikki Siapno Published: 2026-08-05T18:25:08Z Content type: tutorial Language: en Sources: [Level Up Coding System Design Newsletter]() Topics: [Authentication](), [REST API](), [API keys](), [Authorization](), [Security]() Tags: [api](), [api-keys](), [authentication](), [authorization](), [jwt](), [private-key](), [rest](), [security]() ### AI overview This tutorial explains REST API authentication methods, including API keys, bearer tokens, JWTs, HMAC secrets, and mutual TLS. It distinguishes authentication from authorization and discusses operational concerns such as credential rotation, revocation, auditing, rate limiting, and responding to leaked credentials. ### Source excerpt 8 API authentication methods every developer should know. ## Linux ssh-keygen: Set Up SSH Key Authentication the Right Way DevFeed: [Linux ssh-keygen: Set Up SSH Key Authentication the Right Way]() Original publisher: [Read original article]() Author: Hayden James Published: 2026-08-03T10:53:19Z Content type: tutorial Language: en Sources: [Hayden James]() Topics: [OpenSSH](), [ssh](), [Linux](), [Authentication](), [Security](), [passwords]() Tags: [authentication](), [blog](), [guide](), [linux](), [openssh](), [password](), [private-key](), [public-key](), [security](), [server](), [ssh](), [sysadmins]() ### AI overview A practical guide to setting up SSH key authentication on Linux with ssh-keygen. It covers generating key pairs, copying public keys to servers, disabling password login safely, configuring multiple identities, and using passphrases or FIDO2 security keys. ### Source excerpt Password-based SSH login is a liability. This guide walks through generating SSH key pairs with ssh-keygen, deploying public keys, disabling password authentication, and managing multiple keys cleanly with ~/.ssh/config. Continue reading... ## DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport DevFeed: [DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport]() Original publisher: [Read original article]() Author: meina.ghafouri@goteleport.com (Meina Ghafouri) Published: 2025-12-22T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [DevOps](), [CI/CD](), [certificates](), [Security](), [audit]() Tags: [api-keys](), [certificates](), [ci-cd](), [devops](), [environment-variables](), [passwords](), [private-key](), [secrets](), [security]() ### AI overview This tutorial explains the risks of static credentials in DevOps and CI/CD pipelines, including difficult rotation and broad exposure across infrastructure. It presents short-lived certificates and workload identity as ways to reduce risk and limit the exploitation window. ### Source excerpt Learn how to move from static DevOps secrets to short-lived certificates and workload identity, securing CI/CD automation at scale with full audit visibility. ## Recovering/undeleting short deleted files in 50 SLOC of pure C, any filesystem supported. DevFeed: [Recovering/undeleting short deleted files in 50 SLOC of pure C, any filesystem supported.]() Original publisher: [Read original article]() Published: 2025-10-13T22:00:00Z Content type: tutorial Language: en Sources: [Dennis Yurichev]() Topics: [C](), [OpenSSH](), [Linux](), [SQLite](), [Bitcoin](), [Cryptography]() Tags: [bitcoin](), [bug](), [c](), [encryption](), [files](), [filesystem](), [linux](), [openssh](), [private-key](), [sqlite]() ### AI overview This article presents a small pure-C utility for recovering short deleted files by scanning storage for known file headers or boundary strings. It describes recovering data from Linux ext4 SSDs, virtual-machine images, and RAM save files, and notes that deleted OpenSSH keys and Bitcoin wallets may be identifiable. It recommends secure deletion and filesystem encryption to reduce recovery risk. ### Source excerpt Recovering/undeleting short deleted files in 50 SLOC of pure C, any filesystem supported. ## Official Support for DPoP in Keycloak 26.4 DevFeed: [Official Support for DPoP in Keycloak 26.4]() Original publisher: [Read original article]() Author: Giuseppe Graziano Published: 2025-10-09T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [OAuth 2.0](), [Security](), [private key](), [OpenID connect (OIDC)](), [Authorization](), [REST API]() Tags: [documentation](), [idm](), [kerberos](), [keycloak](), [ldap](), [oauth-2-0](), [oidc](), [openid-connect](), [private-key](), [release](), [rest-api](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.4 officially supports OAuth 2.0 Demonstrating Proof-of-Possession (DPoP), which binds access or refresh tokens to a client-controlled public/private key pair. The release adds support across bearer-token endpoints, optional refresh-token-only binding for public clients, and the dpop_jkt parameter in OIDC authorization requests. ### Source excerpt DPoP has been available in Keycloak since version 23.0.0, but only as a preview feature. With the release of Keycloak 26.4, we're happy to share that OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) is now officially supported. What is DPoP? 🔑 DPoP is a Proof-of-Possession mechanism that improves OAuth token security by binding a token (access or refresh) to a public/private key pair controlled by the client. By requiring a signed DPoP proof with each request, DPoP ensures that a stolen bearer token cannot be used without possession of the associated private key. This significantly improves token security in distributed systems. What's New for DPoP in 26.4 🆕 DPoP is now a supported feature and includes some improvements and minor capabilities: Support for all Keycloak endpoints that accept bearer tokens, including the Admin REST API and the Account API. Option to bind only refresh tokens for public clients, while leaving access tokens as bearer if required. Ability to request the dpop_jkt parameter in OIDC authorization requests. For full details, see the official documentation. How to enable and use DPoP in Keycloak 🚀 If you want to force a client to use DPoP, you need to enable the Require DPoP bound tokens switch in the Admin Console Settings tab under Capability config. If Require DPoP bound tokens is off, the client can still send a DPoP proof in the token request. In that case, Keycloak verifies it and adds the thumbprint to the token, but DPoP binding is not enforced. Try It Out 🔍 If you want to experiment with DPoP in practice, you can try it out using the Keycloak FAPI Playground, which includes example client configurations and test flows that demonstrate how DPoP works end-to-end. We'd love to hear what you think about this feature and how we can improve it. Feedback and contributions from the community are always welcome. ## Matter: Improvements to Espressif DAC Provisioning Service DevFeed: [Matter: Improvements to Espressif DAC Provisioning Service]() Original publisher: [Read original article]() Author: John Lee Published: 2024-10-01T00:00:00Z Content type: release Language: en Sources: [Blog on Developer Portal]() Topics: [Matter](), [Espressif](), [Provisioning](), [Cloud]() Tags: [attestation](), [blog](), [certificates](), [cloud](), [devices](), [esp32](), [espressif](), [firmware](), [iot](), [matter](), [private-key](), [provisioning](), [security](), [signing](), [trust](), [update]() ### AI overview Espressif describes updates to its Matter DAC provisioning service, including support for customer-factory manufacturing and secure delivery of Device Attestation Certificates for in-field devices upgrading to Matter. ### Source excerpt Espressif's Secure Manufacturing Service, which was launched last year, has assisted many customers in simplifying their manufacturing. Since a year from launch, we worked with hundreds of customers and served millions of modules that were manufactured with this service. ## Secure boot with auto-signing in ESP RainMaker OTA DevFeed: [Secure boot with auto-signing in ESP RainMaker OTA]() Original publisher: [Read original article]() Author: John Lee Published: 2024-07-29T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [Esp Rainmaker](), [Internet of things](), [Security](), [Espressif](), [Cloud](), [Hardware](), [ESP-IDF]() Tags: [blog](), [developer](), [encryption](), [esp-idf](), [esp-rainmaker](), [esp32](), [espressif](), [fips](), [hardware](), [iot](), [management](), [ota](), [private-key](), [rainmaker](), [secure-boot](), [signing](), [verification]() ### AI overview This article explains how ESP RainMaker's Secure Signing feature manages secure boot keys and automatically signs firmware during OTA upgrades. It describes cloud-based key management, device-specific signing, and role separation for fleet management. ### Source excerpt Security is one of the most important aspects of any IoT system and at Espressif, we take it very seriously. The ESP RainMaker platform offers a secure way to onboard a device onto Wi-Fi network and then control and monitor it through cloud. However, the security of the hardware itself is also critical for the overall system to be secure. Espressif MCUs come with various security features like secure boot, flash encryption, etc. ## Signature counters DevFeed: [Signature counters]() Original publisher: [Read original article]() Author: Adam Langley Published: 2023-08-05T00:00:00Z Content type: article Language: en Sources: [ImperialViolet]() Topics: [WebAuthn](), [Security](), [private key]() Tags: [account](), [private-key](), [security](), [signal]() ### AI overview The article explains WebAuthn signature counters, including their optional nature, how non-zero counters should increase for future assertions from a credential, and how counter inconsistencies might indicate a cloned security key. It argues that sites using counters should lock the account, investigate, and replace the key rather than merely reject the assertion. ### Source excerpt If you look at the structure of the signed messages in WebAuthn you'll notice that one of the fields is called the "signature counter". In the previous long post I said to ignore it, which is still correct, but here's why. Signature counters are optional for the authenticator to implement: it's valid for a security key not to have a signature counter, although the vast majority of them do. In that case, the counter value is always zero. But once a website has seen a non-zero value, then the security key has to ensure that the counter, for all future assertions from a given credential, is strictly increasing. The motivation of the signature counter is that it might allow websites to detect when a security key has been cloned. Cloning a security key is supposed to be very difficult. At the very least, you should need physical access to it, and hopefully you need to spend a substantial amount of time invasively interrogating it. But, if you assume all that happened, then one could clone a security key (probably destroying it in the process), get the private key of a credential out of it, and create a working replica which could be slipped back into the possession of the legitimate user, leaving them unaware that anything has happened. At this point, the attacker can create assertions at will because they know the credential's private key. If all that has happened, then the signature counter might uncover it. Unless the attacker can know exactly when the legitimate user has created an assertion, and thus incremented the counter, then eventually either they or the real user will create an assertion where the counter didn't increase. You might be able to tell, but I consider this a rather far-fetched scenario. Nevertheless, if a website wants to use the signature counters, then it must treat any non-incrementing counter as a signal to lock the account and trigger an investigation. At a minimum, the security key in question should be replaced. Simply rejecting the assertio ## From U2F to passkeys DevFeed: [From U2F to passkeys]() Original publisher: [Read original article]() Author: Adam Langley Published: 2023-07-23T00:00:00Z Content type: article Language: en Sources: [ImperialViolet]() Topics: [Passkeys](), [Authentication](), [passwords](), [Protocol (disambiguation)](), [Security](), [JavaScript]() Tags: [authentication](), [digital-signatures](), [javascript](), [passwords](), [private-key](), [protocol]() ### AI overview This article gives a chronological account of how standards developed from U2F into passkeys. It explains U2F's security-key and JavaScript API standards, the risks of bearer tokens such as passwords and cookies, and how digital signatures can authenticate users without disclosing a private key. ### Source excerpt (This post is nearing 8 000 words. If you want to throw it onto an ereader there's an EPUB version too.) Introduction Over more than a decade, a handful of standards have developed into passkeys--a plausible replacement for passwords. They picked up a lot of complexity on the way, and this post tries to give a chronological account of the development of the core of these technologies. Nothing here is secret; it's all described in various published standards. However, it can be challenging to read these standards and understand how it's meant to fit together. The beginning: U2F U2F stands for "Universal Second Factor". It was a pair of standards, one for computers to talk to small removable devices called security keys, and the second a JavaScript API for websites to use them. The first standard of the pair is also called the Client to Authenticator Protocol (CTAP1), and when the term "U2F" is used in isolation, it usually refers to that. The JavaScript API, now obsolete, was generally referred to as the "U2F API". The goal of U2F was to eliminate "bearer tokens" in user authentication. A "bearer token" is a term of art in authentication that refers to any secret that is passed around to prove identity. A password is the most common example of such a secret. It's a bearer token because you prove who you are by disclosing it, on the assumption that nobody else knows the secret. Passwords are not the only bearer tokens involved in computer security by a long way--the infamous cookies that all web users are constantly bothered about are another example. But U2F was focused on user authentication, while cookies identify computers, so U2F was primarily trying to augment passwords. The problem with bearer tokens is that to use them, you have to disclose them. And knowledge of the token is how you prove your identity. So every time you prove your identity, you are handing another entity the power to impersonate you. Hopefully, the other entity is the intended counterparty and ## Using WSL and Let's Encrypt to create Azure App Service SSL Wildcard Certificates DevFeed: [Using WSL and Let's Encrypt to create Azure App Service SSL Wildcard Certificates]() Original publisher: [Read original article]() Author: Scott Hanselman Published: 2023-06-27T17:17:25Z Content type: tutorial Language: en Sources: [Scott Hanselman]() Topics: [Azure](), [Windows Subsystem for Linux](), [SSL](), [openssl](), [apt](), [pip]() Tags: [apt](), [azure](), [certificates](), [dns](), [install](), [openssl](), [password](), [private-key](), [ssl](), [windows](), [wsl]() ### AI overview This tutorial explains how to use Certbot in Windows Subsystem for Linux with Let's Encrypt to create a wildcard certificate, convert it to a password-protected PFX containing the certificate chain, and upload it to Azure App Service. It also describes importing and exporting the certificate in Windows before updating the App Service binding. ### Source excerpt There are many let's encrypt automatic tools for azure but I also wanted to see if I could use certbot in wsl to generate a wildcard certificate for the azure Friday website and then upload the resulting certificates to azure app service. Azure app service ultimately needs a specific format called dot PFX that includes the full certificate path and all intermediates. Per the docs, App Service private certificates must meet the following requirements: Exported as a password-protected PFX file, encrypted using triple DES. Contains private key at least 2048 bits long Contains all intermediate certificates and the root certificate in the certificate chain. If you have a PFX that doesn't meet all these requirements you can have Windows reencrypt the file. I use WSL and certbot to create the cert, then I import/export in Windows and upload the resulting PFX. Within WSL, install certbot: sudo apt update sudo apt install python3 python3-venv libaugeas0 sudo python3 -m venv /opt/certbot/ sudo /opt/certbot/bin/pip install --upgrade pip sudo /opt/certbot/bin/pip install certbot Then I generate the cert. You'll get a nice text UI from certbot and update your DNS as a verification challenge. Change this to make sure it's two lines, and your domains and subdomains are correct and your paths are correct. sudo certbot certonly --manual --preferred-challenges=dns --email YOUR@EMAIL.COM --server https://acme-v02.api.letsencrypt.org/directory --agree-tos --manual-public-ip-logging-ok -d "azurefriday.com" -d "*.azurefriday.com" sudo openssl pkcs12 -export -out AzureFriday2023.pfx -inkey /etc/letsencrypt/live/azurefriday.com/privkey.pem -in /etc/letsencrypt/live/azurefriday.com/fullchain.pem I then copy the resulting file to my desktop (check your desktop path) so it's now in the Windows world. sudo cp AzureFriday2023.pfx /mnt/c/Users/Scott/OneDrive/Desktop Now from Windows, import the PFX, note the thumbprint and export that cert. Import-PfxCertificate -FilePath "AzureFriday2023.pfx" - ## Authenticated encryption: why you need it and how it works DevFeed: [Authenticated encryption: why you need it and how it works]() Original publisher: [Read original article]() Author: andreacorbellini Published: 2023-03-09T18:35:00Z Content type: tutorial Language: en Sources: [Andrea Corbellini]() Topics: [Cryptography](), [Encryption](), [ChaCha](), [Algorithms]() Tags: [algorithms](), [cryptographic](), [cryptography](), [encryption](), [private-key](), [public-key](), [stream](), [xor]() ### AI overview This tutorial explains malleability in modern cryptographic ciphers and how authenticated encryption addresses it. It introduces symmetric ciphers, illustrates the issue with examples, and discusses ChaCha20-Poly1305 and AES-GCM. ### Source excerpt In this article I want to explore a common problem of modern cryptographic ciphers: malleability. I will explain that problem with some hands-on examples, and then look in detail at how that problem is solved through the use of authenticated encryption. I will describe in particular two algorithms that provide authenticated encryption: ChaCha20-Poly1305 and AES-GCM, and briefly mention some of their variants. The problem ... ## Accelerating Matter Device Manufacturing DevFeed: [Accelerating Matter Device Manufacturing]() Original publisher: [Read original article]() Author: John Lee Published: 2023-02-19T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [Matter](), [Espressif](), [Internet of things](), [Security](), [Provisioning]() Tags: [blog](), [certificates](), [esp32](), [espressif](), [iot](), [matter](), [private-key](), [provisioning](), [security]() ### AI overview This article explains Espressif's Matter Pre-Provisioning Service, which provides modules securely pre-programmed with the certificates and other unique details required by Matter devices. It describes Device Attestation, Device Attestation Certificates, certificate authorities, and protection of the DAC private key during manufacturing. ### Source excerpt Given the latest developments in the IoT industry, there is a strong rush towards building Matter enabled smart devices. (If you are new to Matter, please read up about Matter in our series of blog posts here). We have been actively working on creating solutions that help accelerate our customers to build and launch Matter-enabled devices faster and that too in a cost-effective way. ## Exposing AWS KMS Asymmetric Keys as a JWKS DevFeed: [Exposing AWS KMS Asymmetric Keys as a JWKS]() Original publisher: [Read original article]() Author: Brian Maloney Published: 2023-02-02T20:53:31Z Content type: tutorial Language: en Sources: [Benchling]() Topics: [OpenID connect (OIDC)](), [Authentication](), [Authorization](), [Security](), [Amazon Web Services](), [JSON Web Tokens](), [API](), [threat detection]() Tags: [api](), [authentication](), [authorization](), [aws](), [benchling](), [encryption](), [engineering](), [enterprise](), [identity](), [jwks](), [least-privilege](), [oauth](), [oauth-2-0](), [oauth2](), [oidc](), [openid-connect](), [private-key](), [public-key](), [secrets](), [security](), [threat-detection](), [token]() ### AI overview This Benchling article discusses service-to-service authentication with OAuth 2.0 and OpenID Connect. It explains why administrator-generated API tokens create secret-management, attribution, and least-privilege problems, and introduces private_key_jwt authentication with public-key cryptography while considering AWS KMS for private-key management and JWKS exposure. ### Source excerpt Here at Benchling, interaction with services is a large part of our business, from employees interacting with the software-as-a-service products with which we conduct our daily business, all the way down to interactions between the services that make up the Benchling application platform itself. Secure authentication and authorization to services is a long-standing issue in the industry, but one that has been improving in recent years due to the widespread adoption of modern standards such as OAuth 2.0 and OpenID Connect (OIDC). One specific use case for service-to-service authentication that is important to Benchling Security is connecting our Threat Detection Pipeline to our enterprise identity services vendor. We use this connection to connect log and other data provided by the vendor to our centralized Threat Detection Platform, where we correlate this with other sources of intelligence to detect risky or suspicious user activity in near real-time. Modern Authentication with OIDC Our specific identity services vendor offers two options for authenticating to its API: either an API token that an administrator can generate, or interaction by acting as an Application. API tokens, while very easy to use, are a poor choice for two reasons: First, they are a static secret that must be handled carefully and rotated frequently to mitigate the risk of a leaked key, which causes significant management overhead. Second, the identity services vendor links the privileges and identity of an API token inextricably to the administrator who generated it. This causes actions using the key to be attributed to the administrator and also makes it impossible to implement the principle of least privilege. Client authentication when acting as an Application allows the use of OIDC, and this vendor specifically requires the use of the private_key_jwt Client Authentication method. Enforcing this requirement is a good choice on the part of the vendor -- by using public-key encryption, no sec ## Ultimate Go Episode 16: Adding Transaction Validation and Security to a Blockchain DevFeed: [Ultimate Go Episode 16: Adding Transaction Validation and Security to a Blockchain]() Original publisher: [Read original article]() Published: 2023-01-17T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Blockchain](), [Security](), [Go Language]() Tags: [bitcoin](), [blockchain](), [engineering](), [ethereum](), [go](), [go-blockchain](), [iam](), [identity](), [identity-management](), [learn](), [private-key](), [protocol](), [public-address](), [secure-blockchain](), [security](), [validation](), [verification]() ### AI overview This video explains how to add validation mechanisms to blockchain nodes. It covers checking a transaction's destination, verifying signature rules defined by the protocol, and calculating a user's address from a transaction signature. ### Source excerpt Introduction In episode 15, Bill architected a solution to ensure all the users on his blockchain were given a unique identifier. His approach consisted of essentially leveraging the randomness of a user's private key to ensure each identifier is unique. A disadvantage Bill pointed out with this is that a user may forget their private key and ultimately lose access to their account. To circumvent this issue, Bill proposed the usage of a mnemonic, that is composed of 12 to 24 words, to act as the private key since it's simpler to keep track of and hard to guess. ## Ultimate Go: Advanced Engineering Episode 15 DevFeed: [Ultimate Go: Advanced Engineering Episode 15]() Original publisher: [Read original article]() Published: 2023-01-12T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Blockchain](), [Transactions](), [Ethereum]() Tags: [bitcoin](), [blockchain](), [digital-signature](), [ecdsa](), [ethereum](), [generate](), [go-blockchain](), [library](), [private-key](), [public-address](), [public-key](), [transactions]() ### AI overview This video tutorial explains how to derive a blockchain user's unique address from a public key recovered from a transaction signature. It covers reading the public key, validating the transaction's origin, and generating the user's address using Go Ethereum library functions. ### Source excerpt Introduction In episode 14, Bill architected a solution to digitally sign the transactions on his blockchain. His solution retrieved the private key by : loading private key data from disk, parsing the key data and returning the ECDSA private key. The private key is then used to generate the signature of a transaction. While writing the code to perform this functionality, Bill highlighted how a blockchain node can use a transaction's signature to extrapolate the public key. ## A short overview of Passkeys, and how to use them to secure your infrastructure with Teleport DevFeed: [A short overview of Passkeys, and how to use them to secure your infrastructure with Teleport]() Original publisher: [Read original article]() Author: ben@goteleport.com (Ben Arent) Published: 2023-01-12T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Passkeys](), [Authentication](), [WebAuthn](), [Security](), [API](), [QR Code]() Tags: [android](), [authentication](), [ios](), [private-key](), [qr-code](), [security](), [verification](), [windows-11]() ### AI overview This article explains passkeys as a passwordless authentication method for securing infrastructure with Teleport. It describes cross-platform and cross-browser login, cloud storage backed by a phone's secure enclave, and FIDO2 proximity proof using Bluetooth when a QR code is scanned. ### Source excerpt A short overview of Passkeys, and how to use them to secure your infrastructure with Teleport. ## Creating Ethereum Digital Signatures with Go DevFeed: [Creating Ethereum Digital Signatures with Go]() Original publisher: [Read original article]() Published: 2023-01-11T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Go Language](), [Blockchain](), [Ethereum](), [Transactions](), [Library]() Tags: [bitcoin](), [blockchain](), [code](), [digital-signature](), [ecdsa](), [ethereum](), [go](), [go-blockchain](), [library](), [private-key](), [public-key](), [signed-data](), [transactions]() ### AI overview A video tutorial demonstrating how to create Ethereum digital signatures with Go. It covers private ECDSA keys, signing objects, loading private keys from disk, decoding Ethereum signatures, and deriving public keys using the Go Ethereum library. ### Source excerpt Introduction In episode 13, Bill discussed the idea of adding salt to a hash and how modern crypto-currency blockchains use it to better interpret requests sent to nodes. He continued by defining a function called stamp that embeds a salt within a hash. While writing the function, Bill stated that he would use keccak256 as it's the same algorithm used by Ethereum to generate hash values. Bill will use the APIs provided with Go Ethereum to generate a keccak256 hash. He plans on reusing the stamp function in the future to digitally sign transactions performed on his blockchain. ## Why OpenSSH private key files differ after restoration DevFeed: [Why OpenSSH private key files differ after restoration]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2022-12-20T00:00:00Z Content type: tutorial Language: en Sources: [Carlos Becker]() Topics: [OpenSSH](), [private key](), [Go](), [Code](), [C]() Tags: [code](), [go](), [openssh](), [private-key](), [ssh]() ### AI overview This article investigates why restoring an SSH private key and marshaling it back to OpenSSH private-key format produces a different block. It explains that duplicated random values in the encrypted format allow successful decryption to be checked, while the restored keys can still represent the same key. ### Source excerpt Not long ago, when I was building melt, I learned something interesting. ## What's New in Teleport 11 DevFeed: [What's New in Teleport 11]() Original publisher: [Read original article]() Author: kenneth.dumez@goteleport.com (Kenneth DuMez) Published: 2022-11-09T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [Kubernetes](), [Helm charts](), [Security](), [Amazon EKS](), [Azure Kubernetes Service](), [OpenSSH](), [Protocol (disambiguation)](), [GitHub Actions]() Tags: [aks](), [azure-kubernetes-service](), [github-actions](), [helm-charts](), [new-features](), [overview](), [private-key](), [release](), [security](), [sftp]() ### AI overview An overview of Teleport 11 features, including hardware-backed private keys on Yubikey devices, server-side SFTP support, persistent-storage changes for Helm deployments, and automatic discovery and enrollment of EKS and AKS clusters. ### Source excerpt An overview of all of the new features added into Teleport 11. ## Issuing and using SSH Certificates DevFeed: [Issuing and using SSH Certificates]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2022-11-09T00:00:00Z Content type: tutorial Language: en Sources: [Carlos Becker]() Topics: [certificates](), [ssh](), [OpenSSH](), [Docker](), [configuration-management]() Tags: [certificates](), [configuration-management](), [docker](), [openssh](), [private-key](), [public-key](), [ssh]() ### AI overview This tutorial explains how SSH certificates let administrators control access to servers without managing authorized keys. It covers creating a Certificate Authority key pair, issuing short-lived user certificates, using certificates with private keys, and testing the setup with OpenSSH in Docker. ### Source excerpt SSH certificates allow system administrators to SSH into machines without having to manage authorized keys in the servers. ## The Complete Guide to iOS 16 Passkeys - App and Backend Implementation DevFeed: [The Complete Guide to iOS 16 Passkeys - App and Backend Implementation]() Original publisher: [Read original article]() Author: Allison Poppe Published: 2022-11-03T14:29:49Z Content type: tutorial Language: en Sources: [QuickBird Studios Blog]() Topics: [Passkeys](), [Authentication](), [iOS](), [WebAuthn](), [API](), [Back end]() Tags: [authentication](), [guide](), [ios](), [post](), [private-key](), [public-key](), [verification]() ### AI overview This tutorial explains how to integrate iOS 16 passkeys into an application, covering app-side authentication and the backend API endpoints needed to support registration and sign-in. It describes passkeys as Apple's implementation of WebAuthn and explains that authentication uses a public key stored on the server while the private key remains on the user's device. ### Source excerpt With iOS 16 Apple introduced a way to go passwordless called Passkeys. In this article, we are covering what needs to be done on the app side but also what needs to be implemented in the backend The post The Complete Guide to iOS 16 Passkeys - App and Backend Implementation appeared first on QuickBird Studios. ## What Are JWTs? DevFeed: [What Are JWTs?]() Original publisher: [Read original article]() Author: info@goteleport.com (Victor Elezua) Published: 2022-09-27T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [JSON Web Tokens](), [Authorization](), [distributed-systems](), [Cookies](), [JSON]() Tags: [authorization](), [cookies](), [distributed](), [ecdsa](), [http](), [implementation](), [json](), [jwt](), [microservices](), [private-key]() ### AI overview This tutorial explains JSON Web Tokens (JWTs), including their definition, compact self-contained structure, digital signing methods, authorization use, stateless session management, benefits, risks, and common implementation mistakes. It also contrasts JWT-based sessions with cookies in distributed systems and microservices. ### Source excerpt In this blog post, we'll deep-dive into JSON web tokens (JWTs), how JWTs work and how to implement them securely. [Next page]()