# public key A public key is the public part of an asymmetric cryptographic key pair, used to verify signatures or encrypt data. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## A bit more on Twitter/X's new encrypted messaging DevFeed: [A bit more on Twitter/X's new encrypted messaging]() Original publisher: [Read original article]() Author: Matthew Green Published: 2025-06-09T18:22:31Z Content type: article Language: en Sources: [Matthew Green]() Topics: [End-to-End Encryption](), [X (Twitter)](), [Encryption](), [Security](), [vulnerability](), [public key](), [Ratchet](), [Server](), [passwords](), [Meta]() Tags: [e2e](), [encryption](), [instagram](), [messaging](), [messenger](), [protocol](), [protocols](), [public-key](), [secret-storage](), [security](), [signal](), [technology](), [vulnerability]() ### AI overview This article examines XChat, X's end-to-end encrypted messaging protocol, focusing on its lack of forward secrecy and its server-side storage of user private keys. It explains the Juicebox key-storage design and argues that the security of the system depends heavily on its deployment and server protections. ### Source excerpt Update 6/10: Based on a short conversation with an engineering lead at X, some of the devices used at X are claimed to be using HSMs. See more further below. Matthew Garrett has a nice post about Twitter (uh, X)'s new end-to-end encryption messaging protocol, which is now called XChat. The TL;DR of Matthew's post ... Continue reading A bit more on Twitter/X's new encrypted messaging -> ## A symmetric-key approach to post-quantum Web PKI DevFeed: [A symmetric-key approach to post-quantum Web PKI]() Original publisher: [Read original article]() Author: Adam Langley Published: 2024-04-07T00:00:00Z Content type: opinion Language: en Sources: [ImperialViolet]() Topics: [Cryptography](), [Post-Quantum](), [Encryption](), [TLS (Transport Layer Security)](), [public key](), [Security, Privacy and Abuse Prevention](), [kerberos]() Tags: [cryptography](), [dns](), [don-t](), [kerberos](), [post-quantum](), [public](), [public-key](), [tls]() ### AI overview The article proposes using DNS records and shared symmetric keys with multiple certificate authorities to help authenticate a Kyber key agreement between a client and server. It notes that initial public-key connections to the authorities would still require large post-quantum signatures and raises privacy and policy concerns because authorities could observe which servers clients contact. ### Source excerpt (I think this is worth pondering, but I don't mean it too seriously--don't panic.) Are the sizes of post-quantum signatures getting you down? Are you despairing of deploying a post-quantum Web PKI? Don't fret! Symmetric cryptography is post-quantum too! When you connect to a site, also fetch a record from DNS that contains a handful of "CA" records. Each contains: a UUID that identifies a CA ECA-key(server-CA-key, AAD=server-hostname) A key ID so that the CA can find "CA-key" from the previous field. "CA-key" is a symmetric key known only to the CA, and "server-CA-key" is a symmetric key known to the server and the CA. The client finds three of these CA records where the UUID matches a CA that the client trusts. It then sends a message to each CA containing: ECA-key'(client-CA-key) -- i.e. a key that the client and CA share, encrypted to a key that only the CA knows. We'll get to how the client has such a value later. A key ID for CA-key'. Eclient-CA-key(client-server-key) -- the client randomly generates a client-server key for each CA. The CA record from the server's DNS. The hostname that the client is connecting to. The CA can decrypt "client-CA-key" and then it can decrypt "server-CA-key" (from the DNS information that the client sent) using an AAD that's either the client's specified hostname, or else that hostname with the first label replaced with *, for wildcard records. The CA replies with Eserver-CA-key(client-server-key), i.e. the client's chosen key, encrypted to the server. The client can then start a TLS connection with the server, send it the three encrypted client-server keys, and the client and server can authenticate a Kyber key-agreement using the three shared keys concatenated. Both the client and server need symmetric keys established with each CA for this to work. To do this, they'll need to establish a public-key authenticated connection to the CA. So these connections will need large post-quantum signatures, but that cost can be amortised over ## Keycloak 23.0.1 released DevFeed: [Keycloak 23.0.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2023-11-29T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [OpenID connect (OIDC)](), [saml](), [certificates](), [public key]() Tags: [bugs](), [http](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [migration-guide](), [oidc](), [openid-connect](), [public-key](), [release](), [saml](), [sso](), [update](), [x509]() ### AI overview Keycloak 23.0.1 was released on November 29, 2023. The release notes provide download and upgrade guidance and list resolved issues involving LDAP user storage, Firefox storage access, the admin console, X509 certificate validation, SAML, the Operator, group search, and token refresh. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #23841 Users page with LDAP User Storage Provider Cannot read properties of undefined admin/ui #23872 Attempt to request storage access in Firefox oidc #24261 "Unlink users"-Option greyed out in ldap federation admin/ui #24958 Error handling in admin console when update of user fails due the 400 HTTP error code admin/ui #24961 Keycloak not able to handle multiple validating X509 certificates when public key are the same saml #24984 Operator is missing CRDs metadata in CSV operator #25008 Group search when creating user admin/ui #25022 NPE in checkAndBindMtlsHoKToken on Token Refresh when using SuppressRefreshTokenRotationExecutor and Certificate Bound Token oidc ## Encrypting Arbitrary Data with Elliptic Curve ElGamal DevFeed: [Encrypting Arbitrary Data with Elliptic Curve ElGamal]() Original publisher: [Read original article]() Author: andreacorbellini Published: 2023-01-02T06:30:00Z Content type: tutorial Language: en Sources: [Andrea Corbellini]() Topics: [Cryptography](), [Encryption](), [private key](), [public key](), [Provable security]() Tags: [cryptography](), [ecc](), [elgamal](), [encryption]() ### AI overview This tutorial explains that elliptic curve keys can encrypt arbitrary data directly and introduces elliptic curve ElGamal as an example. It also notes that pure elliptic curve encryption is not widely used or standardized because key agreement is more convenient for most applications. ### Source excerpt From time to time, I hear people saying that Elliptic Curve Cryptography (ECC) cannot be used to directly encrypt data, and you can only do key agreement and digital signatures with it. This is a common misconception, but it's not actually true: you can indeed use elliptic curve keys to encrypt arbitrary data. And I'm not talking about hybrid-encryption schemes (like ECIES ... ## How to Access Infrastructure Without Usernames and Passwords DevFeed: [How to Access Infrastructure Without Usernames and Passwords]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2022-07-27T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [passwords](), [Authentication](), [Security](), [private key](), [ssh](), [public key](), [Vulnerabilities]() Tags: [authentication](), [infrastructure](), [passwords](), [private-key](), [public-key](), [security](), [ssh](), [vulnerabilities]() ### AI overview The article argues that passwords, private keys, API keys, and other secrets create risks through sharing, loss, theft, leakage, and human error. It presents identity-based access as a way to consolidate authentication for growing teams and infrastructure. ### Source excerpt Announcing the release of Teleport 10.0 which adds support for passwordless logins to infrastructure. ## WebAuthn, FIDO2, and CTAP: Concepts and Components of Passwordless Authentication DevFeed: [WebAuthn, FIDO2, and CTAP: Concepts and Components of Passwordless Authentication]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-07-07T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [WebAuthn](), [Authentication](), [public key](), [browsers](), [Security](), [W3C]() Tags: [authentication](), [browsers](), [protocol](), [public-key](), [security](), [w3c](), [web]() ### AI overview This tutorial explains WebAuthn as a public-key authentication API for web browsers. It introduces the relationship between WebAuthn, FIDO2, the W3C specification, and CTAP, and describes the components required for passwordless authentication. ### Source excerpt This post introduces basic concepts and details related to WebAuthn. ## SSH Certificates: How Do OpenSSH Certificates Compare to X.509? DevFeed: [SSH Certificates: How Do OpenSSH Certificates Compare to X.509?]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-06-23T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [OpenSSH](), [certificates](), [Authentication](), [public key]() Tags: [authentication](), [certificates](), [openssh](), [public-key](), [security]() ### AI overview This article explains how OpenSSH certificates differ from X.509 certificates. It describes OpenSSH's custom certificate format and certificate-based authentication flow, including CA signing, certificate validation, expiration checks, and security constraints. ### Source excerpt Learn how OpenSSH certificates differ from X.509. ## How to Configure SSH Certificate-Based Authentication DevFeed: [How to Configure SSH Certificate-Based Authentication]() Original publisher: [Read original article]() Author: info@goteleport.com (Honda McLaren) Published: 2022-04-26T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Authentication](), [certificates](), [OpenSSH](), [Tutorial](), [Security](), [public key](), [private key]() Tags: [authentication](), [certificates](), [openssh](), [private-key](), [protocol](), [public-key](), [security](), [ssh](), [tutorial]() ### AI overview This tutorial explains how to configure SSH certificate-based authentication for an OpenSSH server. It contrasts static SSH keys with short-lived, CA-signed certificates that include identity, expiration, and policy controls, and outlines how servers validate certificates. ### Source excerpt Learn how to configure SSH certificate-based authentication in OpenSSH using short-lived, CA-signed certificates to replace static SSH keys and improve security. ## SSH Keys Compared: RSA, ECDSA, Ed25519 DevFeed: [SSH Keys Compared: RSA, ECDSA, Ed25519]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2022-04-07T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [OpenSSH](), [Cryptography](), [Authentication](), [public key](), [private key](), [certificates](), [Post-Quantum]() Tags: [authentication](), [certificates](), [cryptography](), [ecdsa](), [ed25519](), [openssh](), [post-quantum](), [private-key](), [public-key](), [rsa](), [ssh]() ### AI overview A guide to SSH public-key authentication that compares RSA, ECDSA, and EdDSA (Ed25519), recommends Ed25519 for most uses, and discusses older-system compatibility, key generation, fingerprints, rotation, and certificates. ### Source excerpt Comparing SSH keys: RSA, DSA, ECDSA, and Ed25519 explained, with a straight algorithm recommendation and the move from keys to certificates. Read on. ## How to Set Up SSH Keys: A Step-by-Step Guide (2026) | Teleport DevFeed: [How to Set Up SSH Keys: A Step-by-Step Guide (2026) | Teleport]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-02-03T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [ssh](), [ed25519](), [OpenSSH](), [private key](), [public key](), [GitHub](), [Server]() Tags: [ed25519](), [github](), [guide](), [how-to](), [openssh](), [private-key](), [public-key](), [ssh]() ### AI overview A step-by-step guide to setting up SSH keys with ssh-keygen and Ed25519, adding public keys to servers or GitHub, and protecting private keys with passphrases. It also explains when short-lived SSH certificates may be preferable to long-lived keys. ### Source excerpt Learn how to set up SSH keys with ssh-keygen and Ed25519, add your key to a server or GitHub, and when short-lived SSH certificates beat long-lived keys. ## Revoking Former Employees' Access with Short-Lived Credentials DevFeed: [Revoking Former Employees' Access with Short-Lived Credentials]() Original publisher: [Read original article]() Author: ben@goteleport.com (Ben Arent) Published: 2021-10-28T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Access Control](), [Cybersecurity](), [public key](), [ssh](), [OpenSSH]() Tags: [access-control](), [credentials](), [cybersecurity](), [public-key](), [ssh]() ### AI overview This Teleport blog post uses Halloween imagery to explain access-control risks from former employees retaining credentials or public keys. It recommends short-lived credentials populated through a central identity provider and revoking access when employees leave. ### Source excerpt Are you sure you've revoked all the credentials for the summer intern? This is a fun seasonal deep-dive into what we can learn from Halloween ceremonies. ## How to Deploy SSH Certificates Securely in Production DevFeed: [How to Deploy SSH Certificates Securely in Production]() Original publisher: [Read original article]() Author: sasha@goteleport.com (Alexander Klizhentas) Published: 2021-02-18T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [certificates](), [Security](), [ssh](), [Authentication](), [public key](), [private key](), [trust](), [Cryptography]() Tags: [authentication](), [certificates](), [hardening](), [how-to](), [private-key](), [public-key](), [security](), [ssh](), [trust]() ### AI overview This tutorial explains SSH public-key authentication, SSH certificates, and the key-management challenges involved in securely deploying certificate-based authentication in production. It emphasizes that poorly implemented certificate systems can be less secure than public-key authentication. ### Source excerpt How to deploy SSH certificates in production to make security better, not worse. ## Attacking Smart Card Based Active Directory Networks DevFeed: [Attacking Smart Card Based Active Directory Networks]() Original publisher: [Read original article]() Author: CCob Published: 2020-10-04T19:31:42Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [active directory](), [Authentication](), [certificates](), [private key](), [Cryptography](), [kerberos](), [public key]() Tags: [active-directory](), [attacks](), [authentication](), [certificates](), [cobalt-strike](), [hooking](), [kerberos](), [pin](), [pinswipe](), [pki](), [private-key](), [public-key](), [rubeus](), [smart-card](), [swipe](), [weaponize]() ### AI overview This article examines attacks against smart-card-enforced Active Directory networks. It explains that a physical smart card is not necessarily required for smart-card logon when the corresponding private key is available, describes certificate requirements and policy-related certificate abuse, and introduces PKINIT as public-key support for Kerberos pre-authentication. ### Source excerpt Introduction Recently I was involved in an engagement where I was attacking smart card based Active Directory networks. The fact is though, you don't need a physical smart card at all to authenticate to Active Directory that enforces smart card logon. The attributes of the certificate determine if it can be used for smart card [...] The post Attacking Smart Card Based Active Directory Networks appeared first on Ethical Chaos. ## Galileo's Proposed Authentication Algorithm: Part 2 DevFeed: [Galileo's Proposed Authentication Algorithm: Part 2]() Original publisher: [Read original article]() Published: 2020-08-26T08:43:09Z Content type: article Language: en Sources: [Bert Hubert's writings]() Topics: [Cryptography](), [Authentication](), [Encryption](), [public key](), [Protocol (disambiguation)](), [navigation]() Tags: [authentication](), [cryptographic](), [cryptography](), [encryption](), [gnss](), [navigation](), [protocol](), [public-key]() ### AI overview This second part explains how Galileo OSNMA uses delayed disclosure of symmetric cryptographic keys to let receivers verify earlier navigation-message signatures. It also discusses how the protocol fits authentication data into Galileo page and subframe structures. ### Source excerpt Recapping from part 1: Galileo will soon add cryptographic signatures to the navigation messages. These cryptographic signatures are made with symmetric cryptography, which means clever techniques are required to prevent receivers from impersonating the network. The key to the technique is first signing messages, and only later disclosing the key used for the signatures, thus invalidating it for further use. Receivers can however verify that earlier signatures were indeed made with that key. ## Why SSL scanner results can be misleading for app connections DevFeed: [Why SSL scanner results can be misleading for app connections]() Original publisher: [Read original article]() Author: Question authority Published: 2020-07-01T00:00:00Z Content type: article Language: en Sources: [Signal Blog]() Topics: [SSL](), [certificates](), [web browser](), [public key](), [Firefox](), [Mozilla]() Tags: [browsers](), [certificates](), [mozilla](), [public-key](), [ssl](), [web-browser]() ### AI overview The article explains that SSL scanning utilities often focus on web-browser compatibility and performance, which can make their results misleading for connections made by applications. It also describes how browsers rely on trusted root certificates from certificate authorities to verify website connections. ### Source excerpt Sometimes people dive into Signal's code looking for domain names, and then they send us screenshots asking if they should be concerned: We reply with a short explanation that lays out why there's nothing wrong, but we understand the confusion. Nobody would be excited about getting a grade like this on a homework assignment - and you'd have to stay after class and ask the teacher what the hell a "T" even means on your report about summer vacation ("T"oo cool for school?). Let's take a deeper look at what's going on. Read more... ## How Uber, Facebook, and Netflix Approach SSH Security DevFeed: [How Uber, Facebook, and Netflix Approach SSH Security]() Original publisher: [Read original article]() Author: info@goteleport.com (Jon Silvers) Published: 2019-07-16T00:00:00Z Content type: opinion Language: en Sources: [Teleport]() Topics: [ssh](), [Security](), [OpenSSH](), [Authentication](), [certificates](), [public key](), [Zero Trust](), [DevOps]() Tags: [authentication](), [certificates](), [network](), [public-key](), [security](), [ssh](), [systems](), [zero-trust]() ### AI overview The article examines how large companies approach SSH security and the weaknesses of traditional SSH trust models. It describes problems with unmanaged authorized_keys files and trust on first use, and presents SSH certificates, certificate authorities, and Zero Trust authentication as approaches to address them. ### Source excerpt How are some big, well-known companies approaching SSH? We took a look at three who are setting an example for others to follow. ## W3C Web Authentication (WebAuthn) DevFeed: [W3C Web Authentication (WebAuthn)]() Original publisher: [Read original article]() Author: Stian Thorgersen Published: 2019-03-06T00:00:00Z Content type: article Language: en Sources: [Keycloak Blog]() Topics: [WebAuthn](), [Authentication](), [public key](), [Keycloak](), [browser](), [Java]() Tags: [authentication](), [idm](), [java](), [kerberos](), [keycloak](), [ldap](), [openid-connect](), [public-key](), [saml](), [security](), [sso](), [w3c](), [web-authentication]() ### AI overview The article explains that WebAuthn became an official W3C web standard and describes its use of public-key credentials instead of shared secrets. It covers phishing resistance, browser and device support, two-factor and passwordless authentication, and planned WebAuthn integration in Keycloak. ### Source excerpt W3C Web Authentication (WebAuthn) was recently made an official web standard. This is a great step towards making a safer and simpler authentication experience for users. Where traditional authentication, such as password and OTP, rely on having shared secrets between the user and the web application, this is not the case with WebAuthn. WebAuthn uses public key-based credentials resulting in the web application not having access to the users secrets anymore. The keys are also unique per web application which eliminates the risk of phishing attacks. WebAuthn provides a standard protocol for web applications to authenticate via a number of devices through a relatively simple challenge/response. All major browser vendors now have support for WebAuthn and FIDO2, where FIDO2 is the specification that enables the browser to communicate with different hardware devices. WebAuthn can be used both as a two factor mechanism as well as enable passwordless authentication. There are already an healthy amount of devices that can be used together with WebAuthn. There are a number of security keys like YubiKey, ThinC and Titan. A lot of new laptops also come with built-in fingerprint scanners, and it Android also recently made it possible to use the fingerprint scanners on Android 7+ devices with WebAuthn. We are of course planning on bringing WebAuthn support to Keycloak in the near future. The team behind webauthn4j has been hard at work greating a quality Java library for WebAuthn and will hopefully soon have an extension to Keycloak ready. We will first focus on two-factor authentication with WebAuth and as part of this we will bring a number of improvements to Keycloak around two-factor authentication. For more details check the design document. Later, we will also bring the passwordless experience to Keycloak. This will also introduce Keycloak to the identity first login flows. By asking for the users identity first Keycloak can provide smarter decisions on how to authenticate ## Teleport's SSH Certificate Authority Pinning for Bootstrapping Trust DevFeed: [Teleport's SSH Certificate Authority Pinning for Bootstrapping Trust]() Original publisher: [Read original article]() Author: info@goteleport.com (Russell Jones) Published: 2019-02-26T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [ssh](), [trust](), [Cryptography](), [public key](), [Encryption](), [Kubernetes](), [kubectl]() Tags: [cryptography](), [how-to](), [kubectl](), [kubernetes](), [public-key](), [ssh](), [trust](), [x509]() ### AI overview This article explains how Teleport nodes authenticate Teleport Auth Servers when the cluster's private certificate authority is not in the node's operating-system trust store. It presents SSH certificate authority pinning as a way to bootstrap trust, drawing inspiration from Kubernetes. ### Source excerpt An overview of Teleport's SSH certificate authority pinning capability and discussion of how HTTP public key pinning (HPKP) can be used to improve SSH CA user experience. ## The default OpenSSH key encryption is worse than plaintext DevFeed: [The default OpenSSH key encryption is worse than plaintext]() Original publisher: [Read original article]() Published: 2018-08-03T14:02:00Z Content type: opinion Language: en Sources: [Latacora]() Topics: [OpenSSH](), [Encryption](), [Cryptography](), [public key]() Tags: [credentials](), [encryption](), [github](), [openssh](), [openssl](), [public-key](), [rsa](), [ssh]() ### AI overview The article examines default OpenSSH encryption for RSA private keys and argues that deriving the AES key with MD5 of the password and part of the IV makes the protection vulnerable to efficient password guessing. It concludes that the encryption can be ineffective, especially when passwords are reused. ### Source excerpt Update: I don't know if we can take credit for it or if it's random chance, but I note OpenSSH changed its default in the release after this blog post. The system works! The eslint-scope npm package got compromised recently, stealing npm credentials from your home directory. We started running tabletop exercises: what else would you smash-and-grab, and how can we mitigate that risk? Most people have an RSA SSH key laying around. That SSH key has all sorts of privileges: typically logging into prod and GitHub access. Unlike an npm credential, an SSH key is encrypted, so perhaps it's safe even if it leaks? Let's find out! ## How to Avoid Managing SSH Keys with Short-Lived SSH Certificates DevFeed: [How to Avoid Managing SSH Keys with Short-Lived SSH Certificates]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2018-02-02T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [OpenSSH](), [certificates](), [remote access](), [Authentication](), [private key](), [public key]() Tags: [authentication](), [certificates](), [private-key](), [public-key](), [remote-access](), [ssh]() ### AI overview This article explains why managing long-lived SSH keys can become complex and difficult to scale, and presents short-lived SSH certificates as an alternative for remote access. ### Source excerpt How to avoid managing SSH keys and switch to short-lived SSH certificates. ## SSH using Github team membership via OAuth2 + 2FA DevFeed: [SSH using Github team membership via OAuth2 + 2FA]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2018-01-24T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [ssh](), [GitHub](), [OAuth 2.0](), [Authentication](), [Security](), [public key](), [Open Source]() Tags: [authentication](), [github](), [how-to](), [oauth2](), [open-source](), [public-key](), [security](), [ssh]() ### AI overview This tutorial explains how to use GitHub team membership through OAuth2 and 2FA to manage SSH access to server infrastructure. It describes replacing static SSH keys with automatically expiring SSH certificates, so access can be removed when a team member leaves the organization. ### Source excerpt In this post we show you how to use Github as an identity manager to control who has access to your server infrastructure through SSH ## JWT Authentication DevFeed: [JWT Authentication]() Original publisher: [Read original article]() Author: Zoli Kahan Published: 2016-09-26T05:00:00Z Content type: tutorial Language: en Sources: [Zolmeister]() Topics: [JSON Web Tokens](), [Authentication](), [API](), [middleware](), [private key](), [public key](), [Security](), [Express]() Tags: [api](), [authentication](), [hosting](), [jwt](), [middleware](), [oauth](), [private-key](), [public-key](), [security]() ### AI overview The article explains an authentication approach for hosting platforms that need to support third-party application access and verify local native API calls. It uses JSON Web Tokens with ES256 and a public/private key pair, followed by a sample authentication strategy and Express middleware implementation. ### Source excerpt JWT Authentication Authentication models for hosting platforms require more considerations due to 3rd party api access. We wanted to be able to issue user auth tokens for 3rd party apps (think OAuth), as well as be able to verify authentication of local native api calls (through our iframe native app hooks). ## Signing git commits using Keybase DevFeed: [Signing git commits using Keybase]() Original publisher: [Read original article]() Author: hi@meedamian.com (Damian Mee) Published: 2016-04-14T00:00:00Z Content type: tutorial Language: en Sources: [Damian Mee | Blog | Portfolio | About]() Topics: [Git](), [GitHub](), [account](), [private key](), [Command-line interface](), [public key]() Tags: [command-line](), [git](), [github](), [private-key](), [public-key](), [signing]() ### AI overview A historical guide explains how to use Keybase keys to sign Git commits and have GitHub display a Verified badge. The post warns that some of its advice is terrible and is preserved for historical reasons. ### Source excerpt ⚠ WARNING: This post contains some terrible advice, and is preserved here only for historical reasons. Signing git commits has been a great idea since forever. A great unpopular idea. Luckily, that changes with the recent Github announcement. This is a quick guide on how to set it up with your keybase.io account. Keybase Jump to the git stuff, I already have Keybase. Create keybase.io account Keybase is still not publicly available, but you can ask me or anyone on Keybase for an invite. ## Elliptic Curve Cryptography: a gentle introduction DevFeed: [Elliptic Curve Cryptography: a gentle introduction]() Original publisher: [Read original article]() Author: andreacorbellini Published: 2015-05-17T11:24:00Z Content type: article Language: en Sources: [Andrea Corbellini]() Topics: [Cryptography](), [ECDSA](), [public key](), [Algorithms, Complexity](), [Encryption]() Tags: [bitcoin](), [cryptography](), [dh](), [dsa](), [ecc](), [ecdh](), [ecdsa](), [examples](), [guide](), [math](), [pgp](), [public-key](), [rsa](), [security](), [ssh](), [tls](), [tools](), [web]() ### AI overview A gentle introduction to elliptic curve cryptography explains elliptic curves, their use in public-key cryptography, and why ECC is considered secure. The series covers finite fields, the discrete logarithm problem, ECDH, ECDSA, attacks on ECC, and comparisons with RSA. ### Source excerpt Those of you who know what public-key cryptography is may have already heard of ECC, ECDH or ECDSA. The first is an acronym for Elliptic Curve Cryptography, the others are names for algorithms based on it. Today, we can find elliptic curves cryptosystems in TLS, PGP and SSH, which are just three of the main technologies on which the modern web and IT world ... [Next page]()