> As long as they don't distribute the public key, the data will remain secure.
Technically probably true, but not cryptographically verified. But if the distribute the certificate as the OP indicated, they DO distribute the public key. Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Jon Perryman Sent: Thursday, August 22, 2019 10:19 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: vendor distributes their private key Ask yourself if you can trust a vendor that does not understand basic security concepts. When you complain, will they simply give you the public key or will they request new public / private keys? I personally would be leery because they will be make much worse mistakes. The standard helps with mistakes like this by requiring the use of both keys. Data encrypted with the private key can only be decrypted using the public key. As long as they don't distribute the public key, the data will remain secure. If you move forward, make sure they give you a brand new public key. Jon. On Thursday, August 22, 2019, 05:57:34 AM PDT, Joel M Ivey <ji...@cio.sc.gov> wrote: A vendor has an ftps server for us to connect to from a batch job on zos. Similar setups with vendors have required the vendor to provide their server's public cert chain for import into RACF. This vendor insists on providing not just their server public cert chain but also their private key. First, they provided a password-protected p12 file, describing it as containing the "root, intermediate, and private certs". I requested their public certificate chain only, they sent me a DER file -- with both the server cert and its private key. I have asked them to elaborate on their need to distribute their private key to me, their response has essentially been, that's the way we do it. I'm not comfortable accepting anyone's private key. There has been no mention of "client authentication", and I'm still not sure I'd be comfortable with that config, either. Help me understand two things: 1) what I'm missing as to why any vendor would require me to install their private key on my side when installing the public cert on my side should suffice as in many other instances, and 2) arguments for/against client authentication (not password authentication, but client) in case that is why they're sending me their private key. Joel ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
