A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

3
votes
1answer
47 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
3
votes
1answer
55 views
+100

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My ...
1
vote
1answer
50 views

Diffie Hellman and exchange of public key for signature

Let's assume an insecure channel. Is it safe to exchange Alice & Bob public keys first then apply them to sign communications during the DH process? (then encrypt+sign all future communications)? ...
1
vote
1answer
33 views

how to extract a valid digital certificate and put it on other program

I am working on this matter as a graduate, but I need some help. how can extract a valid digital certificate to put it on other program? can I put a digital certificate on other executables and be ...
0
votes
1answer
58 views

Can a Bitcoin miner generate SHA2 hashes on arbitrary data?

I'm not asking about bitcoin's design...but am interested in the hashing capacity of a bitcoin miner. To be short: do bitcoin miners(or some of them) accept customizable inputs and hash them in ...
-1
votes
0answers
47 views

How to create a digial signature and verify it through a server [migrated]

I am trying to find out a way to create a digital signature for the employees of my company and place it in a server from where they can retrieve them and attach it with any digital document (Office ...
1
vote
1answer
27 views

multiple authenticode signatures

Is it possible to have multiple Authenticode signatures in an executable? The Digital Signatures tab suggests you can, so I was wondering if, for example, you can sign an executable with Verisign's ...
2
votes
2answers
83 views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a ...
1
vote
1answer
45 views

Rest WebService with signed requests in Java

I'm currently implementing a rest web service with Spring+Java+Tomcat and a cmd client to access it. The most important requirement is to restrict the usage to authenticated users - encryption isn't ...
2
votes
2answers
53 views

Using digital certificates in digital signatures

Please could anybody explain to me how certificates are used with digital signatures? I understand difference between certificates and signatures. It is clear. Digital certificates are used to ...
4
votes
1answer
34 views

Mail Signing Certificate – What are the impacts when revocated?

Suppose I open a signed mail on 1st January 2000, signature is OK. What about this two cases : 1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
2
votes
1answer
26 views

What is the ideal HMAC message format if message is an array?

I'm using HMAC exactly as intended to verify the integrity of a message. However, the message is really an associative array (or a hash). Since this will be done on various platforms (within and ...
1
vote
1answer
50 views

Keeping signatures valid even after the private key has been compromised

If I understand the topic of digital signatures correctly, you sign a message via hashing+encrypting it using your private key. Then, if a private key is compromised by an attacker, she could sign ...
0
votes
0answers
14 views

Guidance on Login using Digital Signature DSC (PKCS12 and x509 certificate)

I'm interesting in exploring possibility to authenticate user using their Digital Certificate. The methodology is to first register the DSC from the user and keep their Public key along with Serial ...
0
votes
1answer
50 views

Signature scheme using RSA and SHA512

What do you think about this signature scheme using RSA with 4096 bit keys? Being R pseudorandom padding, fixed length (4096 - 512 bits): RSApriv(R || SHA512(M)) I know that it's not as secure as ...
0
votes
0answers
13 views

Firefox/Thunderbird export public key [migrated]

I have imported a .p12 file inside Firefox/Thunderbird, now I would like to export its public key (without using openssl or whatever command line code), so I can distribute it and people can ...
1
vote
0answers
29 views

Sign java jars for security [closed]

We have an enterprise system that utilizes many in house jars, java applications, to run on a centos 7 linux system. How do I go about achieving the following in order of importance: Only signed ...
1
vote
1answer
50 views

Digital signatures and weak hash functions

There was this question in last year's exam. The teacher claims that answer b) (in boldface below) is correct. Attacks are constantly being performed on digital signatures which use weak hash ...
4
votes
2answers
73 views

Verify digital signature without key public key in signature

When receiving emails, I sometimes see the following: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I found an integer overflow in PHP, in the conversation of dates to "Julian Day Count" function. ...
1
vote
1answer
116 views

If you can break this authentication system then you can break into my house

I'll preface this by saying I know approximately 0 about cyber-sec I've made a server that will allow smart phones to act as a remote control for my house (eg turn lights on/off and unlock doors). ...
0
votes
0answers
14 views

Why do PGP Keys have expiration dates? [duplicate]

I read a tutorial to get started with PGP and so far I understand the importance and the difference between encryption, decryption, signing, and verifying. However, I don't understand why a key has ...
1
vote
1answer
72 views

Server-based PDF Signing using HSM

I have some question about server side pdf signing using network-attached hardware security module. my first question is: what is PDF Signing Certificate? Certificates are public keys, how a ...
3
votes
1answer
54 views

What encryption and signature systems (don't?) allow for plausible deniability of the OP's key being used?

I need to prevent Mallory from blindly matching encryption and signing keys to messages Hypothetical scenario: A user creates a public key An encrypted or signed payload exists. With only public ...
1
vote
1answer
56 views

Multi-Function SSL Digital Certificate

Is there a problem with using a single SSL certificate for both SSL/TLS/HTTPS communication as well as to sign (external) digital timestamp certificates? Other than the obvious: if one key is ...
2
votes
2answers
75 views

Public key authentication: what gets signed?

I've just started reading about SSH and how it's used for authentication. From this website, it says: The private key is able to generate signatures. A signature created using your private key ...
0
votes
2answers
48 views

Installing and updating a CA certificate on a client

I am trying to implement a system where a client can download application packages from a server to install/update them on the client. I suppose that the client is something like a platform on an ...
0
votes
1answer
41 views

Algorithms for transaction authentication

It's unclear to me how transaction signing and transaction authentication work. Industrial solutions use both symmetric and asymmetric algorithms to compute the signature. What does RSA add the ...
2
votes
1answer
51 views

Are there theoretical attacks against ECC Digital Signatures?

I was asked to do a research about attacks on various digital signature schemes. There is one thing that bothers me for which I could not find a direct answer. For digital signatures that are based ...
0
votes
2answers
60 views

SHA1 - S/MIME and CRL validity after deprecation?

In an internal PKI using SHA1 for hashing, will S/MIME signature and CRL/ARL signature be considered invalid in the next few years (SHA1 Deprecation) ? End certificates can be revoked, CA ...
0
votes
2answers
50 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
-1
votes
2answers
142 views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
0
votes
1answer
80 views

PKI - Security concerns when changing a certificate hash algorithm

Suppose I want to change the hash algorithm used for a certificate signature (ex: SHA1 to SHA2). Is it better to revoke the previous certificate and issue a new one with expected hash algorithm ? Or ...
3
votes
3answers
128 views

Corporate PKI - SHA1 deprecation

Here is the context. Suppose you have a corporate PKI with : AC_Root (offline in safe store - SHA1 signature) SubRootA and SubrootB (offline in safe store - SHA1 signature) SubSubRootC, SubSubRootD, ...
1
vote
1answer
92 views

Is there a way to verify a signed XML in Java

.NET has this great way to sign and then verify the signature of an XML file. Is there a way in Java to verify an XML file that .NET has signed this way? thanks - dave
-2
votes
2answers
44 views

TLS - Are signatures still needed?

The story: I'm currently writing a web service that allows for communications to be made remotely via TCP/IP. I first thought about signing each packet using HMAC-SHA1 with a password, appending the ...
2
votes
1answer
43 views

What is 0xXXXXXXXX.asc.sig and how can I generate this?

When I am exchanging PGP keys with someone, I receive the regular 0xXXXXXXXX.asc file and regularly receive a file called 0xXXXXXXXX.asc.sig. What is this file? How can I generate one and send it ...
1
vote
1answer
50 views

Using salt or secret for Hmac

I'm working on a web API. We are going to use Hmac256 for signature hashing. From what I can gather, the secret is a key used to initialize the hash algorithm (ie to generate a random number). The ...
1
vote
1answer
74 views

Use of safe prime in RSA digital signature scheme

For the RSA digital signature scheme , Alice has a pair of public and private keys as denoted by Public key : (e,n) Private key : (d,n) Assuming Alice wants to send a message M to Bob , she would ...
3
votes
1answer
429 views

Can Fiddler decrypt HTTPS traffic when using elliptic curves + client cert authetication?

Case 1 involves TLS + client certificate authentication with both client and server using secp384 based EC certificates. In this case, when monitoring traffic via fiddler, the tunneling/handshaking as ...
1
vote
1answer
62 views

Would it be possible to verify ownership of digital currency without a network connection to an authority server?

Lets imagine the Fed start registering digital USD for use in offline e-wallets, and they figure out a way to make it so that only registered wallets can make transactions. Without an online ...
2
votes
1answer
85 views

Why are PGP signatures not more widely used as an authentication method?

Example: Bob generates a key pair for this example. Bob registers at example dot com where he provides his public key. When Bob will try to log in, example dot com will ask him to sign a random ...
2
votes
2answers
105 views

Code Signing Confusion

I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. ...
0
votes
1answer
26 views

What are valid OpenPGP revocation signature types?

I'm working on an analysis of the full OpenPGP keyring (ca. 3.8 million keys). I imported all keys to a local instance of hockeypuck (keyserver implemented in go). Hockeypuck uses a PostgreSQL ...
0
votes
1answer
80 views

Understanding Digital Signature

I have just learned Digital Signature and am trying to ensure that I have got my understanding of Digital Signature on the correct track. Assume Alice wants to send a message (M) to Bob where the ...
2
votes
2answers
618 views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
0
votes
2answers
85 views

is Digital Signature vulnerable on the Internet?

We all know about how Digital Signing works. I just have some questions about vulnerability risk. At first, As I know, the Signature and the Data are separated and we can split the document into two ...
13
votes
2answers
398 views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
2
votes
1answer
81 views

What does verified file in windows mean? And does it guarantee related files?

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g Microsoft) or in other case, unknown publisher. I know public key encryption can ...
0
votes
3answers
66 views

Adding a “comment” to PGP mail signature files?

I have started signing my mail with PGP, and it attaches the file signature.asc to my messages to verify that I sent them with content, as you'd expect, like this: -----BEGIN PGP SIGNATURE----- ...
1
vote
1answer
64 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...