A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

0
votes
1answer
39 views

Where do magic constants for signature algorithms come from?

For example, I've seen 3031300d060960864801650304020105000420 as an identifier for RSA/SHA256, 3020300c06082a864886f70d020505000410 for RSA/MD5. Where do these values come from? I ran into one of ...
-1
votes
0answers
36 views

DNA Encryption and Digital Signature [on hold]

I am working on DNA based encryption.Does using DNA encryption for digital signature is better to achieve non repudiation than conventional techniques
0
votes
0answers
7 views

How to resign a pdf after changes are made - Adobe Acrobat Pro X [migrated]

I need help updating the time stamp on my signature. I prepared a document, signed it, sent it for review, received comments back, and made some changes. Now I would like to resign the document with ...
1
vote
1answer
62 views

How is a root certificate revoked?

I know that CAs use intermediate certificates to mitigate the impact of potentially having to revoke a root CA (i.e., the need to update all browser clients on peoples computers allover the world). ...
-1
votes
1answer
38 views

In what order are digital certificates verified?

I understand how digital signatures work and how they are verified, but in what order does the CA verify each of the attributes of the digital certificate such as version, issuer, validity etc..? Any ...
0
votes
0answers
10 views

How does XAdES-X-L compare to RFC4998 Evidence Record Syntax

This SE question describes a scenario I don't fully understand the use case or how 4998 can help correct the issue. How and when should XAdES-X-L be used, and where should RFC4998 be used?
-1
votes
0answers
18 views

An alternative to Echosign with certificate support? [closed]

I'm trying to find some business-friendly solution for digital signature circularization, capable of signing documents using external digital certificates. While Adobe EchoSign-like software does ...
1
vote
1answer
21 views

Regarding Openssl.config file: What is the importance of policy matching when creating a self-signed certificate with the aid of this file?

When trying to go through some material for self-signing a certificate, one of the steps required me to set policy conditions in this config file. See: https://www.phildev.net/ssl/opensslconf.html ...
0
votes
0answers
18 views

Reuse key to encrypt signed content

I am developing an application which generates JWT tokens which are signed using HMAC-SHA256 algorithm during their generation and later on encrypted using Fernet library. Since the signing and the ...
2
votes
3answers
58 views

Does a certificate authority use different private keys?

I was wondering whether a CA has different private keys to sign certificates with? Is there a risk of crypto-analysis (or something similar) when a CA signs thousands of certificates with the same ...
0
votes
3answers
31 views

How do you check the signature of a signing program (ex. GnuPG) if there is no native version installed? [Catch 22]

If you downloaded a version of a signature verification program that might have been modified, you naturally check its signature. But what if you have none such program to check it (whose signature ...
1
vote
1answer
25 views

How to create a ring signature?

While reading the Off-the-Record-Messaging paper by Nikita Borisov, Ian Goldberg and Eric Brewer, I came across the idea for "ring signatures" which allow a member of a group to sign a message in the ...
2
votes
0answers
27 views

TLS 1.2 ECDHE_RSA signature [migrated]

I'm currently working on a Java TLS server. I'm trying to get the following CipherSuite to work : TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA When I test it using openssl s_client I get the following error ...
2
votes
1answer
71 views

How do digital signatures on PDF documents work?

I recently filled out a PDF document which required me to append a digital signature. The PDF document had a link embedded in it that I clicked and went through the process. I am curious how this ...
0
votes
0answers
16 views

GPG4Win - How to read/unsign .txt file to see a proper text message after signing only file

I sign a file of sha 256 checksum of one file for test. I choose only sign options with OpenPGP certificate only...This textfile looking like this: ...
0
votes
0answers
94 views

eIDAS - list of certified qualified electronic signature creation devices

In eIDAS there is written in Article 31: On the basis of the information received, the Commission shall establish, publish and maintain a list of certified qualified electronic signature ...
0
votes
2answers
37 views

How to convert a SSL certificate to an authority?

How can one convert an SSL cert provided by an authority to another authority, so one can generate "valid" certs for different domains?
-2
votes
4answers
70 views

How is the private key kept secret in digital signatures?

A digital signature is verified using an algorithm that takes three inputs: the message, the digital signature (message encrypted with private key)* and the public key. If the public key is used to ...
2
votes
0answers
15 views

Signtool validation fails when signing and validating are done in different machines

I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
2
votes
2answers
57 views

Asymmetric key encryption that can have a public decryption key, but encryption key cannot be computed from that [duplicate]

Is there a way where I can distribute a public decryption key, but the encryption key cannot be computed from that key, so that anyone who reads one of my encrypted message, he/she can be quite sure ...
56
votes
9answers
9k views

Proving creation time/date of a screenshot

I have to produce a screenshot of a web page, and want to make sure others will know without any doubt that this screenshot has been produced today. That is, I would like to embed today's date in the ...
0
votes
0answers
16 views

Digital Signature on a Passive RFID tag with small-ish memory constraints

I'm pretty new to the crypto and security worlds and I'm looking for some guidance. Briefly, my project involves Widgets (physical items that need to be authenticated) and Gadgets (physical machines ...
0
votes
2answers
37 views

Can an RSA signature be changed given the public key?

If I were to post on a forum (with potentially malicious administrators) my public RSA key and a small string of text that was signed with the corresponding private key, could someone with access to ...
1
vote
1answer
51 views

What issues exist in generating a signed, paper-based PGP message stored by a hostile organisation?

I have recently been the victim of having my medical record tampered with by the organisation holding it. Under state law I have a legal right to submit information to be included in my medical record,...
3
votes
2answers
85 views

Useless 2FA in case of inside attacker

Suppose a server-side signing scenario, where user keys are generated in a HSM and exported to a database, encrypted with a symmetric key derived from a user password and HSM's master key. To sign, ...
-1
votes
2answers
72 views

How does digital signature algorithms work in a private / public key environment?

From the Wikipedia page on the subject, I get, on a theoretical level, how the process of encrypting and decrypting a message works. The article states that: In a public-key encryption system, any ...
66
votes
3answers
12k views

Why shouldn't I bring a computer to a key-signing party?

I'm looking at the event description for the key-signing party at an upcoming BSD conference, and it's mentioned that I shouldn't bring my computer in to the event: Things to bring no ...
-2
votes
1answer
142 views

What scenarios really benefit from signed JWTs?

UPDATE: I have concluded my research on this problem and posted a lengthy blog entry explaining my findings: The Unspoken Vulnerability of JWTs. I explain how the big push to use JWTs for local ...
0
votes
1answer
35 views

git file signing with eID

Background story; government issues new IDs (eID) which can hold certificates and you can sign documents with it, using card reader and some software that signs document itself (while I do research ...
0
votes
1answer
49 views

Why is CBC-MAC insecure for variable length input?

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Like the highlighted parts in following pictures Slide 32: Slide 33:...
1
vote
3answers
68 views

Does digital signature really ensure data integrity?

Suppose attacker knows public-key of sender. He can make his own private key derived from public-key of sender. Then he can alter message and sign it with his private key. Probably I'm missing the ...
2
votes
0answers
45 views

Algorithm to generate (and verify) string of 4 quad alpha numeric code

I am writing a system, for which I need to generate unique transaction numbers (which can be verified by myself). I want to use something similar to that used by credit cards, where a string of the ...
0
votes
1answer
111 views

Why would I need to use the PRIVATE key to verify a file signature?

I use JavaScript to open CAPICOM store to choose certificate. After that I export selected certificate, public key and private key of that certificate and put them in three hidden fields. var ...
0
votes
1answer
32 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...
1
vote
1answer
59 views

Value of hash in digital signature

I'm hashing using SHA 256 and signing a payload with a private key.The payload does not contain any password and would be HTTP(S) POSTed to server side. The payload contains some dynamic and constant ...
0
votes
0answers
34 views

Altering assembly without affecting digital signature

I have discovered a software crack where the license check assembly (.NET) has been altered but the digital signature and the strong name are both still perfectly intact. Strong naming is easy to ...
3
votes
2answers
62 views

What are the benefits to adding a bitcoin blockhash UID notation to one's OpenPGP key?

Example: Notation data: blockhash@bitcoin.org 000000000000000011d9f6931e65f814c6f3b221736b0c45f25e0365a3d156fa As seen here: https://sks-keyservers.net/pks/lookup?op=vindex&search=...
2
votes
1answer
124 views

What is the difference between a digital signature and whole message encryption?

I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message. Lets consider simple example of email message. I understand how ...
0
votes
1answer
67 views

How to verify the signature of DHE_RSA server parameters (TLS 1.2)?

By reading the TLS 1.2 specs I have been able to manually decrypt/encrypt pretty much all the steps of a TLS connection (DHE_RSA_AES_CBC_128_SHA cipher suite). One of things I am missing is how to ...
0
votes
0answers
19 views

Digital Signature - PKCS#7 Response

I have a long xml-style string which looks like this: MIILhMIILhAY......H9WH9W Task given to me is to digitally sign a pdf document. Is there a tool (like jdk keytool or openssl etc) which I can use ...
0
votes
1answer
41 views

Hashing and signing partial data in payload

I'm hashing and signing part of a payload prior to HTTP Posting from a mobile device to server side. The payload contains of about 7 data elements and only 3 of them are hashed/signed using a private ...
3
votes
2answers
69 views

Signing Double Submit Cookies, where the value is a pseudo random string and a signature of it. Is this more secure?

I'm not sure if I am describing something that has already been proposed. If not, I would like to coin this "Signed Double Submit Cookies" as a method to improve the Double Submit Cookies technique ...
0
votes
1answer
43 views

How secure is it to bundle unencrypted private key and a CSR into PKCS12 certificate?

I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, ...
1
vote
0answers
52 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
0
votes
1answer
44 views

Verify a key was signed by another key

I began using GPG4Win/Kleopatra, the GNU Privacy Guard implementation for Windows. More recently I wanted to verify a download of Qubes OS, for which a guide is offered here. They describe a master ...
1
vote
1answer
157 views

Digitally signing a document with your public/private keypair without certificates?

I have generated a private/public key pair using gpg. Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead ...
0
votes
0answers
64 views

Few questions about verifying a DLL signature?

i have few questions about verifying a file's certificate. The use case is as follows: i have a DLL file that contains a resource i need. I'm signing the file with a code-signing certificate, and ...
1
vote
1answer
61 views

Why timestamping chain is better than “code signature” chain?

Timestamping is recommended as the way to prolong signature validity after its certificate expiration date. One just need to add new timestamp signature before previous timestamp is expired. But what'...
6
votes
1answer
179 views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
4
votes
2answers
71 views

Signature that can only be verified by author and recipient - without pre-shared key

Desiderata: Alice wants to send a message to Bob for him to keep and to be able to refer to, such that Bob can be certain that the message came from Alice and was not tampered with. Alice also ...