A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

0
votes
1answer
32 views

Why is CBC-MAC insecure for variable length input?

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Like the highlighted parts in following pictures Slide 32: Slide ...
1
vote
3answers
55 views

Does digital signature really ensure data integrity?

Suppose attacker knows public-key of sender. He can make his own private key derived from public-key of sender. Then he can alter message and sign it with his private key. Probably I'm missing the ...
2
votes
0answers
29 views

Algorithm to generate (and verify) string of 4 quad alpha numeric code

I am writing a system, for which I need to generate unique transaction numbers (which can be verified by myself). I want to use something similar to that used by credit cards, where a string of the ...
0
votes
1answer
79 views

Why would I need to use the PRIVATE key to verify a file signature?

I use JavaScript to open CAPICOM store to choose certificate. After that I export selected certificate, public key and private key of that certificate and put them in three hidden fields. var ...
0
votes
1answer
31 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...
1
vote
1answer
50 views

Value of hash in digital signature

I'm hashing using SHA 256 and signing a payload with a private key.The payload does not contain any password and would be HTTP(S) POSTed to server side. The payload contains some dynamic and constant ...
0
votes
0answers
32 views

Altering assembly without affecting digital signature

I have discovered a software crack where the license check assembly (.NET) has been altered but the digital signature and the strong name are both still perfectly intact. Strong naming is easy to ...
3
votes
2answers
59 views

What are the benefits to adding a bitcoin blockhash UID notation to one's OpenPGP key?

Example: Notation data: blockhash@bitcoin.org 000000000000000011d9f6931e65f814c6f3b221736b0c45f25e0365a3d156fa As seen here: ...
2
votes
1answer
106 views

What is the difference between a digital signature and whole message encryption?

I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message. Lets consider simple example of email message. I understand how ...
0
votes
1answer
56 views

How to verify the signature of DHE_RSA server parameters (TLS 1.2)?

By reading the TLS 1.2 specs I have been able to manually decrypt/encrypt pretty much all the steps of a TLS connection (DHE_RSA_AES_CBC_128_SHA cipher suite). One of things I am missing is how to ...
0
votes
0answers
12 views

Digital Signature - PKCS#7 Response

I have a long xml-style string which looks like this: MIILhMIILhAY......H9WH9W Task given to me is to digitally sign a pdf document. Is there a tool (like jdk keytool or openssl etc) which I can use ...
0
votes
1answer
25 views

Hashing and signing partial data in payload

I'm hashing and signing part of a payload prior to HTTP Posting from a mobile device to server side. The payload contains of about 7 data elements and only 3 of them are hashed/signed using a private ...
3
votes
2answers
61 views

Signing Double Submit Cookies, where the value is a pseudo random string and a signature of it. Is this more secure?

I'm not sure if I am describing something that has already been proposed. If not, I would like to coin this "Signed Double Submit Cookies" as a method to improve the Double Submit Cookies technique ...
0
votes
1answer
31 views

How secure is it to bundle unencrypted private key and a CSR into PKCS12 certificate?

I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, ...
1
vote
0answers
31 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
0
votes
1answer
25 views

Verify a key was signed by another key

I began using GPG4Win/Kleopatra, the GNU Privacy Guard implementation for Windows. More recently I wanted to verify a download of Qubes OS, for which a guide is offered here. They describe a master ...
1
vote
1answer
101 views

Digitally signing a document with your public/private keypair without certificates?

I have generated a private/public key pair using gpg. Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead ...
0
votes
0answers
39 views

Few questions about verifying a DLL signature?

i have few questions about verifying a file's certificate. The use case is as follows: i have a DLL file that contains a resource i need. I'm signing the file with a code-signing certificate, and ...
1
vote
1answer
42 views

Why timestamping chain is better than “code signature” chain?

Timestamping is recommended as the way to prolong signature validity after its certificate expiration date. One just need to add new timestamp signature before previous timestamp is expired. But ...
6
votes
1answer
85 views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
4
votes
2answers
68 views

Signature that can only be verified by author and recipient - without pre-shared key

Desiderata: Alice wants to send a message to Bob for him to keep and to be able to refer to, such that Bob can be certain that the message came from Alice and was not tampered with. Alice also ...
1
vote
2answers
41 views

What are the technical implmentation differences between signature based scanning and heuristic based scanning?

Signature based scanning works by comparing something to a database. So does this basically amount to scanning file x for string "foobar" ? I know heuristic based scanning can detect new threats that ...
3
votes
0answers
41 views

Is there a cryptographically secure way to verify the date of a process? [duplicate]

I have a few git repositories of content that will be updated constantly over the next decade. At some point down the road I anticipate being asked to prove that the content was actually in the state ...
4
votes
3answers
81 views

Are document signature services violating any rule by exposing PII over clear email?

A company sent me a document to sign via CudaSign, I did. As soon as I completed the transaction, I got a PDF over email with the document attached. The document includes my SSN. I assume, the ...
1
vote
1answer
40 views

Is it possible to give legal value to signed web services?

The context is using digitally signed webservices (with XML-DSIG for example) for e-government interoperability between databases. The idea is to give endorsement to both the data publisher and the ...
2
votes
0answers
35 views

Out of band signature application for banking transactions

I work on a banking signature project. Signing transactions must be carried out on another application to respect the mechanism "Out Of Band". When the user makes a transaction, he must pass to a ...
4
votes
2answers
132 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
3
votes
2answers
122 views

Is signing android apk file with SHA1 digest secure enough?

Google command line example for signing apk files: $ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name source: ...
1
vote
2answers
65 views

understanding client certificate - pfx on the general

Today I am given a pfx and told to access a website. I have absolutely no idea what was given to me initially, so please kindly confirm my understanding on a general level 1) the pfx is a container ...
2
votes
1answer
32 views

Does it matter how information is represented prior to signing?

I have messages that will form a permanent record and be stored for a long time. I care about integrity, authentication, and non-repudiation, so I intend to have the clients creating those messages ...
0
votes
2answers
40 views

Files related/required to a digital certificate

I am new to digital certification and I am trying to understand it as well as get my domain certified. I know this question may be broad, but can someone give me a general idea of the usage of the ...
2
votes
1answer
50 views

Signing web forum messages

I maintain web forum software, which is accessible via NNTP and e-mail (as mailing lists). Since NNTP by design allows anyone to spoof their e-mail address, message signing can be used instead to ...
4
votes
1answer
24 views

Best practice: Should I revoke an identity self-signed using SHA1?

When I first created by PGP keypair, my identity was unfortunatly self-signed using SHA1. I later signed again using SHA512. Does it make sense to revoke the SHA1 signature now or will that just ...
0
votes
0answers
27 views

Secure transfer with proxy person in the middle

I am new to cryptography, so I would like some validation. I have an unusual use case that I haven't found described anywhere and would like to get some help validating my approach. Alice needs ...
3
votes
2answers
54 views

GnuPG does not verify signature while decrypting

I have signed file 1.txt, result file is 1.txt.asc. I changed content in file 1.txt.asc (signed content, not signature). Then I verify signature in 1.txt.asc and I get information that signature is ...
3
votes
0answers
13 views

How can I improve and secure automated signing?

Automated signing of files, such as software packages or file backups, is inherently risky if a certain level of trust is given to it. Having signing be an automated process means that there's no user ...
5
votes
3answers
209 views

Are documents truly “signed” by DocuSign?

I've never been happy with the explanation DocuSign gives for themselves in their own marketing material (e.g. ...
6
votes
2answers
858 views

How does an attack on a digital signature work?

In our IT Security class we have been told that you need CA's to prevent attacks on a digital signature. Sadly, our docent didn't elaborate how such attack would be performed - I can only guess that ...
1
vote
3answers
144 views

Authenticating user in same sub-domain using cookies

We have few in production websites say site1.dom1.com , site2.dom1.com , site3.dom1.com which are just replicas working on different server. Now we want to extend some application on another server ...
0
votes
0answers
49 views

Digitally signing a digital signature

When might it make sense to digitally sign a digital signature?
0
votes
0answers
45 views

DSS digital signing approach

Under the DSS approach to digital signing, what is the advantage of using two pairs of keys for each signature?
1
vote
1answer
59 views

Is it possible to digitally sign an email twice?

User A encrypts an email with the public key of user B and digitally signs it. User B receives this message and decrypts it. B wants to forward it to user C, encrypts it with C's public key and signs ...
6
votes
3answers
1k views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
0
votes
1answer
64 views

Different Microsoft-signed excecutables have apparently the same signature!

On Windows 10 systems, I found two versions of bootsect.exe (a Microsoft-supplied utility that writes disk boot sector) with different hashes (SHA-1 9b7463c79460a55a36b53bee0889f894b2379ec3 for one ...
0
votes
2answers
65 views

PGP vs Hash functions

What is the difference (in terms of security strength) between checking a package' integrity using pgp and hashing functions (i.e. sha256)? Isn't pgp less secure as the verifier must trust the ...
0
votes
1answer
162 views

BLS signature java implementation needed (if possible, along with some example code)

I need to sign a string with the shortest digest possible using regular certificate like X.509. As far as I understand, I will have to transform the string to the sequence of bytes, then sign. After ...
2
votes
1answer
29 views

Signing a code and application

I want to send my application to different servers/terminals with content integrity and confidentiality. So, I need to some process to sign my code and application before sending it to servers and to ...
4
votes
1answer
59 views

What does an OpenPGP signature consist of?

I don't understand how OpenPGP signatures work. I have a picture which I want to sign, and a digital certificate which consists of my name and email address and my public key. Additionally, a digital ...
3
votes
1answer
45 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep ...
0
votes
1answer
94 views

Where in the CSR is the public key?

I am reading http://www.akadia.com/services/ssh_test_certificate.html In step 2 openssl req -new -key server.key -out server.csr server.key is generated earlier using openssl genrsa -des3 -out ...