Tagged Questions
0
votes
1answer
131 views
How secure is my private key in the Windows Digital Certificate store?
Many files we download don't have digital signatures. Files may get infected or someone may intentionally modify them on our hard disk.
So I wrote a simple file hashing program in c# that creates a ...
3
votes
2answers
119 views
what is the difference between a mac and a digital signiture
I understand that a MAC algorithm takes a message and a private key as input and hashes them to a value. I understand that senders and receivers often use MACs to authenticate a message and check the ...
7
votes
7answers
208 views
Proving running code on a website is unchanged
Can it be proved to the user that the running code behind a website with security related code is the same as published?
I'm currently looking at a few new project ideas and one involves secure ...
1
vote
1answer
452 views
Parsing a PKCS7 detached signature hash
I'm trying to manually verify signatures of Apple iOS Passbook files, which are PKCS #7 detached signatures of the RSA key of the Apple developer who created the file.
Which means there's a file ...
2
votes
3answers
371 views
rsa encrypted hash == rsa signature
$ echo -n "1327943823" > test_ok.txt
$ openssl dgst -sha1 -binary -out test_ok.sha1 test_ok.txt
$ echo "GURbsl4CFPCG83RCZxsEpoRleXicXQhH1OC4Fk77b7EMj2g8aHUhD/L+sm
...
4
votes
1answer
57 views
Standards for CA cert revocation and time-constrained cryptographic algorithm parameters
I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
13
votes
7answers
3k views
Why do people still use/recommend MD5 if it is cracked since 1996?
It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996
Therefore we suggest that in the future MD5 should no longer be implemented in ...
2
votes
2answers
352 views
Time needed to generate an RSA signature of a document
How does the length of the RSA key and the size of the document affect the time it takes to sign a document using SHA-1 and RSA?
I used CrypTool to check it, but the time does not appear to be larger ...
3
votes
1answer
206 views
self-signatures using SHA1
This page says:
self-signatures must not use SHA1
You can check this by doing:
gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep ...
7
votes
4answers
1k views
when people say a file has a checked md5 hash, what exactly does that mean?
ok I was just reading this site: http://www.zdnet.com/blog/bott/stay-safe-online-5-secrets-every-pc-and-mac-owner-should-know/3542?pg=4&tag=mantle_skin;content
and thought of something I always ...
15
votes
3answers
401 views
What is gained by hashing the last block on-device?
Recently I encountered the notion of "hashing the last block on-device".
It means that when computing a digital signature, the hash that serves as input for the actual signature computation is not to ...
16
votes
9answers
598 views
Does hashing a file from an unsigned website give a false sense of security?
Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
