A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

2
votes
1answer
96 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
17
votes
2answers
2k views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
0
votes
0answers
29 views

Smartcard authentification: encrypt/decrypt or ECDSA?

I'm implementing a simple door access control with smart keyfobs. At the moment I send a 32 byte message to the keyfob which it signs with ECDSA and I verify the authenticity with the public key. ...
0
votes
0answers
43 views

deceptive digital signature?

I am new to cyphering and I try to understand this case : my government sends me so-called "digitally signed" PDFs, as you can see below (text only, after "Thanks"). Although there is a certificate ...
2
votes
1answer
220 views

OpenSSL check if a SSL certificate is SHA-1 or SHA256 signed

How do I check if an OpenSSL certificate issued to a site is SHA-1 or SHA-256? I have a quite a lot of intranet sites using OpenSSL certificates and I am a bit confused as when I check the certificate ...
1
vote
2answers
53 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
4
votes
3answers
135 views

Is there a way to prove some content came from a specific website?

I guess we can all agree that a screenshot of a website proves nothing; one can edit the HTML as much as one likes, take a screenshot and show a website displaying false information. As far as I ...
0
votes
1answer
29 views

Authentication using a digital signiture

I'm new to the world of digital signatures and encryption and I'm trying to learn more. I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital ...
9
votes
1answer
22k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
3
votes
1answer
106 views

Encrypt/sign a client-to-API request?

We are building a JSON API on top of our Ruby on Rails Web application, using JSONAPI::Resources to expose endpoints and Doorkeeper to handle user authentication. Most of our API endpoints will be ...
2
votes
1answer
70 views

In the context of advanced electronic signatures, what does “sole control” mean?

To satisfy the conditions for an advanced or qualified electronic signature, the power to sign must remain under the "sole control" of the signatory. Can anyone provide concrete examples of what this ...
3
votes
3answers
81 views

Central auth service redirecting to subdomain, using digital signature as auth token

I'm working on a "proof of concept" of a central auth service (not CAS). There are holes in my understanding of what I need to do, and I have concerns that the "protocol" is not secure. Why/What ...
3
votes
1answer
82 views

Need raw certificate/key to sign PDFs via Java app. But vendors seem to only sell HSMs for this. What to do?

Our organisation wants to purchase a digital signature certificate for signing financial PDF documents. We want to automate this process, so we'll be having Java code do the signing work. For that the ...
1
vote
2answers
112 views

What are some Linux commands for genrating and verifying digital signatures?

I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography. If I understand correctly then the public key and the private key in an asymmetric ...
2
votes
1answer
51 views

signature and padding

I use JcaContentSignerBuilder to sign a self-signed certificate but I don't know what the default padding is. My requirement is that I must NOT use PKCS#1.5 padding. The code I use is below - can ...
1
vote
1answer
38 views

How is the signing of an OpenPGP public key realized technically?

I recently have signed the public OpenPGP key of a friend of mine. Curious to see, which effect this would have on the actual key, I compared the key before and after signing it. What I found was that ...
0
votes
1answer
44 views

Long term trust anchor validation

Let's say someone signs a document for long term validation using a certificate issued by a trusted CA. Throughout the following years, the document is timestamped again and again by multiple trusted ...
2
votes
1answer
62 views

Generating Own SSL certificate using DSC issued by a CA

Ok. So, here is what I know: SSL Certificate are used to verify domain for HTTPS protocol. These are issued by a root CA to ensure that it can be trusted by anyone using the website and trusting the ...
0
votes
2answers
440 views

MS-Word and Digital Signatures

We would like to digitally sign DOC (MS-Word) and PDF documents using PKI. Is this possible using an internally deployed CA? I've found lots of articles getting email digitally signed but almost no ...
1
vote
2answers
73 views

Is this explanation about how SSL Certificate Signatures work correct?

I was reviewing some information about SSL certificates and came across an explanation I believe to be incorrect. The explanation is of how signatures and hashing algorithms work in the context of ...
0
votes
3answers
110 views

In message signing, is the digest encrypted with a generated symmetric key or with the sender's private key?

I understand the encryption process uses a generated symmetric key to encrypt a message, and then encrypts the symmetric key with the receiver's public key before it is sent across the wire. This ...
1
vote
3answers
282 views

Adding a “comment” to PGP mail signature files?

I have started signing my mail with PGP, and it attaches the file signature.asc to my messages to verify that I sent them with content, as you'd expect, like this: -----BEGIN PGP SIGNATURE----- ...
7
votes
2answers
355 views

Is a mail secure if it's PGP-encrypted, but unsigned when sent with DKIM?

I run my own mail server and would like to use different addresses on the same domain. If I were to sign mails from those addresses, I'd have to generate new PGP keys for each and every one of them. ...
2
votes
2answers
57 views

What problem does PKI fix; how would someone “lie about their identity”? [duplicate]

What does having a certificate issued by a Content Authority protect against? In everything I've red (and watched) they teach it as "you are given the public key to communicate with Alice, but how do ...
3
votes
2answers
92 views

Digital signature: How do I know what I'm signing?

Suppose I have to sign a PDF form. If I'm using (say) Acrobat Reader and a hardware security token, at some point I will be prompted for a PIN to authorize the token to sign the document. How can ...
5
votes
2answers
94 views

What is the difference between the “sig” files and the checksum files, such as on the PuTTY download page?

This is about the functional differences between sig files and checksum files and how they can be used by a user downloading some software. For example, on the PuTTY download page both sig files and ...
1
vote
1answer
76 views

Where does the list of trusted content authorities come from when using a web browser?

I was asked "how do browsers know whether or not to trust the certificate from the server it's connecting to" and thought it was a pretty good question. After doing some googling I found two answers: ...
6
votes
3answers
661 views

Is piping a `ssh-agent` signed message as a password secure?

There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section ...
1
vote
1answer
67 views

Need asymmetric encryption(not signing) where server encrypts and client decrypts

So I'm trying to build a licensing server, where the licenses of the applications need to be checked when logging in or when the application gets used. But some of those application work offline most ...
2
votes
1answer
60 views

How do key pairs work especially in the context of cryptographic signatures?

Is it the case that any message encrypted with a private key can be decrypted with its matching public key and any message encrypted with a public key can be decrypted with the matching private key ...
3
votes
2answers
786 views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
1
vote
2answers
93 views

Specific clarification on how https server public key is trusted

I know the general concept of how digital certificates works: e.g. server "signs" the message it wants to send to the client using his private key and sends along a message digest and on the receiving ...
0
votes
1answer
106 views

Encryption and Signature with same RSA private key

Talking about cipher-suites that use RSA both for sign of DH parameters and for digital signature. The keys used for these process are the same, or is there a public and private key for each one? If ...
0
votes
1answer
72 views

Certificate - Digital fingerprint vs Signature [duplicate]

What is the purpose of the « fingerprint » section of a x509 certificate, and is there an issue using SHA1 for it ? I understand the certificate signature section, but I can’t see the point with the ...
0
votes
1answer
79 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. Indeed, I am wondering if the code signing certificate (the “final cert”) must already ...
1
vote
2answers
101 views

Where is my missunderstanding in how digital signatures are used with licence files to allow program to run?

I'm trying to learn how digitally signing a licence file helps prevent piracy. For example say an application only runs if it verifies the date as specified in a licence file has not past. Obviously ...
1
vote
1answer
42 views

How can I guarantee non-modification of data with signatures?

I am required to design a system where auditors can come along some time in the future, examine historic data, and be sure that the data has not changed since it was stored. I have a spec that ...
3
votes
1answer
650 views

How does signing work with Elliptic Curve Crypto?

So I have read up and have a decent understanding of how the crypto works with Elliptic Curve Cryptography. I also think I have an understanding of how signing works with things like Elliptic Curve ...
2
votes
2answers
329 views

With javascript in the browser, how can I sign some data without directly manipulating a private key?

With JavaScript in the browser, I need to digitally sign some data. I'm looking at the new Crypto.Subtle api, specifically the sign() and importKey() methods. I want, very reasonably I feel, to ...
1
vote
1answer
29 views

How to verify signature while downloading log4j?

From the log4j download page. The PGP signatures can be verified using PGP or GPG. First download the KEYS as well as the asc signature file for the relevant distribution. Make sure you get these ...
1
vote
1answer
53 views

RSA signature on TLS

In a TLS handshake using ECDHE-RSA, the ServerKeyExchange frame must include the ECDHE ServerPublicKey, signed with its RSA private key, as specified in the RFC 4492. Got it. Trying to implement an ...
0
votes
1answer
90 views

How to encrypt with ECDSA?

Suppose there's a transaction in the blockchain in which a given address transfers bitcoins to whoever. I need to encrypt a message so only the owner of that address will read it. I have his public ...
2
votes
2answers
157 views

Assuring Client is Authorized to use JSON Web Token

JSON Web Tokens ( JWT ) are server-signed objects that the issuing server uses to identify a user, track session data and authorize requests. The fact that JWT are server-signed gives assurance that ...
-1
votes
2answers
216 views

Run our own Certificate Authority for internal use only: safe or not? [duplicate]

According to the guide at How to Run Your Own Certificate Authority, my organization have a plan to issue our own digital certificates for internal use only (the managers will sign PDF documents to ...
1
vote
2answers
140 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
1
vote
1answer
84 views

Is algorithm used to sign defined by certificate?

Using pfx certificate to sign or cypher, the algorithm used (rsa-1_5, rsa-oaep-mgf1p, etc) is defined inside pfx certificate? Certificate has information about algorithms used? Or it's totally ...
5
votes
3answers
1k views

Digital Signature and Verification?

AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it. So public key is used to decrypt ...
1
vote
1answer
52 views

Is there a way to sign information by when it was made? [duplicate]

Looking at this question ("Is it legal to use an online logbook?") from Aviation SE, I'm wondering if there is a way to sign information in such a way that: It ensures that there was a certain time ...
2
votes
2answers
128 views

Significance of the difference between DSA and RSA in signature verifying speed

I have run openssl speed and the output on my CPU for longest available DSA key size, which is 2048 bits: sign verify sign/s verify/s rsa 2048 bits 0.029185s ...
10
votes
2answers
243 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...