A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

3
votes
1answer
109 views

Validate XML-DSig by DVCS

Is it possible to validate an XML message (with XML-DSig or XAdES signature) by a Data Validation and Certification Server (RFC 3029)? Should it understand XML signatures or not? Could it parse XML? ...
0
votes
1answer
198 views

The Hash header in GPG ASCII armor

When sending a signed message using GPG, it always includes a line that says Hash: SHA256 right at the top of my email. I was wondering if/why it's required, and if not, how I can remove it (in an ...
4
votes
3answers
4k views

What is the difference between an electronic signature and a digital signature

From Wikipedia: An electronic signature, or e-signature, is any electronic means that indicates either that a person adopts the contents of an electronic message, or more broadly that the ...
0
votes
1answer
227 views

Secure API access over SSL using oauth token

On the project that i'm currently working, we authenticate the clients by username and password. In this system each user has a key which is calculated from his password. However, we want to provide ...
24
votes
4answers
10k views

How to achieve non-repudiation?

If I have a message that I need to send to another person, how do I achieve non repudiation ? Is digitally signing the message sufficient ?
2
votes
1answer
120 views

How signature validation would be checked on server side?

Sorry, It may be possible that few things are repeated in my question. I have gone through some documentation/discussion signing an API request and twitter signature documentation As per the ...
4
votes
2answers
141 views

Can the client certificate authentication process treated as a user digitally signed the content(and then get verified on the server)?

The authentication was triggered by certain event (like approving button) on the form. In the process of client certificate authentication (in IIS), user was asked to use their PIN (private key) and ...
0
votes
3answers
4k views

How to prevent man-in-the-middle attacks beside of SSL?

I would like to discuss this scenario: There is a HTTPS service which responds with signed keys to an authenticated client. These signed keys can be used for another service to return very sensible ...
5
votes
3answers
617 views

How can I prove that I wrote a certain blog post?

I would like to be able to prove that I wrote the article that resides at a given URL on someone else's blog. Is there a way that I can do this with public key cryptography? I know a bit about the ...
0
votes
2answers
248 views

Using a Common Private Key for Digital Signatures

I have a mobile application and a server. The mobile application communicates with the server through a web services framework via SSL. The mobile application allows customers to pay for ...
3
votes
2answers
117 views

Deciding whether to sign someones key

How do i decide whether to sign someones PGP public key? I was looking at some contact pages and they have a request for people to sign their public key. How serious of a commitment is it to sign ...
6
votes
1answer
10k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
0
votes
2answers
187 views

How do I securely identify a remote (self programmed embedded) device in PHP?

Is there a reliable way in PHP to identify a device that might be behind a Router (so the IP is not unique)? Background: I have several embedded devices (self programmed & adaptable) that contact ...
7
votes
4answers
2k views

when people say a file has a checked md5 hash, what exactly does that mean?

ok I was just reading this site: http://www.zdnet.com/blog/bott/stay-safe-online-5-secrets-every-pc-and-mac-owner-should-know/3542?pg=4&tag=mantle_skin;content and thought of something I always ...
2
votes
2answers
71 views

Which signing strategy?

I have a device which should lock and unlock something after receiving a signed server response. So in the best case a loop would lock like this: User locks device User wants to unlock device User ...
3
votes
1answer
379 views

Can you make a digital signature using the receiver's public key?

My question is, can you make a digital signature using the receiver's public key and then have the receiver verify the signature using his private key? I always thought that in order to create a ...
1
vote
2answers
99 views

Are there any systems to mitigate the risk of losing a Signing Key?

I want to design a system that hinges on ECDSA. All messages are signed using the algorithm, and this is used to prevent spoofing. However, if a user were to somehow lose control of their key, they ...
3
votes
3answers
319 views

Why a self-signed digital certificate (X.509) cannot be altered?

I'm not experienced in code signing but I was thinking about this: as you know, there are various tools for self-signing digital certificate generation (as makecert from Windows or OpenSSL). Now, It ...
-5
votes
2answers
107 views

Protection of online image file (ancient manuscript) [duplicate]

I am going to protect an image file (ancient manuscript) which will be available online for everyone to download. I want to protect the file in these situations: When it's on the server, I need to ...
1
vote
1answer
269 views

Advantages of using a Digital Signature Scheme (DSS) with Appendix instead of DSS giving Message Recovery

I've been looking at the EMV draft specification (pdf) for using Eliptic Curve Cryptography in payment cards instead of the currently used RSA. One thing I've noticed is that they've moved from using ...
9
votes
3answers
560 views

API message verification without storing private key?

I'm in the process of implementing a public API for my web service. Security is a key concern as money is involved. It seems the current common practice for "authenticating" users in API requests is ...
1
vote
1answer
115 views

Licensing/selling digital certificate to another company

I recently stopped distributing my software, so I no longer use the digital certificate (AKA digital signature) I created for it. A couple of days ago, a large software company offered to buy the ...
3
votes
1answer
79 views

How can a server recover from its secret key stolen?

Suppose a server use digital signature to prove the files it sends to users. If someone steals the secret key in the server, what should it do?
1
vote
1answer
916 views

How secure is my private key in the Windows Digital Certificate store?

Many files we download don't have digital signatures. Files may get infected or someone may intentionally modify them on our hard disk. So I wrote a simple file hashing program in c# that creates a ...
6
votes
5answers
2k views

A standard way to manually add a digital signature to a pdf file?

I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
2
votes
1answer
585 views

The security of sending emails with SPF/DKIM, but not signed

We're using an email sending service (fairly known) to send our emails. We made DNS changes so that emails going through them would pass SPF and DKIM. A few days ago we noticed that they allow any ...
1
vote
1answer
212 views

is pkcs#7 suitable for signing and encrypting zip files?

I'm looking to protect zip files that I will be regularly sending to a 3rd party. I need to ensure strong confidentiality and non-repudation. I would like signing/encryption to be based on ...
2
votes
1answer
570 views

how to specify pkcs#7 requirements for a third party you are exchanging data with?

I am looking to use PKCS#7 to sign and encrypt data (offline batch data files) that are exchanged with a 3rd party. I need to write an interface specification for the 3rd party so that they can ...
4
votes
1answer
113 views

How do I build a secure signing mechanism on top of HMAC

Say we have a system with strong shared keys (not passphrases), and we're trying to sign messages sent by the server that will be visible to an attacker. E.g. storing session state in a signed cookie. ...
0
votes
1answer
67 views

What is closed system esignature?

I need to find a solution for one of my clients who is asking me to implement a esignature solution. I was thinking of suggesting some solutions like DocuSign or EchoSign. But recently my client ...
1
vote
4answers
217 views

certificate usage for signing and encryption

I have a question for basic operating with certificates in emails and pdfs. Im familiar with public key cryptography. The scenario: In my scenario I want to send a confidential email to a person A ...
0
votes
1answer
266 views

Where is RSA Digital signature used in the online banking world?

When i do online banking, i sign my digital transaction with a digipass. Ive been told that it uses a RSA-based digital signature scheme. But an rsa digital signature (1024 bit for the modulus) is a ...
7
votes
2answers
345 views

What asymetric scheme provides the shortest signature, while being secure?

I've had a look at several signature schemes (DSA, ECDSA for the most common ones), and am wondering about whether there exist a scheme that would have the following properties : Be asymmetric (one ...
3
votes
2answers
418 views

what is the difference between a mac and a digital signiture

I understand that a MAC algorithm takes a message and a private key as input and hashes them to a value. I understand that senders and receivers often use MACs to authenticate a message and check the ...
0
votes
1answer
115 views

Does DSA need padding?

So i read on wikipedia that digital signatures need padding (like PSS) and i know this is true for RSA. But know i ask myself does DSA also need padding?
1
vote
1answer
246 views

PKCS#7 message constructed by our code, any weaknesses in the output?

We have this as the PKCS#7 encrypted message. We would like to open this up for review and analysis here, for people to poke holes. This sample is generated via test certificates and keys. The concern ...
7
votes
7answers
237 views

Proving running code on a website is unchanged

Can it be proved to the user that the running code behind a website with security related code is the same as published? I'm currently looking at a few new project ideas and one involves secure ...
0
votes
1answer
50 views

How esignature verification process work?

I have a web application in which the users will be signing an html report. I know how the digital signature authentication works. But here the user will literally be signing the document (So, Should ...
4
votes
3answers
1k views

Is a 512 bit RSA key secure when used temporary?

Is a 512 bit RSA key secure when a new key gets generated and used approximately once a week? The key is only used for signing messages, not for encrypting sensitive data. This is for a system where ...
4
votes
1answer
391 views

Does Authenticode still work offline and with a “fake” certificate

Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
5
votes
1answer
269 views

Most efficient key algorithm for a TLS server key?

Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator. Which key algorithm should I choose for the server key in ...
4
votes
2answers
417 views

Is piping a `ssh-agent` signed message as a password secure?

There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section ...
14
votes
2answers
388 views

Which factors should I consider for devices that accept handwritten digital signatures?

These days many locations ask you to give your signature on a digital signature pad/device. As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
4
votes
2answers
2k views

When using symmetric key encryption, do we need to sign?

Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough ...
5
votes
3answers
323 views

DHE exchange and client authentication

If a server has a known public key and a Diffie-Helman exchange is performed and signed by that key, is there any benefit to authenticating the client before establishing a secure channel instead of ...
1
vote
1answer
960 views

Parsing a PKCS7 detached signature hash

I'm trying to manually verify signatures of Apple iOS Passbook files, which are PKCS #7 detached signatures of the RSA key of the Apple developer who created the file. Which means there's a file ...
2
votes
1answer
191 views

Is the `ssh-agent`'s DSA signature deterministic?

In my hopes to use ssh-agent to generate a signature as password I implicitly assumed a deterministic signature. DSA is however supposed to take random value k for signing. However that randomness is ...
2
votes
1answer
436 views

How to verify the signature in an iOS Passbook pass?

The Passbook application in the new iOS6 keeps track of movie tickets, coupons, and other 'passes' for you, and the passes themselves are loaded onto the user's device via file packages with the ...
2
votes
3answers
781 views

rsa encrypted hash == rsa signature

$ echo -n "1327943823" > test_ok.txt $ openssl dgst -sha1 -binary -out test_ok.sha1 test_ok.txt $ echo "GURbsl4CFPCG83RCZxsEpoRleXicXQhH1OC4Fk77b7EMj2g8aHUhD/L+sm ...
8
votes
4answers
6k views

License key / Serial number generator and checker

I need a serial number generator and accompanying checker. I would like to be able to set a salt (and maybe a length). The generator should only produce serial numbers that pass the test of the ...