A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

2
votes
1answer
50 views

Subject verification of certificates

Suppose H has taken C’s certificate and manually changed the subject information in C’s certificate from C to H. Would this modification be detected by A during the certificate verification process?
0
votes
1answer
81 views

RSA vs DSA Digital Signature Message Digest Recovery

I'm learning about signatures using RSA and DSA, I've come across this little fact: RSA can recover the message digest from the signature, whereas in DSA this isn’t possible – you have to have the ...
0
votes
1answer
77 views

Is a handwritten scanned signature equivalent to its paper counterpart? [closed]

In terms of Authentication, Integrity and non-repudiation, is a handwritten scanned signature equivalent to its paper counterpart? For example, if you have a paper contract and you obtain a digital ...
3
votes
2answers
58 views

Signing the Recovery Partition

Do any computer manufacturers sign (DSA, or just publishing a hash) their recovery partitions so that I can be sure that these bits are authentic? I'd like to buy a second-hand computer and reduce ...
2
votes
1answer
52 views

How to verify installed packages [closed]

On Linux (Debian x64) I recently installed some software with: apt-get install the_package_name APT told me some packages couldn't be authenticated but I ignored the warning and installed anyway. ...
0
votes
2answers
88 views

Can a signed downloaded file be securely verified if you only control the private key and the download/verification algorithm?

I'm designing the update procedure for IP Camera's. I'm wondering if my current design is secure enough. I have a binary file that I want to get to a device. I make a hash of this binary file and ...
4
votes
2answers
149 views

Is it possible and does it make sense to sign an E-mail with PGP and S/MIME?

After some research without any answer to my question, if it's possible and does it make sense to sign an E-mail with PGP and s/mime (?), I'm hoping to get an answer here. I know that, PGP and S/MIME ...
2
votes
1answer
72 views

Use the server's key to digitally sign the HTML content it delivered?

Is there any way to prove that a HTML page was delivered to my browser, and not modified in any way, after it was delivered over TLS? I need to prove integrity, and authenticity of the sender, ...
3
votes
1answer
151 views

Generating secret keys with secret keys

Hydra is a secretive organization. It is comprised of several Directors at the top, and many Agents underneath them. A Director sends Agents on secret missions. During these missions, communication ...
53
votes
5answers
14k views

Why should one not use the same asymmetric key for encryption as they do for signing?

In an answer to a question about RSA and PGP, PulpSpy noted this: It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for ...
1
vote
0answers
127 views

PKCS#7 signed data structure in signed PDF document

Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ...
1
vote
1answer
348 views

DSA Generates different signatures with the same data [closed]

I'm using the example given in msdn article about the DSACryptoServiceProvider Class. The problem is that I get a different signature each time I run the code. I tried OpenSSL and didn't get this ...
2
votes
2answers
87 views

Is HTTPS required for PCI Compliance when downloading desktop software patches, if no PII is transmitted, and content is digitally signed + verified?

We have a desktop app that downloads patch content via HTTP. The content is digitally signed and verified by client software after download. Is HTTPS required to achieve PCI compliance if: No PII ...
3
votes
1answer
168 views

Standard to represent digital signature on paper

Users are making a deal using the website. Website generated PDF file (something like contract or report). Users perform digital signing of this file (analogous to hand-written signature on paper ...
1
vote
0answers
87 views

Is LTV in a pdf required if it has a trusted timestamp and the Verification Authority is guaranteed to remain active? [closed]

I have successfully managed to add valid "qualified digital signatures" using a USB token to the PDFs generated by our web application through TCPDF. I am now wondering if I should try to add a ...
16
votes
4answers
14k views

How do the processes for digital certificates, signatures and ssl work?

I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication. Server has a digital certificate acquired from a CA. It also has public and ...
3
votes
1answer
98 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
3
votes
1answer
99 views

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My ...
1
vote
1answer
85 views

Diffie Hellman and exchange of public key for signature

Let's assume an insecure channel. Is it safe to exchange Alice & Bob public keys first then apply them to sign communications during the DH process? (then encrypt+sign all future communications)? ...
1
vote
1answer
117 views

multiple authenticode signatures

Is it possible to have multiple Authenticode signatures in an executable? The Digital Signatures tab suggests you can, so I was wondering if, for example, you can sign an executable with Verisign's ...
1
vote
1answer
193 views

Is long-term validity definitively corrupted upon TSA certificate revocation?

Suppose a document that was signed with a long-term signature (e.g. CAdES-A): D S T1 (D - document, S - signature, T1 - time-stamp created using a time-stamping certificate C1). If C1 appears in the ...
1
vote
1answer
174 views

how to extract a valid digital certificate and put it on other program

I am working on this matter as a graduate, but I need some help. how can extract a valid digital certificate to put it on other program? can I put a digital certificate on other executables and be ...
0
votes
1answer
72 views

Can a Bitcoin miner generate SHA2 hashes on arbitrary data?

I'm not asking about bitcoin's design...but am interested in the hashing capacity of a bitcoin miner. To be short: do bitcoin miners(or some of them) accept customizable inputs and hash them in ...
1
vote
3answers
603 views

What part of the CSR is hashed in order to create its signature?

I'd like to change the CSR before it is transferred to the CA without going through the CSR creation process again. To do that I need to know how to calculate the signature of the CSR after I modified ...
3
votes
2answers
132 views

Can CA issue a certificate without CSR?

My question is if the CA can generate a private/public keypair on behalf of the requestor and sign it with its own private key? Is there any standard way or protocol to distribute such a ...
1
vote
1answer
158 views

Rest WebService with signed requests in Java

I'm currently implementing a rest web service with Spring+Java+Tomcat and a cmd client to access it. The most important requirement is to restrict the usage to authenticated users - encryption isn't ...
1
vote
4answers
6k views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
2
votes
2answers
132 views

Using digital certificates in digital signatures

Please could anybody explain to me how certificates are used with digital signatures? I understand difference between certificates and signatures. It is clear. Digital certificates are used to ...
4
votes
1answer
41 views

Mail Signing Certificate – What are the impacts when revocated?

Suppose I open a signed mail on 1st January 2000, signature is OK. What about this two cases : 1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
1
vote
1answer
69 views

Keeping signatures valid even after the private key has been compromised

If I understand the topic of digital signatures correctly, you sign a message via hashing+encrypting it using your private key. Then, if a private key is compromised by an attacker, she could sign ...
2
votes
1answer
47 views

What is the ideal HMAC message format if message is an array?

I'm using HMAC exactly as intended to verify the integrity of a message. However, the message is really an associative array (or a hash). Since this will be done on various platforms (within and ...
0
votes
1answer
99 views

Signature scheme using RSA and SHA512

What do you think about this signature scheme using RSA with 4096 bit keys? Being R pseudorandom padding, fixed length (4096 - 512 bits): RSApriv(R || SHA512(M)) I know that it's not as secure as ...
0
votes
0answers
65 views

Guidance on Login using Digital Signature DSC (PKCS12 and x509 certificate)

I'm interesting in exploring possibility to authenticate user using their Digital Certificate. The methodology is to first register the DSC from the user and keep their Public key along with Serial ...
3
votes
3answers
382 views

Corporate PKI - SHA1 deprecation

Here is the context. Suppose you have a corporate PKI with : AC_Root (offline in safe store - SHA1 signature) SubRootA and SubrootB (offline in safe store - SHA1 signature) SubSubRootC, SubSubRootD, ...
1
vote
0answers
57 views

Sign java jars for security [closed]

We have an enterprise system that utilizes many in house jars, java applications, to run on a centos 7 linux system. How do I go about achieving the following in order of importance: Only signed ...
1
vote
1answer
74 views

Digital signatures and weak hash functions

There was this question in last year's exam. The teacher claims that answer b) (in boldface below) is correct. Attacks are constantly being performed on digital signatures which use weak hash ...
4
votes
2answers
190 views

Verify digital signature without key public key in signature

When receiving emails, I sometimes see the following: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I found an integer overflow in PHP, in the conversation of dates to "Julian Day Count" function. ...
1
vote
1answer
136 views

If you can break this authentication system then you can break into my house

I'll preface this by saying I know approximately 0 about cyber-sec I've made a server that will allow smart phones to act as a remote control for my house (eg turn lights on/off and unlock doors). ...
9
votes
8answers
546 views

Authencity of information displayed on an untrusted device

Suppose I have a (bluetooth/usb) device which needs to displays information on an external pc/phone. Is there a simple and effective method to garantuee that the information displayed hasn't been ...
12
votes
3answers
13k views

License key / Serial number generator and checker

I need a serial number generator and accompanying checker. I would like to be able to set a salt (and maybe a length). The generator should only produce serial numbers that pass the test of the ...
13
votes
3answers
3k views

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure because if the key is compromised or ...
0
votes
0answers
14 views

Why do PGP Keys have expiration dates? [duplicate]

I read a tutorial to get started with PGP and so far I understand the importance and the difference between encryption, decryption, signing, and verifying. However, I don't understand why a key has ...
1
vote
1answer
84 views

Multi-Function SSL Digital Certificate

Is there a problem with using a single SSL certificate for both SSL/TLS/HTTPS communication as well as to sign (external) digital timestamp certificates? Other than the obvious: if one key is ...
1
vote
1answer
312 views

Server-based PDF Signing using HSM

I have some question about server side pdf signing using network-attached hardware security module. my first question is: what is PDF Signing Certificate? Certificates are public keys, how a ...
4
votes
2answers
198 views

A method for securely sharing centrally-stored documents among a changing set of users?

I believe it's possible to meet these requirements only if a third party is involved in a manual process. For example: Each user is given the same public key The private key resides offline at a ...
0
votes
2answers
260 views

Installing and updating a CA certificate on a client

I am trying to implement a system where a client can download application packages from a server to install/update them on the client. I suppose that the client is something like a platform on an ...
0
votes
2answers
179 views

Typical mistakes when implementing digital signatures?

I am looking for a list of typical mistakes someone can make when implementing digital signatures for a software. And of course why they are mistakes and how an attacker could take advantage of them. ...
2
votes
2answers
135 views

Public key authentication: what gets signed?

I've just started reading about SSH and how it's used for authentication. From this website, it says: The private key is able to generate signatures. A signature created using your private key ...
31
votes
11answers
1k views

Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
36
votes
2answers
7k views

Why are hand-written signatures still so commonly used?

Why are hand-written signatures still so commonly used? Can they actually prove anything? Two assumptions: If anyone wants to forge my signature I'm sure they will be able to do it. Even my own ...