A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

3
votes
2answers
92 views

Digital signature: How do I know what I'm signing?

Suppose I have to sign a PDF form. If I'm using (say) Acrobat Reader and a hardware security token, at some point I will be prompted for a PIN to authorize the token to sign the document. How can ...
3
votes
3answers
80 views

Central auth service redirecting to subdomain, using digital signature as auth token

I'm working on a "proof of concept" of a central auth service (not CAS). There are holes in my understanding of what I need to do, and I have concerns that the "protocol" is not secure. Why/What ...
2
votes
1answer
64 views

Correct way of signing and verifying a message

I have an object which I need to transmit to clients and I need the clients to know that I actually created the object. Obviously, this process involves in me signing the object with my private key, ...
1
vote
1answer
75 views

Where does the list of trusted content authorities come from when using a web browser?

I was asked "how do browsers know whether or not to trust the certificate from the server it's connecting to" and thought it was a pretty good question. After doing some googling I found two answers: ...
2
votes
2answers
172 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
1
vote
1answer
67 views

Need asymmetric encryption(not signing) where server encrypts and client decrypts

So I'm trying to build a licensing server, where the licenses of the applications need to be checked when logging in or when the application gets used. But some of those application work offline most ...
2
votes
1answer
60 views

How do key pairs work especially in the context of cryptographic signatures?

Is it the case that any message encrypted with a private key can be decrypted with its matching public key and any message encrypted with a public key can be decrypted with the matching private key ...
1
vote
2answers
90 views

Specific clarification on how https server public key is trusted

I know the general concept of how digital certificates works: e.g. server "signs" the message it wants to send to the client using his private key and sends along a message digest and on the receiving ...
0
votes
1answer
105 views

Encryption and Signature with same RSA private key

Talking about cipher-suites that use RSA both for sign of DH parameters and for digital signature. The keys used for these process are the same, or is there a public and private key for each one? If ...
0
votes
1answer
69 views

Certificate - Digital fingerprint vs Signature [duplicate]

What is the purpose of the « fingerprint » section of a x509 certificate, and is there an issue using SHA1 for it ? I understand the certificate signature section, but I can’t see the point with the ...
0
votes
1answer
71 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. Indeed, I am wondering if the code signing certificate (the “final cert”) must already ...
1
vote
2answers
100 views

Where is my missunderstanding in how digital signatures are used with licence files to allow program to run?

I'm trying to learn how digitally signing a licence file helps prevent piracy. For example say an application only runs if it verifies the date as specified in a licence file has not past. Obviously ...
3
votes
1answer
102 views

Encrypt/sign a client-to-API request?

We are building a JSON API on top of our Ruby on Rails Web application, using JSONAPI::Resources to expose endpoints and Doorkeeper to handle user authentication. Most of our API endpoints will be ...
1
vote
1answer
42 views

How can I guarantee non-modification of data with signatures?

I am required to design a system where auditors can come along some time in the future, examine historic data, and be sure that the data has not changed since it was stored. I have a spec that ...
2
votes
2answers
313 views

With javascript in the browser, how can I sign some data without directly manipulating a private key?

With JavaScript in the browser, I need to digitally sign some data. I'm looking at the new Crypto.Subtle api, specifically the sign() and importKey() methods. I want, very reasonably I feel, to ...
1
vote
1answer
29 views

How to verify signature while downloading log4j?

From the log4j download page. The PGP signatures can be verified using PGP or GPG. First download the KEYS as well as the asc signature file for the relevant distribution. Make sure you get these ...
1
vote
1answer
51 views

RSA signature on TLS

In a TLS handshake using ECDHE-RSA, the ServerKeyExchange frame must include the ECDHE ServerPublicKey, signed with its RSA private key, as specified in the RFC 4492. Got it. Trying to implement an ...
0
votes
1answer
86 views

How to encrypt with ECDSA?

Suppose there's a transaction in the blockchain in which a given address transfers bitcoins to whoever. I need to encrypt a message so only the owner of that address will read it. I have his public ...
2
votes
1answer
94 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
2
votes
2answers
152 views

Assuring Client is Authorized to use JSON Web Token

JSON Web Tokens ( JWT ) are server-signed objects that the issuing server uses to identify a user, track session data and authorize requests. The fact that JWT are server-signed gives assurance that ...
1
vote
2answers
138 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
1
vote
1answer
84 views

Is algorithm used to sign defined by certificate?

Using pfx certificate to sign or cypher, the algorithm used (rsa-1_5, rsa-oaep-mgf1p, etc) is defined inside pfx certificate? Certificate has information about algorithms used? Or it's totally ...
1
vote
1answer
52 views

Is there a way to sign information by when it was made? [duplicate]

Looking at this question ("Is it legal to use an online logbook?") from Aviation SE, I'm wondering if there is a way to sign information in such a way that: It ensures that there was a certain time ...
-1
votes
2answers
211 views

Run our own Certificate Authority for internal use only: safe or not? [duplicate]

According to the guide at How to Run Your Own Certificate Authority, my organization have a plan to issue our own digital certificates for internal use only (the managers will sign PDF documents to ...
2
votes
2answers
124 views

Significance of the difference between DSA and RSA in signature verifying speed

I have run openssl speed and the output on my CPU for longest available DSA key size, which is 2048 bits: sign verify sign/s verify/s rsa 2048 bits 0.029185s ...
2
votes
1answer
164 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
0
votes
1answer
283 views

Simulation of cloud based digital signature with Hardware Security Module (HSM)

I am working on a cloud-based digital signature with a Hardware Security Module (HSM). I know that PKCS#11 AND Microsoft CryptoAPI implementation is required. I want to simulate the total process. For ...
-1
votes
2answers
75 views

Does any nation-state CA (certificate authority) have a public API to verify digital signatures? [closed]

There are around 200+ nation-states on the planet. Most of these use eIDs. Do any of these nation-states have a public API to verify digital signatures? Example: Nation-state Canada issues a eID to ...
2
votes
0answers
35 views

Nation-state digital signatures - how is my public key linked to an identity? [duplicate]

A bitcoiner trying to understand the nation-states. When I use my eID (I'm swedish and I have 'BankID'), and I sign something with my private key that's in the 'eID-file' that I've got on my laptop, ...
2
votes
3answers
786 views

Help verifying downloaded Kali image

I am following instructions as shown here Operating Windows 7, so have downloaded GPG4WIN. Next instruction: is to enter this command: $ wget -q -O - https://www.kali.org/archive-key.asc | gpg ...
1
vote
1answer
33 views

Is there a cryptosystem that allows a set of auditors to confirm that they have valid Shamir or Group signatures?

Suppose I have a client that generates and sends a Shamir key (or group signature) to a set of Auditors. This key is essentially an unverified set of bytes. Each auditor wants to somehow verify that ...
10
votes
2answers
242 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...
9
votes
2answers
297 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
5
votes
2answers
106 views

How do I prepare for Certificate Authority end of business?

We are deploying a security solution which uses certificates to validate documents. These certificates are issued by our government-authorized CA. What if in a distant future, the CA who provided us ...
5
votes
2answers
73 views

Understanding digitial certifications

q1) Does that mean that every time information is exchanged, both the original data + digital certification is sent? Meaning data + signature for each and every exchange. q2) Can any kind soul here ...
3
votes
2answers
169 views

Why can I sign but not encrypt?

-edit- After following a chain of links from this question I see this is similar/duplicate of Why should one not use the same asymmetric key for encryption as they do for signing? but this question ...
1
vote
2answers
55 views

Combinations of key exchange and signature algorithm in TLS

Let's say that one does not trust ECC a lot, and values confidentiality over authenticity (perhaps simply for the reason that MitM is more difficult than passive eavesdropping and decryption later ...
3
votes
1answer
71 views

Verifying cryptographically signed files when the key has been revoked

This is mostly a question out of idle curiousity. If I use my private key to sign a file today, forming a signature, and distribute that signature with the document to someone they can then use my ...
4
votes
2answers
824 views

Confidentiality in Digital Signature

Recently I have been working on Digital Signature. Some common reasons for applying a Digital signature to communications are Authentication, Integrity and Non-repudiation. Does Digital Signature also ...
1
vote
1answer
38 views

Is there a way to sign a 624 bits message on 256 bits

I'm looking for a way to sign a 624 bits message on 256bits (sig length = 256 bits) with an asymmetric keys system? I'm trying to sign a qrcode so a client can be sure that this qrcode has been ...
4
votes
1answer
199 views

Difference between public key and private key validity period

In the section about certificate extensions, the ITU-T X.509 recommendation writes: The private key corresponding to a certified public key is typically used over a different period from the ...
2
votes
1answer
284 views

Is it a safe to hardcode my secret key in my iOS app?

Cloudinary iOS SDK configuration suggests to hardcode your api_secret in your iOS app's source code. Isn't that a security vulnerability since string literals can be extracted from the app binary, ...
2
votes
2answers
81 views

Can an embedded CRL be trusted?

Embedding CRLs in a signed document will allow the signature to be validated "long term", by providing a snapshot of the signer's state the moment the document was signed. Im wondering if these ...
2
votes
0answers
109 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
10
votes
2answers
384 views

Are there any meta-formats for crypto?

Are there are any (properly specified) meta-formats / schema formats for describing cryptographic message structures? I'm looking for a way to describe the format (where some channels might want ...
0
votes
2answers
76 views

Getting the DNS root name servers in a secure way

It doesn't happen often that a root name server changes, but when it does sometimes it takes months for OS vendors to provide patches and in the mean time there is a security risk. So: How to get ...
2
votes
1answer
288 views

PKCS#1-1.5 encoding - is there a reason to use 00 in block type?

For encryption block looking like this: EB = 00 || BT || PS || 00 || Data where BT - block type and PS - padding string, I've read that we use three types of BT - 00, 01, 02. Now, since 00 and 01 are ...
1
vote
2answers
98 views

Man in the middle attack on browser downloads

I'm writing this post from chrome. If I go to a HTTPS site after this, the public keys built into the version of chrome I'm using will be used to verify the site's signature (unless I misunderstand). ...
1
vote
1answer
217 views

Request signing for REST API

I am building a REST API that will receive requests like: GET /api/entities GET /api/entities?filter=X&sort=Y This seems straight forward: have the client HMAC(path + query, key), send me a key ...
2
votes
0answers
78 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...