A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

0
votes
1answer
76 views

Different Microsoft-signed excecutables have apparently the same signature!

On Windows 10 systems, I found two versions of bootsect.exe (a Microsoft-supplied utility that writes disk boot sector) with different hashes (SHA-1 9b7463c79460a55a36b53bee0889f894b2379ec3 for one ...
2
votes
5answers
10k views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
6
votes
3answers
1k views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
0
votes
2answers
83 views

PGP vs Hash functions

What is the difference (in terms of security strength) between checking a package' integrity using pgp and hashing functions (i.e. sha256)? Isn't pgp less secure as the verifier must trust the ...
0
votes
1answer
219 views

BLS signature java implementation needed (if possible, along with some example code)

I need to sign a string with the shortest digest possible using regular certificate like X.509. As far as I understand, I will have to transform the string to the sequence of bytes, then sign. After ...
26
votes
4answers
39k views

how digital signature verification process works

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
2
votes
1answer
30 views

Signing a code and application

I want to send my application to different servers/terminals with content integrity and confidentiality. So, I need to some process to sign my code and application before sending it to servers and to ...
14
votes
1answer
18k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
4
votes
1answer
62 views

What does an OpenPGP signature consist of?

I don't understand how OpenPGP signatures work. I have a picture which I want to sign, and a digital certificate which consists of my name and email address and my public key. Additionally, a digital ...
10
votes
3answers
380 views

Is this a weakness of enveloped XML signature?

There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course). Let's have a simple XML message with an enveloped XML signature: <?xml ...
0
votes
1answer
109 views

Where in the CSR is the public key?

I am reading http://www.akadia.com/services/ssh_test_certificate.html In step 2 openssl req -new -key server.key -out server.csr server.key is generated earlier using openssl genrsa -des3 -out ...
0
votes
2answers
140 views

SSL digital certificate process - high level

I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database. In this case, I have an web server and needs to implement SSL ...
5
votes
1answer
646 views

multiple authenticode signatures

Is it possible to have multiple Authenticode signatures in an executable? The Digital Signatures tab suggests you can, so I was wondering if, for example, you can sign an executable with Verisign's ...
3
votes
1answer
374 views

Make signed file from content file and its detached signature?

I have a text file which I will call filename.txt. Firstly I call gpg --output filename.asc --clearsign filename.txt Signed file filename.asc is created. Then I call gpg --armor --output filename....
1
vote
2answers
53 views

RSA blind signature vs signing a hash

My understanding is that the key feature of a blind RSA signature is that the signer is unaware of the contents of the message being signed. How is this different from simply hashing some data and ...
2
votes
1answer
285 views

Microsoft and SHA-1 deprecating on Windows 7

Microsoft states: Effective January 1, 2016, Windows (version 7 and higher) and Windows Server will no longer trust any code that is signed with a SHA-1 code signing certificate and that ...
3
votes
2answers
104 views

Sign a callback URL

I have a Single Sign-On system that works this way : User clicks link on clientsite.com that redirect him to mastersite.com?returnTo=http://clientsite.com If auth is valid, the user is redirected ...
2
votes
1answer
55 views

what is worth a digital signature based on email address only? [closed]

I have noticed that most digital signature providers do not try to certify anything but an e-mail address, while it is quite easy to create an email address without disclosing any personal information....
4
votes
2answers
202 views

Why would some Windows executables not have a “Digital Signatures” tab?

Why would some executable on a Windows 7 system not have a "Digital Signatures" tab? (With this question I am referring to those executables that are not part of Windows OS and to which the ...
3
votes
0answers
62 views

Can I do an enveloping XAdES signature on binary content?

I need to sign some binary content (scanned documents) with a digital signature compliant with European norms, CAdES - XAdES. One option would be to use this library to do a XAdES signature. Is there ...
5
votes
2answers
213 views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
2
votes
1answer
208 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
3
votes
1answer
86 views

Verification of a timestamped PDF

I'm kinda new to the process of timestamping files to provide digital integrity. For testing purposes, i use tsa.safecreative.org for PDF files. Now i've signed a couple PDF files and if i open up ...
3
votes
2answers
148 views

Client side signing of a file(.exe,.dll,.jar..) using CA issued certificate and signtool [closed]

In a current project we have purchased certificate from a trusted CA and have installed in a host, sign tool is also installed in the same host. All the files which we develop(jar,dll,apk,exe etc..,) ...
2
votes
1answer
97 views

Correct way of signing and verifying a message

I have an object which I need to transmit to clients and I need the clients to know that I actually created the object. Obviously, this process involves in me signing the object with my private key, ...
14
votes
3answers
16k views

License key / Serial number generator and checker

I need a serial number generator and accompanying checker. I would like to be able to set a salt (and maybe a length). The generator should only produce serial numbers that pass the test of the ...
0
votes
1answer
25 views

Standard digital signature data representation

I am creating digital signatures using various scheme, e.g. RSASSA-PSS. The result is bytes that represents signed data with private key. I would like to store signature as a standard data ...
1
vote
0answers
126 views

CMS signed data OpenSSL verification error

I have a CMS signed data that is successfully verified through Java BouncyCastle library. When trying to verify through OpenSSL, I am getting the following error: >openssl smime -verify -inform ...
2
votes
1answer
103 views

Strategy for electronic document (PDF) signatures

I'm treading into the murky waters of electronic document signatures, and I'm having trouble figuring out the right approach to deal with my requirements. I think this should be pretty straightforward,...
2
votes
3answers
297 views

Digital signatures and truly validating what was actually agreed to

I am developing an application and part of signing up requires a user to sign a contract agreement of using the service. I have been reading around the subject for a few days, and I am fairly happy ...
0
votes
1answer
37 views

For X.509 Certificates where is the actual digital signature?

When you open up the certificate information from your browser and go to the details tab there is a bunch of information for various certificate fields. I am wondering which field contains the actual ...
0
votes
5answers
167 views

How to make sure nobody has read this!

Is there any computer/server which would allow me to get "guaranteed read access history" for files? For example, suppose I made a file with my plaintext passwords and simply wanted to make sure that ...
2
votes
2answers
85 views

Is this a secure Digital Signature + Encryption method?

I am trying to wrap my head around Digital Signatures and how RSA Encryption supports them. And which order to do them along with what specifically to encrypt. So say we have Alice and Bob and a ...
1
vote
0answers
143 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
21
votes
2answers
2k views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
0
votes
0answers
40 views

Smartcard authentification: encrypt/decrypt or ECDSA?

I'm implementing a simple door access control with smart keyfobs. At the moment I send a 32 byte message to the keyfob which it signs with ECDSA and I verify the authenticity with the public key. ...
0
votes
0answers
49 views

deceptive digital signature?

I am new to cyphering and I try to understand this case : my government sends me so-called "digitally signed" PDFs, as you can see below (text only, after "Thanks"). Although there is a certificate ...
2
votes
1answer
2k views

OpenSSL check if a SSL certificate is SHA-1 or SHA256 signed

How do I check if an OpenSSL certificate issued to a site is SHA-1 or SHA-256? I have a quite a lot of intranet sites using OpenSSL certificates and I am a bit confused as when I check the certificate ...
1
vote
2answers
71 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
4
votes
3answers
142 views

Is there a way to prove some content came from a specific website?

I guess we can all agree that a screenshot of a website proves nothing; one can edit the HTML as much as one likes, take a screenshot and show a website displaying false information. As far as I know,...
0
votes
1answer
38 views

Authentication using a digital signiture

I'm new to the world of digital signatures and encryption and I'm trying to learn more. I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital ...
9
votes
1answer
25k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
2
votes
1answer
203 views

Encrypt/sign a client-to-API request?

We are building a JSON API on top of our Ruby on Rails Web application, using JSONAPI::Resources to expose endpoints and Doorkeeper to handle user authentication. Most of our API endpoints will be ...
2
votes
1answer
104 views

In the context of advanced electronic signatures, what does “sole control” mean?

To satisfy the conditions for an advanced or qualified electronic signature, the power to sign must remain under the "sole control" of the signatory. Can anyone provide concrete examples of what this ...
3
votes
3answers
103 views

Central auth service redirecting to subdomain, using digital signature as auth token

I'm working on a "proof of concept" of a central auth service (not CAS). There are holes in my understanding of what I need to do, and I have concerns that the "protocol" is not secure. Why/What ...
3
votes
1answer
178 views

Need raw certificate/key to sign PDFs via Java app. But vendors seem to only sell HSMs for this. What to do?

Our organisation wants to purchase a digital signature certificate for signing financial PDF documents. We want to automate this process, so we'll be having Java code do the signing work. For that the ...
1
vote
2answers
210 views

What are some Linux commands for genrating and verifying digital signatures?

I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography. If I understand correctly then the public key and the private key in an asymmetric ...
2
votes
1answer
140 views

signature and padding

I use JcaContentSignerBuilder to sign a self-signed certificate but I don't know what the default padding is. My requirement is that I must NOT use PKCS#1.5 padding. The code I use is below - can ...
1
vote
1answer
49 views

How is the signing of an OpenPGP public key realized technically?

I recently have signed the public OpenPGP key of a friend of mine. Curious to see, which effect this would have on the actual key, I compared the key before and after signing it. What I found was that ...
0
votes
1answer
55 views

Long term trust anchor validation

Let's say someone signs a document for long term validation using a certificate issued by a trusted CA. Throughout the following years, the document is timestamped again and again by multiple trusted ...