A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

2
votes
2answers
171 views

Does SMIME differ from TLS, PGP, DMARC signature, or a Portal Encrypted email message in terms of legal non-repudiation?

I'm interested in protecting email messages from NSA-style snooping, but don't want to incur additional legal risk in doing so. In other words, does SMIME encryption and/or signing cause a given ...
0
votes
0answers
79 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
-3
votes
1answer
66 views

Digitally sign all outbound data [closed]

I want to digitally sign all outbound data from my computer. Can someone suggest a way to do this programatically or using some tool? Instead of actually signing the data, I would simply append a ...
0
votes
2answers
206 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
0
votes
1answer
58 views

Digitally sign all the packets from client machine

If I insist on digitally signing all outgoing packets from my computer, would it affect my browsing experience? I mean if a website doesn't expect me to sign my packets, and still I sign them, can I ...
0
votes
3answers
93 views

Public key encryption vs Digital signatures

For same chunk of data, which one is faster? Public key encryption or digital signature? Confidentiality is not important. I am trying to achieve non-repudiation for the communication. Thanks!
1
vote
0answers
77 views

digitally signing a document [closed]

I've been asked to implement digital signatures for documents at work. I really need to read up more on the matter but several searches didn't make an obvious approach stand out. Main features I ...
1
vote
2answers
180 views

RSA-Based Signature Algorithms

From Beginning Cryptography with Java - chapter 4, digital signatures: Signatures are created using the RSA algorithm by applying the RSA algorithm using the private key and then distributing ...
1
vote
1answer
61 views

Trust on certificate authorities

If I as layman don't err, there are in banking controls, from both internal and national oversights, of the work done by the employees. These are apparently effective, since the details of ...
1
vote
4answers
356 views

How to verify full USB drive's digital signature

There are various ways to verify the validity of a file, usually checking the MD5 checksum or OpenPGP signature. Is it possible to do the same for a full USB Drive? I'd like to be able send a USB ...
0
votes
0answers
28 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
5
votes
3answers
543 views

Is piping a `ssh-agent` signed message as a password secure?

There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section ...
2
votes
1answer
114 views

Why do I have keys of strangers in my GPG keychain?

I'm going though my GPG keychain. I've got a key for a few strangers in my keychain. I don't recall exchanging keys and I'm not sure how the public keys came to be installed in the keychain. I think ...
4
votes
2answers
187 views

Can the client certificate authentication process treated as a user digitally signed the content(and then get verified on the server)?

The authentication was triggered by certain event (like approving button) on the form. In the process of client certificate authentication (in IIS), user was asked to use their PIN (private key) and ...
0
votes
1answer
91 views

Is this signature methodology secure?

I'm working on authentication for my JSON-RPC API and my current working strategy is using signed requests sent via POST over SSL. I'm wondering if anyone can see any vulnerabilities that I haven't ...
0
votes
1answer
196 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
3
votes
1answer
187 views

Is there an algorithm to generate digitally signed URL links?

Scenario: Alice prepares an URL link to Bob's web service (e.g., http://www.bob.com/sensitiveData/123?login=mallory). Alice gives the URL link to Mallory. Mallory follows the link to trigger an ...
7
votes
1answer
17k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
0
votes
4answers
223 views

Can a certification authority sign another CA's certs?

Disclaimer: I have low knowledge of X.509 and PKI, so I would appreciate an answer that is not entirely technical, i.e. by using real-life example scenarios.) I was searching for information ...
1
vote
1answer
115 views

Is it possible to add backdoor to a file with the same size and crc32 checksum (4bytes)?

Is it possible to add backdoor to a file with the same size and crc32 checksum (4bytes)? (The file does not contain byte code, it contains program code as text. The language is PHP.)
4
votes
1answer
135 views
3
votes
4answers
299 views

Does a PGP signature provide integrity verification?

Many websites including OpenSSL's website provide downloads along with MD5/SHA1 checksums sometimes in addition to PGP signatures for the files. Simply put, do PGP signatures provide file integrity ...
5
votes
1answer
4k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
2
votes
1answer
354 views

How to sign data with OpenSSL 0.9.8?

I am building a license generator for nodejs and I am currently testing on Heroku. On my local machine running OpenSSL 1.0.1g, I'm able to test my key pairs (sign and verify) like this: # data.txt's ...
1
vote
2answers
69 views

Is it possible to sign/verify a key-pair?

We currently have the need to authenticate and verify generated keypairs. Our system allows users to register for our service which generates them a key-pair for use on our network. We are in need of ...
0
votes
1answer
214 views

RSA vs ECDSA for VANET Security

I am doing a project on Vehicular Ad-Hoc Network Security (VANET). The proposed scheme uses electronic signature as a means to authenticating the nodes. Most of the research papers I read suggested ...
-2
votes
3answers
70 views

Does HTTPS retrieval, among its other effects, sign a document? [duplicate]

Does HTTPS retrieval, among its other effects, sign a document? I'm asking in hopes of understanding in more specific details what TLS accomplishes. I will try to elaborate my question, as follows. ...
1
vote
0answers
182 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
0
votes
2answers
59 views

Attack Signatures books [closed]

I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on ...
0
votes
1answer
181 views

Digital Signature Software

What is the digital signature software? What it takes to digitally sign software? I'm using the Kaspersky antivírus and the software I wrote, in Delphi, is flagged by the antivirus software due to ...
1
vote
1answer
335 views

What popular online services allow passwordless authentication using digital signatures? [closed]

I am looking for web services that allow clients to authenticate using digital signatures. Especially with e-commerce and payments, clients generally authenticate using name and password (sometimes ...
4
votes
1answer
3k views

Certificate verified using two different paths

StartSSL has an intermediate certificate that they use to sign their EV certificates: sub.class4.server.ca.pem. This certificate's issuer is shown by openssl x509 to be /C=IL/O=StartCom ...
0
votes
4answers
127 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
2
votes
1answer
719 views

Which mail clients support PGP/MIME - is there an overview? [closed]

Does anyone know if there is a current overview (I only found ones from before 2006) which MUAs (mail clients) do support PGP/MIME? I wonder whether there still exist issues like "Outlook Express ...
1
vote
2answers
609 views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...
1
vote
0answers
57 views

Is the digital declaration just an obscure proposal?

One professor from my university proposed me and some colleagues to work on a paper about the digital declaration (which is supposed to be better than the digital signature) for passing the subject. ...
0
votes
3answers
171 views

Is it ok to send user's private key away, even if protected with a SSL channel?

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
3
votes
1answer
440 views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ? (I was told ...
1
vote
1answer
89 views

Digitally signed scripts as a way to thwart XSS

As a blanket approach to dealing with XSS attacks, rather than having to remember to escape user-generated code, is there a way to instruct the browser not to execute any script or script-function ...
1
vote
1answer
360 views

valid PDF signature without using hardware HSM or usb Token

I have a DMS system(alfresco) that needs to sign approx 50.000 valid signatures a year. The signing certificate needs to be acquired from one of the affiliated sub-CA's. So according to the Adobe CDS ...
6
votes
1answer
146 views

Reading older mails signed with a certificate that has meanwhile expired

A few years ago I have used S/MIME certs to sign (and encrypt) my mails. The reason for which I stopped signing was the following: My (class 2) cert was issued on Jan. 1st 2008 (just a sample). It ...
19
votes
8answers
15k views

Why do people still use/recommend MD5 if it is cracked since 1996?

It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996 Therefore we suggest that in the future MD5 should no longer be implemented in ...
0
votes
1answer
101 views

How to modify a certificate using getTBSCertificate() method

I want to show that if I modify one bit or byte from a given X509 certificate the signature verification results false (because this modification results different hash value from the certificate). ...
3
votes
1answer
317 views

Internal code-signing certificate on Windows

I'm looking to improve defense-in-depth on a system, primarily by closing some holes in injected DLLs. Certain applications installed on the system cause helper DLLs (e.g. shell extensions, BHOs, ...
3
votes
3answers
2k views

How to sign & timestamp log or zip files?

I think I can easily sign the files however I also need a timestamp from 3rd party vendor. I want to digitally sign + stamp log files including DHCP & mail because of laws here. UPDATE: I found ...
1
vote
0answers
189 views

How to check executable code signing signatures?

How can I see all code signing signatures an executable has? I know that requests for a tool are usually considered as opinion based, but I really can't find one and I don't expect many answers. ...
-1
votes
2answers
159 views

Digital signatures and truly validating what was actually agreed to

I am developing an application and part of signing up requires a user to sign a contract agreement of using the service. I have been reading around the subject for a few days, and I am fairly happy ...
12
votes
3answers
551 views

How are private keys handled in an enterprise?

We would like to start using digital signatures and possibly encryption for e-mails in our company. My knowledge of public-key cryptography is entirely theoretical with no practical experience. In ...
3
votes
1answer
198 views

How online document signing services guarantee non-repudiation?

There is a number of services online like RightSignature or SignHub that will let you sign online legally binding documents. I understand how documents can be signed digitally and this can guarantee ...
0
votes
1answer
84 views

Proof of quantum safety of the Merkle signature scheme

The Wikipedia article about the Merkle signature scheme claims that it is very adjustable and resistant against quantum computing. What proof is there of this?