A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

-1
votes
4answers
214 views

Is it possible to digitally sign information with a password?

I'm creating a cloud storage service and need to have the ability to provide reliable security for clients. In my previous question, I used a different schematic and said I would post a new question. ...
1
vote
1answer
463 views

Signing session cookies

The Play Framework for Scala has support for signed session cookies. In the application configuration file is an "application secret" that is set as a secure random number when the application source ...
3
votes
3answers
305 views

Can a zero knowledge proof of voting be made using a trusted auth server (without client side crypto)?

Questions: Can one implement a secure voting system having all the features described below? e.g. without disclosing any individual's vote to the government server (or the third party), preserving ...
3
votes
6answers
226 views

Does an email signature increase security?

I'm using Thunderbird with Enigmail. It has both encrypt and sign options for sending PGP emails -- but why is an email signature needed? It just looks overkill to me! Alice and Bob can use PGP to ...
-1
votes
1answer
203 views

DSA Generates different signatures with the same data [closed]

I'm using the example given in msdn article about the DSACryptoServiceProvider Class. The problem is that I get a different signature each time I run the code. I tried OpenSSL and didn't get this ...
0
votes
2answers
205 views

How to detect authenticity Of Client and Server Certificate?

How its possible to detect authenticity Of Client and Server Certificate. For example, If server A has certificate and someone C stolen its certificate and send it to B then How we decide that it's ...
3
votes
4answers
326 views

Evil certificate authority in public-key-infrastructure

Alice goes to the certificate authority (CA) and registers her public key for signature verification. She gets a certificate for this from the CA. Bob requests Alice' public signature verification key ...
0
votes
1answer
106 views

What protection certificates would be required for an application that consists of setup, loading utility and main application?

Say we have an InnoSetup installer script, a native C++ QT files loading application and a .Net client application that we load/update each time and which is the main application. We load files via ...
14
votes
4answers
14k views

how digital signature verification process works

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
0
votes
2answers
140 views

Subdomain-only SSL security/availability

CAcert and StartSSL both only validate domains whose TLD is owned by the requester. I have a few subdomains that come from places like freeDNS that I would like to run an SSL-secured server on. Are ...
3
votes
3answers
357 views

Is there an attack that can modify ciphertext while still allowing it to be decrypted?

Is there any way an encrypted file using AES-256 could be modified without alerting the file owner, ie., so it can still be decrypted with the same key? I know that without an initialization vector ...
0
votes
2answers
1k views

Digital Certificate “Signature and Fingerprint”

What's the difference between Digital certificate's signature and fingerprint (thumbprint) ? I know that Signature: The actual signature to verify that it came from the issuer. and Thumbprint ...
1
vote
2answers
101 views

How to sign and encrypt mails using firefox

There is an option under Tools>options>Advanced>Security Devices. How to use that to encrypt and digitally signed your emails.
1
vote
1answer
111 views

Using secp256k1 and ECDSA with IKE

I just tried using an IKE daemon and EC certificates. I used the secp256k1 curve for key generation. The daemon claims signature scheme ECDSA-256 not supported by private key Now I am wondering ...
1
vote
0answers
250 views

Implementing OAuth flow in JavaScript

I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing ...
1
vote
0answers
108 views

Techniques for web-user communication across an untrusted server

I'm designing a web-based notification framework (i.e. a user can subscribe to updates from a service or another user) where communication between users is encrypted. User-to-user communication on ...
3
votes
1answer
127 views

Validate XML-DSig by DVCS

Is it possible to validate an XML message (with XML-DSig or XAdES signature) by a Data Validation and Certification Server (RFC 3029)? Should it understand XML signatures or not? Could it parse XML? ...
0
votes
1answer
331 views

The Hash header in GPG ASCII armor

When sending a signed message using GPG, it always includes a line that says Hash: SHA256 right at the top of my email. I was wondering if/why it's required, and if not, how I can remove it (in an ...
4
votes
3answers
7k views

What is the difference between an electronic signature and a digital signature

From Wikipedia: An electronic signature, or e-signature, is any electronic means that indicates either that a person adopts the contents of an electronic message, or more broadly that the ...
0
votes
1answer
362 views

Secure API access over SSL using oauth token

On the project that i'm currently working, we authenticate the clients by username and password. In this system each user has a key which is calculated from his password. However, we want to provide ...
26
votes
4answers
14k views

How to achieve non-repudiation?

If I have a message that I need to send to another person, how do I achieve non repudiation ? Is digitally signing the message sufficient ?
3
votes
1answer
154 views

How signature validation would be checked on server side?

Sorry, It may be possible that few things are repeated in my question. I have gone through some documentation/discussion signing an API request and twitter signature documentation As per the ...
0
votes
3answers
8k views

How to prevent man-in-the-middle attacks beside of SSL?

I would like to discuss this scenario: There is a HTTPS service which responds with signed keys to an authenticated client. These signed keys can be used for another service to return very sensible ...
6
votes
3answers
650 views

How can I prove that I wrote a certain blog post?

I would like to be able to prove that I wrote the article that resides at a given URL on someone else's blog. Is there a way that I can do this with public key cryptography? I know a bit about the ...
0
votes
2answers
509 views

Using a Common Private Key for Digital Signatures

I have a mobile application and a server. The mobile application communicates with the server through a web services framework via SSL. The mobile application allows customers to pay for ...
3
votes
2answers
144 views

Deciding whether to sign someones key

How do i decide whether to sign someones PGP public key? I was looking at some contact pages and they have a request for people to sign their public key. How serious of a commitment is it to sign ...
0
votes
2answers
384 views

How do I securely identify a remote (self programmed embedded) device in PHP?

Is there a reliable way in PHP to identify a device that might be behind a Router (so the IP is not unique)? Background: I have several embedded devices (self programmed & adaptable) that contact ...
7
votes
4answers
3k views

when people say a file has a checked md5 hash, what exactly does that mean?

ok I was just reading this site: http://www.zdnet.com/blog/bott/stay-safe-online-5-secrets-every-pc-and-mac-owner-should-know/3542?pg=4&tag=mantle_skin;content and thought of something I always ...
2
votes
2answers
75 views

Which signing strategy?

I have a device which should lock and unlock something after receiving a signed server response. So in the best case a loop would lock like this: User locks device User wants to unlock device User ...
3
votes
1answer
608 views

Can you make a digital signature using the receiver's public key?

My question is, can you make a digital signature using the receiver's public key and then have the receiver verify the signature using his private key? I always thought that in order to create a ...
1
vote
2answers
102 views

Are there any systems to mitigate the risk of losing a Signing Key?

I want to design a system that hinges on ECDSA. All messages are signed using the algorithm, and this is used to prevent spoofing. However, if a user were to somehow lose control of their key, they ...
3
votes
3answers
411 views

Why a self-signed digital certificate (X.509) cannot be altered?

I'm not experienced in code signing but I was thinking about this: as you know, there are various tools for self-signing digital certificate generation (as makecert from Windows or OpenSSL). Now, It ...
-5
votes
2answers
121 views

Protection of online image file (ancient manuscript) [duplicate]

I am going to protect an image file (ancient manuscript) which will be available online for everyone to download. I want to protect the file in these situations: When it's on the server, I need to ...
1
vote
1answer
383 views

Advantages of using a Digital Signature Scheme (DSS) with Appendix instead of DSS giving Message Recovery

I've been looking at the EMV draft specification (pdf) for using Eliptic Curve Cryptography in payment cards instead of the currently used RSA. One thing I've noticed is that they've moved from using ...
10
votes
3answers
1k views

API message verification without storing private key?

I'm in the process of implementing a public API for my web service. Security is a key concern as money is involved. It seems the current common practice for "authenticating" users in API requests is ...
2
votes
1answer
144 views

Licensing/selling digital certificate to another company

I recently stopped distributing my software, so I no longer use the digital certificate (AKA digital signature) I created for it. A couple of days ago, a large software company offered to buy the ...
3
votes
1answer
83 views

How can a server recover from its secret key stolen?

Suppose a server use digital signature to prove the files it sends to users. If someone steals the secret key in the server, what should it do?
1
vote
1answer
1k views

How secure is my private key in the Windows Digital Certificate store?

Many files we download don't have digital signatures. Files may get infected or someone may intentionally modify them on our hard disk. So I wrote a simple file hashing program in c# that creates a ...
7
votes
5answers
4k views

A standard way to manually add a digital signature to a pdf file?

I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
3
votes
1answer
954 views

The security of sending emails with SPF/DKIM, but not signed

We're using an email sending service (fairly known) to send our emails. We made DNS changes so that emails going through them would pass SPF and DKIM. A few days ago we noticed that they allow any ...
1
vote
1answer
267 views

is pkcs#7 suitable for signing and encrypting zip files?

I'm looking to protect zip files that I will be regularly sending to a 3rd party. I need to ensure strong confidentiality and non-repudation. I would like signing/encryption to be based on ...
2
votes
1answer
907 views

how to specify pkcs#7 requirements for a third party you are exchanging data with?

I am looking to use PKCS#7 to sign and encrypt data (offline batch data files) that are exchanged with a 3rd party. I need to write an interface specification for the 3rd party so that they can ...
4
votes
1answer
160 views

How do I build a secure signing mechanism on top of HMAC

Say we have a system with strong shared keys (not passphrases), and we're trying to sign messages sent by the server that will be visible to an attacker. E.g. storing session state in a signed cookie. ...
0
votes
1answer
74 views

What is closed system esignature?

I need to find a solution for one of my clients who is asking me to implement a esignature solution. I was thinking of suggesting some solutions like DocuSign or EchoSign. But recently my client ...
1
vote
4answers
406 views

certificate usage for signing and encryption

I have a question for basic operating with certificates in emails and pdfs. Im familiar with public key cryptography. The scenario: In my scenario I want to send a confidential email to a person A ...
0
votes
1answer
316 views

Where is RSA Digital signature used in the online banking world?

When i do online banking, i sign my digital transaction with a digipass. Ive been told that it uses a RSA-based digital signature scheme. But an rsa digital signature (1024 bit for the modulus) is a ...
7
votes
2answers
677 views

What asymetric scheme provides the shortest signature, while being secure?

I've had a look at several signature schemes (DSA, ECDSA for the most common ones), and am wondering about whether there exist a scheme that would have the following properties : Be asymmetric (one ...
3
votes
2answers
830 views

what is the difference between a mac and a digital signiture

I understand that a MAC algorithm takes a message and a private key as input and hashes them to a value. I understand that senders and receivers often use MACs to authenticate a message and check the ...
0
votes
1answer
150 views

Does DSA need padding?

So i read on wikipedia that digital signatures need padding (like PSS) and i know this is true for RSA. But know i ask myself does DSA also need padding?
1
vote
1answer
376 views

PKCS#7 message constructed by our code, any weaknesses in the output?

We have this as the PKCS#7 encrypted message. We would like to open this up for review and analysis here, for people to poke holes. This sample is generated via test certificates and keys. The concern ...