A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

0
votes
1answer
140 views

Encryption and Signature with same RSA private key

Talking about cipher-suites that use RSA both for sign of DH parameters and for digital signature. The keys used for these process are the same, or is there a public and private key for each one? If ...
0
votes
1answer
131 views

Certificate - Digital fingerprint vs Signature [duplicate]

What is the purpose of the « fingerprint » section of a x509 certificate, and is there an issue using SHA1 for it ? I understand the certificate signature section, but I can’t see the point with the ...
0
votes
1answer
127 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. I am wondering if the code signing certificate (the “final cert”) must already be in ...
1
vote
2answers
153 views

Where is my missunderstanding in how digital signatures are used with licence files to allow program to run?

I'm trying to learn how digitally signing a licence file helps prevent piracy. For example say an application only runs if it verifies the date as specified in a licence file has not past. Obviously ...
2
votes
1answer
175 views

Encrypt/sign a client-to-API request?

We are building a JSON API on top of our Ruby on Rails Web application, using JSONAPI::Resources to expose endpoints and Doorkeeper to handle user authentication. Most of our API endpoints will be ...
1
vote
1answer
45 views

How can I guarantee non-modification of data with signatures?

I am required to design a system where auditors can come along some time in the future, examine historic data, and be sure that the data has not changed since it was stored. I have a spec that ...
1
vote
2answers
600 views

With javascript in the browser, how can I sign some data without directly manipulating a private key?

With JavaScript in the browser, I need to digitally sign some data. I'm looking at the new Crypto.Subtle api, specifically the sign() and importKey() methods. I want, very reasonably I feel, to ...
0
votes
1answer
31 views

How to verify signature while downloading log4j?

From the log4j download page. The PGP signatures can be verified using PGP or GPG. First download the KEYS as well as the asc signature file for the relevant distribution. Make sure you get these ...
1
vote
1answer
73 views

RSA signature on TLS

In a TLS handshake using ECDHE-RSA, the ServerKeyExchange frame must include the ECDHE ServerPublicKey, signed with its RSA private key, as specified in the RFC 4492. Got it. Trying to implement an ...
0
votes
1answer
179 views

How to encrypt with ECDSA?

Suppose there's a transaction in the blockchain in which a given address transfers bitcoins to whoever. I need to encrypt a message so only the owner of that address will read it. I have his public ...
1
vote
0answers
119 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
2
votes
2answers
237 views

Assuring Client is Authorized to use JSON Web Token

JSON Web Tokens ( JWT ) are server-signed objects that the issuing server uses to identify a user, track session data and authorize requests. The fact that JWT are server-signed gives assurance that ...
0
votes
2answers
180 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
1
vote
1answer
113 views

Is algorithm used to sign defined by certificate?

Using pfx certificate to sign or cypher, the algorithm used (rsa-1_5, rsa-oaep-mgf1p, etc) is defined inside pfx certificate? Certificate has information about algorithms used? Or it's totally ...
0
votes
1answer
53 views

Is there a way to sign information by when it was made? [duplicate]

Looking at this question ("Is it legal to use an online logbook?") from Aviation SE, I'm wondering if there is a way to sign information in such a way that: It ensures that there was a certain time ...
-1
votes
2answers
289 views

Run our own Certificate Authority for internal use only: safe or not? [duplicate]

According to the guide at How to Run Your Own Certificate Authority, my organization have a plan to issue our own digital certificates for internal use only (the managers will sign PDF documents to ...
1
vote
2answers
181 views

Significance of the difference between DSA and RSA in signature verifying speed

I have run openssl speed and the output on my CPU for longest available DSA key size, which is 2048 bits: sign verify sign/s verify/s rsa 2048 bits 0.029185s ...
2
votes
1answer
198 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
0
votes
1answer
446 views

Simulation of cloud based digital signature with Hardware Security Module (HSM)

I am working on a cloud-based digital signature with a Hardware Security Module (HSM). I know that PKCS#11 AND Microsoft CryptoAPI implementation is required. I want to simulate the total process. For ...
-1
votes
2answers
77 views

Does any nation-state CA (certificate authority) have a public API to verify digital signatures? [closed]

There are around 200+ nation-states on the planet. Most of these use eIDs. Do any of these nation-states have a public API to verify digital signatures? Example: Nation-state Canada issues a eID to ...
2
votes
0answers
35 views

Nation-state digital signatures - how is my public key linked to an identity? [duplicate]

A bitcoiner trying to understand the nation-states. When I use my eID (I'm swedish and I have 'BankID'), and I sign something with my private key that's in the 'eID-file' that I've got on my laptop, ...
2
votes
3answers
1k views

Help verifying downloaded Kali image

I am following instructions as shown here Operating Windows 7, so have downloaded GPG4WIN. Next instruction: is to enter this command: $ wget -q -O - https://www.kali.org/archive-key.asc | gpg ...
1
vote
1answer
35 views

Is there a cryptosystem that allows a set of auditors to confirm that they have valid Shamir or Group signatures?

Suppose I have a client that generates and sends a Shamir key (or group signature) to a set of Auditors. This key is essentially an unverified set of bytes. Each auditor wants to somehow verify that ...
10
votes
2answers
266 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...
9
votes
2answers
330 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
5
votes
2answers
112 views

How do I prepare for Certificate Authority end of business?

We are deploying a security solution which uses certificates to validate documents. These certificates are issued by our government-authorized CA. What if in a distant future, the CA who provided us ...
5
votes
2answers
77 views

Understanding digitial certifications

q1) Does that mean that every time information is exchanged, both the original data + digital certification is sent? Meaning data + signature for each and every exchange. q2) Can any kind soul here ...
3
votes
2answers
211 views

Why can I sign but not encrypt?

-edit- After following a chain of links from this question I see this is similar/duplicate of Why should one not use the same asymmetric key for encryption as they do for signing? but this question ...
1
vote
2answers
66 views

Combinations of key exchange and signature algorithm in TLS

Let's say that one does not trust ECC a lot, and values confidentiality over authenticity (perhaps simply for the reason that MitM is more difficult than passive eavesdropping and decryption later ...
7
votes
2answers
108 views

Verifying cryptographically signed files when the key has been revoked

This is mostly a question out of idle curiousity. If I use my private key to sign a file today, forming a signature, and distribute that signature with the document to someone they can then use my ...
4
votes
2answers
1k views

Confidentiality in Digital Signature

Recently I have been working on Digital Signature. Some common reasons for applying a Digital signature to communications are Authentication, Integrity and Non-repudiation. Does Digital Signature also ...
1
vote
1answer
40 views

Is there a way to sign a 624 bits message on 256 bits

I'm looking for a way to sign a 624 bits message on 256bits (sig length = 256 bits) with an asymmetric keys system? I'm trying to sign a qrcode so a client can be sure that this qrcode has been ...
4
votes
1answer
278 views

Difference between public key and private key validity period

In the section about certificate extensions, the ITU-T X.509 recommendation writes: The private key corresponding to a certified public key is typically used over a different period from the ...
2
votes
1answer
342 views

Is it a safe to hardcode my secret key in my iOS app?

Cloudinary iOS SDK configuration suggests to hardcode your api_secret in your iOS app's source code. Isn't that a security vulnerability since string literals can be extracted from the app binary, ...
2
votes
2answers
100 views

Can an embedded CRL be trusted?

Embedding CRLs in a signed document will allow the signature to be validated "long term", by providing a snapshot of the signer's state the moment the document was signed. Im wondering if these ...
2
votes
0answers
135 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
10
votes
2answers
397 views

Are there any meta-formats for crypto?

Are there are any (properly specified) meta-formats / schema formats for describing cryptographic message structures? I'm looking for a way to describe the format (where some channels might want ...
0
votes
2answers
79 views

Getting the DNS root name servers in a secure way

It doesn't happen often that a root name server changes, but when it does sometimes it takes months for OS vendors to provide patches and in the mean time there is a security risk. So: How to get ...
2
votes
2answers
482 views

PKCS#1-1.5 encoding - is there a reason to use 00 in block type?

For encryption block looking like this: EB = 00 || BT || PS || 00 || Data where BT - block type and PS - padding string, I've read that we use three types of BT - 00, 01, 02. Now, since 00 and 01 are ...
1
vote
2answers
112 views

Man in the middle attack on browser downloads

I'm writing this post from chrome. If I go to a HTTPS site after this, the public keys built into the version of chrome I'm using will be used to verify the site's signature (unless I misunderstand). ...
1
vote
1answer
296 views

Request signing for REST API

I am building a REST API that will receive requests like: GET /api/entities GET /api/entities?filter=X&sort=Y This seems straight forward: have the client HMAC(path + query, key), send me a key ...
2
votes
0answers
120 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
1
vote
1answer
141 views

Is the enforcement of only allowing signed application to run in a Windows server a safe rule in a prod environment?

There are various security tools that allow an administrator to enforce only signed applications to run in a Windows operating system. is this a realistic general enforcement rule in a production ...
1
vote
1answer
214 views

Signing (HMAC) cookie identifier

Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier? In example, expressjs#session ...
9
votes
2answers
1k views

How are digital certificates compared?

I have read about SSL and TLS; I know how RSA works and why digital certificates are necessary (more or less), but I am curious about how we prevent a fake digital certificate. The operating system ...
0
votes
1answer
41 views

Asymmetric Encryption Digital Signatures

Here is the paragraph I can't quite get my head around. Alice sends a message to Bob and wants him to be sure the message has come from her. • She publishes her public key. • She computes ...
0
votes
1answer
174 views

RSA vs DSA Digital Signature Message Digest Recovery

I'm learning about signatures using RSA and DSA, I've come across this little fact: RSA can recover the message digest from the signature, whereas in DSA this isn’t possible – you have to have the ...
0
votes
1answer
151 views

Is a handwritten scanned signature equivalent to its paper counterpart? [closed]

In terms of Authentication, Integrity and non-repudiation, is a handwritten scanned signature equivalent to its paper counterpart? For example, if you have a paper contract and you obtain a digital ...
2
votes
1answer
100 views

How to verify installed packages [closed]

On Linux (Debian x64) I recently installed some software with: apt-get install the_package_name APT told me some packages couldn't be authenticated but I ignored the warning and installed anyway. ...
0
votes
2answers
138 views

Can a signed downloaded file be securely verified if you only control the private key and the download/verification algorithm?

I'm designing the update procedure for IP Camera's. I'm wondering if my current design is secure enough. I have a binary file that I want to get to a device. I make a hash of this binary file and ...