A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

2
votes
1answer
679 views

How to verify the signature in an iOS Passbook pass?

The Passbook application in the new iOS6 keeps track of movie tickets, coupons, and other 'passes' for you, and the passes themselves are loaded onto the user's device via file packages with the ...
3
votes
3answers
1k views

rsa encrypted hash == rsa signature

$ echo -n "1327943823" > test_ok.txt $ openssl dgst -sha1 -binary -out test_ok.sha1 test_ok.txt $ echo "GURbsl4CFPCG83RCZxsEpoRleXicXQhH1OC4Fk77b7EMj2g8aHUhD/L+sm ...
9
votes
4answers
8k views

License key / Serial number generator and checker

I need a serial number generator and accompanying checker. I would like to be able to set a salt (and maybe a length). The generator should only produce serial numbers that pass the test of the ...
2
votes
2answers
804 views

Revoked certificate validation using past times

I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past. Unfortunately I have problems verifying revoked ...
4
votes
5answers
224 views

Is there any security value of creatively naming folders containing sensitive files?

A friend of mine asked me if he could sign his tax returns without printing them out. While helping him, he insisted on naming the folder containing images of his signature and initials a completely ...
14
votes
6answers
2k views

Why not RSA-encrypt the entire document?

I have recently learned of a way for person B to verify that a document sent from person A is indeed from person A. Person A gives Person B his public RSA key. This must be done reliably. Person A ...
1
vote
0answers
203 views

Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]

I have installed openssl and now the rsa_test.c is running fine. What I want to do is: Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey. The public key contains the ...
3
votes
2answers
486 views

Distributed XAdES-X and XAdES-A signatures over multiple documents

As the standard is not completely clear in this matter, I'm trying to found out if the XAdES standard (ETSI TS 101 903 v1.4.2) describes distributed case in which the SigAndRefsTimeStamp element or ...
1
vote
2answers
155 views

How does a code signing vender charge for creating certificate chains?

I have a question about creating digital signatures for pdf files. I want to have a certificate for my company and have children certificates as many as the number of company's employees who can ...
3
votes
2answers
275 views

Reusing HMAC state for multiple messages

I have a secret key k and message m. I send m || HMAC(m, k) to some other party, who can verify the integrity of m, assuming that they know k. Suppose I have multiple messages m1, m2, and so on. ...
5
votes
3answers
723 views

Digital Signature and Verification?

AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it. So public key is used to decrypt ...
4
votes
1answer
77 views

Standards for CA cert revocation and time-constrained cryptographic algorithm parameters

I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
20
votes
2answers
2k views

Digital Certificate deployment: using two certs for each user?

At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs: One for signing documents, emails, etc. that is ...
4
votes
2answers
626 views

What are the real-time applications of long term digital signature with timestamp

I want to know the real time applications that uses digital signatures with timestamps. Specially I am interested to know the applications where we can trust an old signed document which is now ...
3
votes
3answers
962 views

A “good enough” digital signature, with short key

In my application, I want to hide debug feature behind a password. I don't want the password to be easily known by issuing strings executable, so I want to rely on digital signature. We want Debbie ...
1
vote
1answer
265 views

Signature and Timestamp for Long Term Document Archival Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity. As far as I understand, I ...
1
vote
2answers
704 views

Signed request vs HTTP digest auth for API authentication?

By signed request I mean something like this (simplified example): Client creates a sig in his request: $sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
12
votes
3answers
502 views

Can signing too much compromise a private key?

Can a collection of many messages signed with the same private key be abused to either forge signatures so some (but not all possible) messages, or even worse to reconstruct that private key with less ...
-1
votes
2answers
429 views

Request/Creating a Code Signing Certificate

I have need for a code signing certificate which is trusted by a CA in the windows domain. How do I request/create this certificate? Do I have to request a code signing certificate on the ...
0
votes
1answer
228 views

Can I export my digital certificate to this emtec usb

It is said here http://www.emtec-international.com/sites/default/files/s530_aes_en_0.pdf 2048 bit RSA module: ready for PKI application SHA256 data hashing: ready for digital signature Does it ...
1
vote
1answer
405 views

Purpose and Uses of Root SSL Certificates

I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?). When and ...
3
votes
2answers
571 views

Digital signature with partial recovery

I'm having problems understanding what is meant by "digital signature with partial recovery". I found from Google that digital signature with recovery should mean that the message is recoverable from ...
1
vote
2answers
226 views

Using digital signatures to identify users

Consider the following requirement: Bob should be able to verify that a payment request came from Alice. The above is in simple terms the basic idea, however, in reality Alice would be user A of ...
13
votes
1answer
9k views

What is the actual value of a certificate fingerprint?

In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
2
votes
3answers
335 views

Why do credit cards not use digital certificates?

Asymmetric encryption and digital certificates are used all over in the IT world to verify authenticity and prevent forgeries. And it works great. Why do credit cards not use some form of ...
1
vote
1answer
490 views

Best Practices for Storing Digital Certificate

I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
8
votes
3answers
608 views

Most widespread use of PGP after 20 years

Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP ...
2
votes
2answers
609 views

Time needed to generate an RSA signature of a document

How does the length of the RSA key and the size of the document affect the time it takes to sign a document using SHA-1 and RSA? I used CrypTool to check it, but the time does not appear to be larger ...
5
votes
1answer
18k views

How to use OpenSSL generated keys in Java?

I have my pair of Public and Private keys and my certificate. Those where created in OpenSSL (why? because I was asked to do it in OpenSSL). Now I want to use those things to make a Java app that ...
1
vote
1answer
308 views

Does signing my e-mail with DKIM imply non-repudiation for all my users?

Since a few weeks I have set up my google apps domain to use DKIM for all outgoing mail. Does this mean that everyone that is in possession of a copy of the message can verify that it really ...
6
votes
1answer
836 views

Public key length

I was wondering if there was (and I hope there is) a standard for public key size for ECDH (Elliptic Curve Diffie-Hellman) and ECDSA (Elliptic Curve Digital Signature Algorithm) for every curve type ...
2
votes
1answer
613 views

DRY API Authentication Design Between Services

I am creating an API service that is going to require authentication. this will be the first part of a project that will include a front-end service for my website, and also open up the api for 3rd ...
6
votes
2answers
650 views

Enforce Code/Script Signing

I have both a couple of X.509 Code Signing certificates and a GPG keypair that I can use to sign against code I run on my VPS. Every now and again I write code for iOS, OS X and Windows and always ...
2
votes
1answer
893 views

encode der with openssl

When you issue openssl dgst -sign key <file it follows the PKCS#1 standard to generate a digital signature. hash file with some hash digest function encode the hashed value in DER format, ...
7
votes
4answers
628 views

What good, standard digital signature verification clients are widely or easily deployed?

I'm looking for a good way to publish data along with a digital signature (and ideally a timestamp) which is as easy as possible to verify. For example, imagine an election administrator who wants to ...
8
votes
4answers
9k views

How do the processes for digital certificates, signatures and ssl work?

I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication. Server has a digital certificate acquired from a CA. It also has public and ...
6
votes
3answers
3k views

Can I use a private key as a public key and vice versa?

I have code to encrypt data using a public key and decrypt it using a private key. This is useful when a client wants to send data to a server and know that only the server can decrypt it. But say I ...
3
votes
2answers
237 views

security and the well constructed Qt plugin

"All you'd have to do is build a plugin and you could completely pwn the software." I'm building an application using plugins. I think all you have to do is build a plugin and copy it into the ...
6
votes
1answer
235 views

How to Get and Set Digital Signatures with FDA 21 CFR Part 11 Standards

How do I get and set digital signatures with the 21 CFR part 11 standards as defined by the Food&Drug Administration of the USA?
6
votes
1answer
447 views

OpenPGP Encryption / Decryption Process Using GnuPG

I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
4
votes
1answer
4k views

openssl verify signature

For S/MIME, I now know I can verify PKCS#7 detached signatures with: openssl smime -verify -in detachedsign.pem -content content.txt But what about non-MIME messages? So if I sign the message ...
9
votes
5answers
9k views

What does “key with length of x bits” mean?

I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
3
votes
2answers
315 views

Null content digitally signed message

IA technical specification I'm following requires me to send: The Digital Signature must be in the form of a null content Digitally Signed message (i.e. a PKCS#7 object containing the signature ...
2
votes
4answers
102 views

Securely signing a container package

I have a desktop application that uses a kind of package format to load a blob and do something with it. To ensure the authenticity of the blob, I would like to add a digital signature. I researched ...
30
votes
1answer
5k views

Why are hand-written signatures still so commonly used?

I apologize, that this is not an IT security question (at least not directly), but I couldn't find a more suitable StackExchange site to ask this question. Why are hand-written signatures still so ...
15
votes
3answers
500 views

What is gained by hashing the last block on-device?

Recently I encountered the notion of "hashing the last block on-device". It means that when computing a digital signature, the hash that serves as input for the actual signature computation is not to ...
3
votes
1answer
626 views

What kind of certificate do I need to be able to make and sign my own digital signing certicates?

At build time for a program, I would like to generate a new key pair, and create a certificate that will be embedded (securely) into the program. The purpose of the key pair is to digitally sign an ...
3
votes
1answer
275 views

self-signatures using SHA1

This page says: self-signatures must not use SHA1 You can check this by doing: gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep ...
3
votes
1answer
108 views

A method for securely sharing centrally-stored documents among a changing set of users?

I believe it's possible to meet these requirements only if a third party is involved in a manual process. For example: Each user is given the same public key The private key resides offline at a ...
13
votes
2answers
2k views

Does my PGP key really need to match the e-mail address for which I'll be using it?

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...