A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

2
votes
2answers
205 views

Code Signing Confusion

I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. ...
1
vote
1answer
163 views

Understanding Digital Signature

I have just learned Digital Signature and am trying to ensure that I have got my understanding of Digital Signature on the correct track. Assume Alice wants to send a message (M) to Bob where the ...
2
votes
1answer
164 views

What does verified file in windows mean? And does it guarantee related files?

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g Microsoft) or in other case, unknown publisher. I know public key encryption can ...
2
votes
1answer
177 views

Is there any asymmetric scheme provides signature with length of 30 bytes?

I want to send short messages to cell phones.Commonly a short message is no longer than 70 bytes. I need 20 bytes or more holding information and the rest bytes are for signature provided by ...
5
votes
3answers
339 views

What are you saying when you sign a PGP key?

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address? To explain what I mean, take the following two ...
3
votes
1answer
227 views

Will PGP signed email be blocked in China?

I generally sign all of my outgoing email with PGP. I don't usually encrypt it because most people I send mail to don't have a public key. Anyway, if I send an unencrypted message with a PGP signature ...
2
votes
2answers
805 views

PGP/GPG verifying authenticity

My boss recently implemented a new security system related to PGP/GPG. The whole idea behind this is to sign files so that people know from who they came. They don't require us to encrypt them, just ...
1
vote
0answers
117 views

Verifying the owner of a signing key

I'm using elliptic curve cryptography (curve25519 and ed25519) for key exchange and signing. The signing and key exchange keypairs are independent. I need two users to be able to verify each other's ...
3
votes
3answers
379 views

Why are apps signed?

From the Android website: Android requires that all apps be digitally signed with a certificate before they can be installed. The signature ensures that only the original developer can publish ...
0
votes
0answers
482 views

Application Privilege Control in Kaspersky blocks program with no digital signature

I made a small application that displays hello world to the console output and attempted to open it in another computer that had Kaspersky fully updated. When I ran the application, Kaspersky gave a ...
2
votes
2answers
603 views

Why is a CSR hashed?

What are the use cases for defining something other than the default SHA1 hash in a CSR? Is it to protect the digital signature, public/private keys? What is it protecting exactly?
1
vote
2answers
295 views

Are digital signature algorithms subject to the same types of attack as public-key encryption algorithms?

I understand that digital signatures are usually implemented by encrypting a message digest with a private key, decrypting the resulting signature with a public key, and verifying that the message ...
2
votes
1answer
181 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
4
votes
2answers
1k views

Does Authenticode still work offline and with a “fake” certificate

Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
1
vote
2answers
206 views

Is it Possible to use one commercial SSL Certificate to issue end user certs?

My organization is preparing to purchase some 50 "units" from Symantec, with which we can purchase Verisign SSL certificates of varying authentication levels. Our organization does not have--but ...
1
vote
3answers
437 views

Digital Signature and man-in-the-middle

While reading this page about Public-Private key encryption, I asked myself a question about digital signature: Alice wants to sign a message for Bob; she uses her private key to sign the message. ...
0
votes
1answer
321 views

EAP-TLS fragmentation implementation

I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a ...
0
votes
1answer
875 views

PDF Digital Signature [closed]

I got free certificate from Comodo and installed on my Windows. Now I'm trying to sign PDF document using this certificate, but get message: "signature validity is unknown": Why is this? How I can ...
0
votes
1answer
552 views

Testing Digital Signature Verification

I'm testing a system which involves updating a database using files sent from external parties. These files sent from external parties are basically just large flat files to update a database. The ...
2
votes
2answers
237 views

Does SMIME differ from TLS, PGP, DMARC signature, or a Portal Encrypted email message in terms of legal non-repudiation?

I'm interested in protecting email messages from NSA-style snooping, but don't want to incur additional legal risk in doing so. In other words, does SMIME encryption and/or signing cause a given ...
-4
votes
1answer
82 views

Digitally sign all outbound data [closed]

I want to digitally sign all outbound data from my computer. Can someone suggest a way to do this programatically or using some tool? Instead of actually signing the data, I would simply append a ...
0
votes
2answers
397 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
1
vote
1answer
126 views

Digitally sign all the packets from client machine

If I insist on digitally signing all outgoing packets from my computer, would it affect my browsing experience? I mean if a website doesn't expect me to sign my packets, and still I sign them, can I ...
1
vote
3answers
498 views

Public key encryption vs Digital signatures

For same chunk of data, which one is faster? Public key encryption or digital signature? Confidentiality is not important. I am trying to achieve non-repudiation for the communication. Thanks!
1
vote
0answers
95 views

digitally signing a document [closed]

I've been asked to implement digital signatures for documents at work. I really need to read up more on the matter but several searches didn't make an obvious approach stand out. Main features I ...
1
vote
2answers
318 views

RSA-Based Signature Algorithms

From Beginning Cryptography with Java - chapter 4, digital signatures: Signatures are created using the RSA algorithm by applying the RSA algorithm using the private key and then distributing ...
1
vote
1answer
67 views

Trust on certificate authorities

If I as layman don't err, there are in banking controls, from both internal and national oversights, of the work done by the employees. These are apparently effective, since the details of ...
1
vote
4answers
832 views

How to verify full USB drive's digital signature

There are various ways to verify the validity of a file, usually checking the MD5 checksum or OpenPGP signature. Is it possible to do the same for a full USB Drive? I'd like to be able send a USB ...
2
votes
1answer
224 views

Why do I have keys of strangers in my GPG keychain?

I'm going though my GPG keychain. I've got a key for a few strangers in my keychain. I don't recall exchanging keys and I'm not sure how the public keys came to be installed in the keychain. I think (...
4
votes
2answers
240 views

Can the client certificate authentication process treated as a user digitally signed the content(and then get verified on the server)?

The authentication was triggered by certain event (like approving button) on the form. In the process of client certificate authentication (in IIS), user was asked to use their PIN (private key) and ...
1
vote
1answer
198 views

Is this signature methodology secure?

I'm working on authentication for my JSON-RPC API and my current working strategy is using signed requests sent via POST over SSL. I'm wondering if anyone can see any vulnerabilities that I haven't ...
0
votes
1answer
480 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
4
votes
1answer
492 views

Is there an algorithm to generate digitally signed URL links?

Scenario: Alice prepares an URL link to Bob's web service (e.g., http://www.bob.com/sensitiveData/123?login=mallory). Alice gives the URL link to Mallory. Mallory follows the link to trigger an ...
1
vote
4answers
705 views

Can a certification authority sign another CA's certs?

Disclaimer: I have low knowledge of X.509 and PKI, so I would appreciate an answer that is not entirely technical, i.e. by using real-life example scenarios.) I was searching for information about ...
1
vote
1answer
148 views

Is it possible to add backdoor to a file with the same size and crc32 checksum (4bytes)?

Is it possible to add backdoor to a file with the same size and crc32 checksum (4bytes)? (The file does not contain byte code, it contains program code as text. The language is PHP.)
4
votes
1answer
178 views
3
votes
4answers
950 views

Does a PGP signature provide integrity verification?

Many websites including OpenSSL's website provide downloads along with MD5/SHA1 checksums sometimes in addition to PGP signatures for the files. Simply put, do PGP signatures provide file integrity ...
2
votes
1answer
746 views

How to sign data with OpenSSL 0.9.8?

I am building a license generator for nodejs and I am currently testing on Heroku. On my local machine running OpenSSL 1.0.1g, I'm able to test my key pairs (sign and verify) like this: # data.txt's ...
1
vote
2answers
96 views

Is it possible to sign/verify a key-pair?

We currently have the need to authenticate and verify generated keypairs. Our system allows users to register for our service which generates them a key-pair for use on our network. We are in need of ...
0
votes
1answer
308 views

RSA vs ECDSA for VANET Security

I am doing a project on Vehicular Ad-Hoc Network Security (VANET). The proposed scheme uses electronic signature as a means to authenticating the nodes. Most of the research papers I read suggested ...
-2
votes
3answers
71 views

Does HTTPS retrieval, among its other effects, sign a document? [duplicate]

Does HTTPS retrieval, among its other effects, sign a document? I'm asking in hopes of understanding in more specific details what TLS accomplishes. I will try to elaborate my question, as follows. ...
1
vote
0answers
307 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
0
votes
2answers
100 views

Attack Signatures books [closed]

I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on ...
0
votes
1answer
310 views

Digital Signature Software

What is the digital signature software? What it takes to digitally sign software? I'm using the Kaspersky antivírus and the software I wrote, in Delphi, is flagged by the antivirus software due to ...
1
vote
1answer
439 views

What popular online services allow passwordless authentication using digital signatures? [closed]

I am looking for web services that allow clients to authenticate using digital signatures. Especially with e-commerce and payments, clients generally authenticate using name and password (sometimes ...
4
votes
1answer
5k views

Certificate verified using two different paths

StartSSL has an intermediate certificate that they use to sign their EV certificates: sub.class4.server.ca.pem. This certificate's issuer is shown by openssl x509 to be /C=IL/O=StartCom Ltd./OU=...
0
votes
4answers
160 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
2
votes
1answer
1k views

Which mail clients support PGP/MIME - is there an overview? [closed]

Does anyone know if there is a current overview (I only found ones from before 2006) which MUAs (mail clients) do support PGP/MIME? I wonder whether there still exist issues like "Outlook Express ...
1
vote
2answers
947 views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...
1
vote
0answers
63 views

Is the digital declaration just an obscure proposal?

One professor from my university proposed me and some colleagues to work on a paper about the digital declaration (which is supposed to be better than the digital signature) for passing the subject. ...