A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

-1
votes
0answers
22 views

DNA Encryption and Digital Signature [on hold]

I am working on DNA based encryption.Does using DNA encryption for digital signature is better to achieve non repudiation than conventional techniques
0
votes
0answers
7 views

How to resign a pdf after changes are made - Adobe Acrobat Pro X [migrated]

I need help updating the time stamp on my signature. I prepared a document, signed it, sent it for review, received comments back, and made some changes. Now I would like to resign the document with ...
2
votes
3answers
58 views

Does a certificate authority use different private keys?

I was wondering whether a CA has different private keys to sign certificates with? Is there a risk of crypto-analysis (or something similar) when a CA signs thousands of certificates with the same ...
1
vote
1answer
60 views

How is a root certificate revoked?

I know that CAs use intermediate certificates to mitigate the impact of potentially having to revoke a root CA (i.e., the need to update all browser clients on peoples computers allover the world). ...
56
votes
9answers
9k views

Proving creation time/date of a screenshot

I have to produce a screenshot of a web page, and want to make sure others will know without any doubt that this screenshot has been produced today. That is, I would like to embed today's date in the ...
-1
votes
1answer
31 views

In what order are digital certificates verified?

I understand how digital signatures work and how they are verified, but in what order does the CA verify each of the attributes of the digital certificate such as version, issuer, validity etc..? Any ...
0
votes
0answers
10 views

How does XAdES-X-L compare to RFC4998 Evidence Record Syntax

This SE question describes a scenario I don't fully understand the use case or how 4998 can help correct the issue. How and when should XAdES-X-L be used, and where should RFC4998 be used?
-1
votes
0answers
17 views

An alternative to Echosign with certificate support? [closed]

I'm trying to find some business-friendly solution for digital signature circularization, capable of signing documents using external digital certificates. While Adobe EchoSign-like software does ...
1
vote
1answer
20 views

Regarding Openssl.config file: What is the importance of policy matching when creating a self-signed certificate with the aid of this file?

When trying to go through some material for self-signing a certificate, one of the steps required me to set policy conditions in this config file. See: https://www.phildev.net/ssl/opensslconf.html ...
-4
votes
0answers
30 views

Free or Open Source Digital Signature solutions [closed]

What are some open source or free digital signature solutions that can be used by an organisation?Kindly provide the links and API documentation in case of an open source solution.
1
vote
1answer
51 views

What issues exist in generating a signed, paper-based PGP message stored by a hostile organisation?

I have recently been the victim of having my medical record tampered with by the organisation holding it. Under state law I have a legal right to submit information to be included in my medical record,...
0
votes
1answer
134 views

Algorithms for transaction authentication

It's unclear to me how transaction signing and transaction authentication work. Industrial solutions use both symmetric and asymmetric algorithms to compute the signature. What does RSA add the ...
5
votes
3answers
2k views

Digital Signature and Verification?

AFAIK , When Alice wants to write a message to Bob -- she uses Bob's public key and encrypt the message - and then Bob - using his private key - use to decrypt it. So public key is used to decrypt ...
0
votes
0answers
18 views

Reuse key to encrypt signed content

I am developing an application which generates JWT tokens which are signed using HMAC-SHA256 algorithm during their generation and later on encrypted using Fernet library. Since the signing and the ...
67
votes
5answers
20k views

Why should one not use the same asymmetric key for encryption as they do for signing?

In an answer to a question about RSA and PGP, PulpSpy noted this: It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both)....
-1
votes
2answers
72 views

How does digital signature algorithms work in a private / public key environment?

From the Wikipedia page on the subject, I get, on a theoretical level, how the process of encrypting and decrypting a message works. The article states that: In a public-key encryption system, any ...
3
votes
2answers
491 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
0
votes
3answers
31 views

How do you check the signature of a signing program (ex. GnuPG) if there is no native version installed? [Catch 22]

If you downloaded a version of a signature verification program that might have been modified, you naturally check its signature. But what if you have none such program to check it (whose signature ...
1
vote
1answer
25 views

How to create a ring signature?

While reading the Off-the-Record-Messaging paper by Nikita Borisov, Ian Goldberg and Eric Brewer, I came across the idea for "ring signatures" which allow a member of a group to sign a message in the ...
15
votes
7answers
10k views

Deprecation of SHA1 code signing certificates on Windows

EDIT (7/7/2016) - see addition at the end of post I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables (http:...
2
votes
0answers
27 views

TLS 1.2 ECDHE_RSA signature [migrated]

I'm currently working on a Java TLS server. I'm trying to get the following CipherSuite to work : TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA When I test it using openssl s_client I get the following error ...
9
votes
3answers
18k views

What is the difference between an electronic signature and a digital signature

From Wikipedia: An electronic signature, or e-signature, is any electronic means that indicates either that a person adopts the contents of an electronic message, or more broadly that the ...
2
votes
1answer
67 views

How do digital signatures on PDF documents work?

I recently filled out a PDF document which required me to append a digital signature. The PDF document had a link embedded in it that I clicked and went through the process. I am curious how this ...
0
votes
0answers
89 views

eIDAS - list of certified qualified electronic signature creation devices

In eIDAS there is written in Article 31: On the basis of the information received, the Commission shall establish, publish and maintain a list of certified qualified electronic signature ...
0
votes
0answers
15 views

GPG4Win - How to read/unsign .txt file to see a proper text message after signing only file

I sign a file of sha 256 checksum of one file for test. I choose only sign options with OpenPGP certificate only...This textfile looking like this: ...
-2
votes
1answer
141 views

What scenarios really benefit from signed JWTs?

UPDATE: I have concluded my research on this problem and posted a lengthy blog entry explaining my findings: The Unspoken Vulnerability of JWTs. I explain how the big push to use JWTs for local ...
1
vote
1answer
46 views

Should I verify installer file PGP hash?

Let's say that I'll download an installer for a program on Windows and the publisher has released PGP Signature for the file. The installer file does not have any code signing certificates. If I ...
0
votes
2answers
37 views

How to convert a SSL certificate to an authority?

How can one convert an SSL cert provided by an authority to another authority, so one can generate "valid" certs for different domains?
-2
votes
4answers
70 views

How is the private key kept secret in digital signatures?

A digital signature is verified using an algorithm that takes three inputs: the message, the digital signature (message encrypted with private key)* and the public key. If the public key is used to ...
3
votes
0answers
78 views

How does a Sign tool work?

My basic understanding of how a sign tool works is: Load the zip-file (may be exe, jar, ddl, apk, etc.) which has to be signed to its memory (cache memory of the sign tool). Verify it and unzip the ...
2
votes
0answers
15 views

Signtool validation fails when signing and validating are done in different machines

I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
2
votes
2answers
57 views

Asymmetric key encryption that can have a public decryption key, but encryption key cannot be computed from that [duplicate]

Is there a way where I can distribute a public decryption key, but the encryption key cannot be computed from that key, so that anyone who reads one of my encrypted message, he/she can be quite sure ...
0
votes
0answers
15 views

Digital Signature on a Passive RFID tag with small-ish memory constraints

I'm pretty new to the crypto and security worlds and I'm looking for some guidance. Briefly, my project involves Widgets (physical items that need to be authenticated) and Gadgets (physical machines ...
17
votes
2answers
4k views

Does my PGP key really need to match the e-mail address for which I'll be using it?

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
0
votes
2answers
37 views

Can an RSA signature be changed given the public key?

If I were to post on a forum (with potentially malicious administrators) my public RSA key and a small string of text that was signed with the corresponding private key, could someone with access to ...
3
votes
2answers
84 views

Useless 2FA in case of inside attacker

Suppose a server-side signing scenario, where user keys are generated in a HSM and exported to a database, encrypted with a symmetric key derived from a user password and HSM's master key. To sign, ...
1
vote
2answers
53 views

What are the technical implementation differences between signature-based scanning and heuristic-based scanning?

Signature-based scanning works by comparing something to a database. So does this basically amount to scanning a file x for string foobar? I know heuristic-based scanning can detect new threats that ...
2
votes
3answers
140 views

Are there any systems to mitigate the risk of losing a Signing Key?

I want to design a system that hinges on ECDSA. All messages are signed using the algorithm, and this is used to prevent spoofing. However, if a user were to somehow lose control of their key, they ...
66
votes
3answers
12k views

Why shouldn't I bring a computer to a key-signing party?

I'm looking at the event description for the key-signing party at an upcoming BSD conference, and it's mentioned that I shouldn't bring my computer in to the event: Things to bring no ...
0
votes
1answer
35 views

git file signing with eID

Background story; government issues new IDs (eID) which can hold certificates and you can sign documents with it, using card reader and some software that signs document itself (while I do research ...
0
votes
1answer
49 views

Why is CBC-MAC insecure for variable length input?

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Like the highlighted parts in following pictures Slide 32: Slide 33:...
1
vote
1answer
155 views

Digitally signing a document with your public/private keypair without certificates?

I have generated a private/public key pair using gpg. Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead ...
0
votes
1answer
111 views

Why would I need to use the PRIVATE key to verify a file signature?

I use JavaScript to open CAPICOM store to choose certificate. After that I export selected certificate, public key and private key of that certificate and put them in three hidden fields. var ...
3
votes
2answers
61 views

What are the benefits to adding a bitcoin blockhash UID notation to one's OpenPGP key?

Example: Notation data: blockhash@bitcoin.org 000000000000000011d9f6931e65f814c6f3b221736b0c45f25e0365a3d156fa As seen here: https://sks-keyservers.net/pks/lookup?op=vindex&search=...
1
vote
3answers
66 views

Does digital signature really ensure data integrity?

Suppose attacker knows public-key of sender. He can make his own private key derived from public-key of sender. Then he can alter message and sign it with his private key. Probably I'm missing the ...
2
votes
0answers
45 views

Algorithm to generate (and verify) string of 4 quad alpha numeric code

I am writing a system, for which I need to generate unique transaction numbers (which can be verified by myself). I want to use something similar to that used by credit cards, where a string of the ...
42
votes
2answers
10k views

Why are hand-written signatures still so commonly used?

Why are hand-written signatures still so commonly used? Can they actually prove anything? Two assumptions: If anyone wants to forge my signature I'm sure they will be able to do it. Even my own ...
15
votes
6answers
24k views

What does “key with length of x bits” mean?

I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
0
votes
1answer
153 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. I am wondering if the code signing certificate (the “final cert”) must already be in ...
0
votes
1answer
32 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...