A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

0
votes
1answer
41 views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
2
votes
1answer
33 views

How to sign data with OpenSSL 0.9.8?

I am building a license generator for nodejs and I am currently testing on Heroku. On my local machine running OpenSSL 1.0.1g, I'm able to test my key pairs (sign and verify) like this: # data.txt's ...
1
vote
2answers
47 views

Is it possible to sign/verify a key-pair?

We currently have the need to authenticate and verify generated keypairs. Our system allows users to register for our service which generates them a key-pair for use on our network. We are in need of ...
0
votes
1answer
90 views

RSA vs ECDSA for VANET Security

I am doing a project on Vehicular Ad-Hoc Network Security (VANET). The proposed scheme uses electronic signature as a means to authenticating the nodes. Most of the research papers I read suggested ...
24
votes
10answers
824 views

Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
0
votes
0answers
17 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
-2
votes
3answers
50 views

Does HTTPS retrieval, among its other effects, sign a document? [duplicate]

Does HTTPS retrieval, among its other effects, sign a document? I'm asking in hopes of understanding in more specific details what TLS accomplishes. I will try to elaborate my question, as follows. ...
1
vote
0answers
28 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
1answer
31 views

Is long-term validity definitively corrupted upon TSA certificate revocation?

Suppose a document that was signed with a long-term signature (e.g. CAdES-A): D S T1 (D - document, S - signature, T1 - time-stamp created using a time-stamping certificate C1). If C1 appears in the ...
0
votes
2answers
33 views

Attack Signatures books [closed]

I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on ...
0
votes
1answer
35 views

Digital Signature Software

What is the digital signature software? What it takes to digitally sign software? I'm using the Kaspersky antivĂ­rus and the software I wrote, in Delphi, is flagged by the antivirus software due to ...
1
vote
1answer
62 views

What popular online services allow passwordless authentication using digital signatures? [closed]

I am looking for web services that allow clients to authenticate using digital signatures. Especially with e-commerce and payments, clients generally authenticate using name and password (sometimes ...
2
votes
1answer
56 views

Certificate verified using two different paths

StartSSL has an intermediate certificate that they use to sign their EV certificates: sub.class4.server.ca.pem. This certificate's issuer is shown by openssl x509 to be /C=IL/O=StartCom ...
0
votes
4answers
42 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
1answer
60 views

Which mail clients support PGP/MIME - is there an overview? [closed]

Does anyone know if there is a current overview (I only found ones from before 2006) which MUAs (mail clients) do support PGP/MIME? I wonder whether there still exist issues like "Outlook Express ...
1
vote
2answers
95 views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...
1
vote
0answers
45 views

Is the digital declaration just an obscure proposal?

One professor from my university proposed me and some colleagues to work on a paper about the digital declaration (which is supposed to be better than the digital signature) for passing the subject. ...
0
votes
3answers
127 views

Is it ok to send user's private key away, even if protected with a SSL channel?

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
3
votes
1answer
317 views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ? (I was told ...
1
vote
1answer
59 views

Digitally signed scripts as a way to thwart XSS

As a blanket approach to dealing with XSS attacks, rather than having to remember to escape user-generated code, is there a way to instruct the browser not to execute any script or script-function ...
1
vote
1answer
60 views

valid PDF signature without using hardware HSM or usb Token

I have a DMS system(alfresco) that needs to sign approx 50.000 valid signatures a year. The signing certificate needs to be acquired from one of the affiliated sub-CA's. So according to the Adobe CDS ...
6
votes
1answer
85 views

Reading older mails signed with a certificate that has meanwhile expired

A few years ago I have used S/MIME certs to sign (and encrypt) my mails. The reason for which I stopped signing was the following: My (class 2) cert was issued on Jan. 1st 2008 (just a sample). It ...
16
votes
8answers
9k views

Why do people still use/recommend MD5 if it is cracked since 1996?

It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996 Therefore we suggest that in the future MD5 should no longer be implemented in ...
0
votes
1answer
33 views

How to modify a certificate using getTBSCertificate() method

I want to show that if I modify one bit or byte from a given X509 certificate the signature verification results false (because this modification results different hash value from the certificate). ...
3
votes
1answer
57 views

Internal code-signing certificate on Windows

I'm looking to improve defense-in-depth on a system, primarily by closing some holes in injected DLLs. Certain applications installed on the system cause helper DLLs (e.g. shell extensions, BHOs, ...
3
votes
3answers
933 views

How to sign & timestamp log or zip files?

I think I can easily sign the files however I also need a timestamp from 3rd party vendor. I want to digitally sign + stamp log files including DHCP & mail because of laws here. UPDATE: I found ...
1
vote
3answers
316 views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
1
vote
0answers
77 views

How to check executable code signing signatures?

How can I see all code signing signatures an executable has? I know that requests for a tool are usually considered as opinion based, but I really can't find one and I don't expect many answers. ...
0
votes
3answers
53 views

How to verify full USB drive's digital signature

There are various ways to verify the validity of a file, usually checking the MD5 checksum or OpenPGP signature. Is it possible to do the same for a full USB Drive? I'd like to be able send a USB ...
-1
votes
2answers
79 views

Digital signatures and truly validating what was actually agreed to

I am developing an application and part of signing up requires a user to sign a contract agreement of using the service. I have been reading around the subject for a few days, and I am fairly happy ...
11
votes
3answers
327 views

How are private keys handled in an enterprise?

We would like to start using digital signatures and possibly encryption for e-mails in our company. My knowledge of public-key cryptography is entirely theoretical with no practical experience. In ...
3
votes
1answer
92 views

How online document signing services guarantee non-repudiation?

There is a number of services online like RightSignature or SignHub that will let you sign online legally binding documents. I understand how documents can be signed digitally and this can guarantee ...
9
votes
7answers
428 views

Authencity of information displayed on an untrusted device

Suppose I have a (bluetooth/usb) device which needs to displays information on an external pc/phone. Is there a simple and effective method to garantuee that the information displayed hasn't been ...
0
votes
1answer
51 views

Proof of quantum safety of the Merkle signature scheme

The Wikipedia article about the Merkle signature scheme claims that it is very adjustable and resistant against quantum computing. What proof is there of this?
1
vote
1answer
71 views

Ideal cryptocurrency digital signature

What are the characteristics of the ideal digital signature for cryptocurrency transaction verification? The reason I ask is because this answer about bitcoin signatures describes a potential ...
-1
votes
4answers
205 views

Is it possible to digitally sign information with a password?

I'm creating a cloud storage service and need to have the ability to provide reliable security for clients. In my previous question, I used a different schematic and said I would post a new question. ...
1
vote
1answer
114 views

Signing session cookies

The Play Framework for Scala has support for signed session cookies. In the application configuration file is an "application secret" that is set as a secure random number when the application source ...
2
votes
3answers
192 views

Can a zero knowledge proof of voting be made using a trusted auth server (without client side crypto)?

Questions: Can one implement a secure voting system having all the features described below? e.g. without disclosing any individual's vote to the government server (or the third party), preserving ...
3
votes
6answers
191 views

Does an email signature increase security?

I'm using Thunderbird with Enigmail. It has both encrypt and sign options for sending PGP emails -- but why is an email signature needed? It just looks overkill to me! Alice and Bob can use PGP to ...
-1
votes
1answer
101 views

DSA Generates different signatures with the same data [closed]

I'm using the example given in msdn article about the DSACryptoServiceProvider Class. The problem is that I get a different signature each time I run the code. I tried OpenSSL and didn't get this ...
0
votes
2answers
138 views

How to detect authenticity Of Client and Server Certificate?

How its possible to detect authenticity Of Client and Server Certificate. For example, If server A has certificate and someone C stolen its certificate and send it to B then How we decide that it's ...
1
vote
4answers
243 views

Evil certificate authority in public-key-infrastructure

Alice goes to the certificate authority (CA) and registers her public key for signature verification. She gets a certificate for this from the CA. Bob requests Alice' public signature verification key ...
0
votes
1answer
99 views

What protection certificates would be required for an application that consists of setup, loading utility and main application?

Say we have an InnoSetup installer script, a native C++ QT files loading application and a .Net client application that we load/update each time and which is the main application. We load files via ...
14
votes
4answers
9k views

how digital signature verification process works

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
0
votes
2answers
81 views

Subdomain-only SSL security/availability

CAcert and StartSSL both only validate domains whose TLD is owned by the requester. I have a few subdomains that come from places like freeDNS that I would like to run an SSL-secured server on. Are ...
3
votes
3answers
308 views

Is there an attack that can modify ciphertext while still allowing it to be decrypted?

Is there any way an encrypted file using AES-256 could be modified without alerting the file owner, ie., so it can still be decrypted with the same key? I know that without an initialization vector ...
0
votes
2answers
378 views

Digital Certificate “Signature and Fingerprint”

What's the difference between Digital certificate's signature and fingerprint (thumbprint) ? I know that Signature: The actual signature to verify that it came from the issuer. and Thumbprint ...
1
vote
2answers
96 views

How to sign and encrypt mails using firefox

There is an option under Tools>options>Advanced>Security Devices. How to use that to encrypt and digitally signed your emails.
1
vote
1answer
90 views

Using secp256k1 and ECDSA with IKE

I just tried using an IKE daemon and EC certificates. I used the secp256k1 curve for key generation. The daemon claims signature scheme ECDSA-256 not supported by private key Now I am wondering ...
1
vote
0answers
104 views

Implementing OAuth flow in JavaScript

I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing ...