A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

0
votes
1answer
47 views

How to verify the signature of DHE_RSA server parameters (TLS 1.2)?

By reading the TLS 1.2 specs I have been able to manually decrypt/encrypt pretty much all the steps of a TLS connection (DHE_RSA_AES_CBC_128_SHA cipher suite). One of things I am missing is how to ...
2
votes
2answers
437 views

PKCS#1-1.5 encoding - is there a reason to use 00 in block type?

For encryption block looking like this: EB = 00 || BT || PS || 00 || Data where BT - block type and PS - padding string, I've read that we use three types of BT - 00, 01, 02. Now, since 00 and 01 are ...
0
votes
0answers
10 views

Digital Signature - PKCS#7 Response

I have a long xml-style string which looks like this: MIILhMIILhAY......H9WH9W Task given to me is to digitally sign a pdf document. Is there a tool (like jdk keytool or openssl etc) which I can use ...
3
votes
2answers
51 views

Signing Double Submit Cookies, where the value is a pseudo random string and a signature of it. Is this more secure?

I'm not sure if I am describing something that has already been proposed. If not, I would like to coin this "Signed Double Submit Cookies" as a method to improve the Double Submit Cookies technique ...
0
votes
1answer
21 views

Hashing and signing partial data in payload

I'm hashing and signing part of a payload prior to HTTP Posting from a mobile device to server side. The payload contains of about 7 data elements and only 3 of them are hashed/signed using a private ...
0
votes
1answer
20 views

How secure is it to bundle unencrypted private key and a CSR into PKCS12 certificate?

I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, ...
1
vote
0answers
25 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
7
votes
2answers
758 views

How do systems protect against a stolen code-signing certificate after the certificate expires?

Imagine this scenario: 1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp. 15th December 2014 - the certificate is revoked. Malware will be prevented from ...
4
votes
2answers
63 views

Signature that can only be verified by author and recipient - without pre-shared key

Desiderata: Alice wants to send a message to Bob for him to keep and to be able to refer to, such that Bob can be certain that the message came from Alice and was not tampered with. Alice also ...
0
votes
1answer
49 views

Digitally signing a document with your public/private keypair without certificates?

I have generated a private/public key pair using gpg. Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead ...
0
votes
1answer
19 views

Verify a key was signed by another key

I began using GPG4Win/Kleopatra, the GNU Privacy Guard implementation for Windows. More recently I wanted to verify a download of Qubes OS, for which a guide is offered here. They describe a master ...
3
votes
2answers
74 views

Signing the Recovery Partition

Do any computer manufacturers sign (DSA, or just publishing a hash) their recovery partitions so that I can be sure that these bits are authentic? I'd like to buy a second-hand computer and reduce ...
1
vote
1answer
36 views

Why timestamping chain is better than “code signature” chain?

Timestamping is recommended as the way to prolong signature validity after its certificate expiration date. One just need to add new timestamp signature before previous timestamp is expired. But ...
0
votes
0answers
26 views

Few questions about verifying a DLL signature?

i have few questions about verifying a file's certificate. The use case is as follows: i have a DLL file that contains a resource i need. I'm signing the file with a code-signing certificate, and ...
0
votes
1answer
112 views

Algorithms for transaction authentication

It's unclear to me how transaction signing and transaction authentication work. Industrial solutions use both symmetric and asymmetric algorithms to compute the signature. What does RSA add the ...
6
votes
1answer
65 views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
1
vote
2answers
32 views

What are the technical implmentation differences between signature based scanning and heuristic based scanning?

Signature based scanning works by comparing something to a database. So does this basically amount to scanning file x for string "foobar" ? I know heuristic based scanning can detect new threats that ...
2
votes
2answers
299 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
4
votes
3answers
72 views

Are document signature services violating any rule by exposing PII over clear email?

A company sent me a document to sign via CudaSign, I did. As soon as I completed the transaction, I got a PDF over email with the document attached. The document includes my SSN. I assume, the ...
3
votes
0answers
39 views

Is there a cryptographically secure way to verify the date of a process? [duplicate]

I have a few git repositories of content that will be updated constantly over the next decade. At some point down the road I anticipate being asked to prove that the content was actually in the state ...
3
votes
1answer
41 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep ...
20
votes
3answers
4k views

Does OpenPGP key expiration add to security?

I've created a new OpenPGP key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised ...
1
vote
1answer
40 views

Is it possible to give legal value to signed web services?

The context is using digitally signed webservices (with XML-DSIG for example) for e-government interoperability between databases. The idea is to give endorsement to both the data publisher and the ...
2
votes
0answers
34 views

Out of band signature application for banking transactions

I work on a banking signature project. Signing transactions must be carried out on another application to respect the mechanism "Out Of Band". When the user makes a transaction, he must pass to a ...
4
votes
2answers
83 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
0
votes
0answers
13 views

Symantec/Verisign CA problem to install the intermediate certificate [migrated]

In order to sign/encrypt Email I have installed Verisign S-Mime Certificate from Verisign and exported it from IE as a .pfx (PKCS #12). My problem is when I tried to import it in Security > My ...
3
votes
2answers
79 views

Is signing android apk file with SHA1 digest secure enough?

Google command line example for signing apk files: $ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name source: ...
1
vote
2answers
54 views

understanding client certificate - pfx on the general

Today I am given a pfx and told to access a website. I have absolutely no idea what was given to me initially, so please kindly confirm my understanding on a general level 1) the pfx is a container ...
2
votes
1answer
31 views

Does it matter how information is represented prior to signing?

I have messages that will form a permanent record and be stored for a long time. I care about integrity, authentication, and non-repudiation, so I intend to have the clients creating those messages ...
0
votes
2answers
39 views

Files related/required to a digital certificate

I am new to digital certification and I am trying to understand it as well as get my domain certified. I know this question may be broad, but can someone give me a general idea of the usage of the ...
2
votes
1answer
49 views

Signing web forum messages

I maintain web forum software, which is accessible via NNTP and e-mail (as mailing lists). Since NNTP by design allows anyone to spoof their e-mail address, message signing can be used instead to ...
4
votes
1answer
23 views

Best practice: Should I revoke an identity self-signed using SHA1?

When I first created by PGP keypair, my identity was unfortunatly self-signed using SHA1. I later signed again using SHA512. Does it make sense to revoke the SHA1 signature now or will that just ...
5
votes
1answer
373 views

self-signatures using SHA1

This page says: self-signatures must not use SHA1 You can check this by doing: gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep ...
7
votes
2answers
107 views

Verifying cryptographically signed files when the key has been revoked

This is mostly a question out of idle curiousity. If I use my private key to sign a file today, forming a signature, and distribute that signature with the document to someone they can then use my ...
0
votes
1answer
44 views

Authenticating a user by verifying a signature

Background I'm setting up an API which will be used primarily over HTTPS (only calls not needing any security what so ever is available over HTTP). Some aspects of it need to be accessed only by ...
0
votes
2answers
131 views

is Digital Signature vulnerable on the Internet?

We all know about how Digital Signing works. I just have some questions about vulnerability risk. At first, As I know, the Signature and the Data are separated and we can split the document into two ...
0
votes
0answers
27 views

Secure transfer with proxy person in the middle

I am new to cryptography, so I would like some validation. I have an unusual use case that I haven't found described anywhere and would like to get some help validating my approach. Alice needs ...
3
votes
2answers
49 views

GnuPG does not verify signature while decrypting

I have signed file 1.txt, result file is 1.txt.asc. I changed content in file 1.txt.asc (signed content, not signature). Then I verify signature in 1.txt.asc and I get information that signature is ...
5
votes
3answers
154 views

Are documents truly “signed” by DocuSign?

I've never been happy with the explanation DocuSign gives for themselves in their own marketing material (e.g. ...
1
vote
4answers
157 views

Use GnuPG to verify if specified user signed file

To verify if file is signed correctly we use command: gpg --verify <file_name> and the output shows if file is signed correctly. And if it is, then signer name is shown. But is there ...
3
votes
0answers
12 views

How can I improve and secure automated signing?

Automated signing of files, such as software packages or file backups, is inherently risky if a certain level of trust is given to it. Having signing be an automated process means that there's no user ...
1
vote
3answers
123 views

Authenticating user in same sub-domain using cookies

We have few in production websites say site1.dom1.com , site2.dom1.com , site3.dom1.com which are just replicas working on different server. Now we want to extend some application on another server ...
6
votes
2answers
854 views

How does an attack on a digital signature work?

In our IT Security class we have been told that you need CA's to prevent attacks on a digital signature. Sadly, our docent didn't elaborate how such attack would be performed - I can only guess that ...
3
votes
2answers
108 views

Advantage of group signing over single signing

As I know, signing is used to ensure integrity and authenticity of sender. What is the advantage of group digital signing over individual signing? Can anyone explain this using a scenario?
2
votes
2answers
117 views

Self-signed cert - how it works

I am new to SSL / digital certificates / signatures. What I know is that a digital signature must be verified/decrypted using the public key. So a cert that is signed by a CA must be ...
7
votes
1answer
71 views

Subresource Integrity versus signing

The draft spec for subresource integrity is straightforward: This document specifies such a validation scheme, extending two HTML elements with an integrity attribute that contains a ...
1
vote
2answers
1k views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
0
votes
0answers
48 views
14
votes
7answers
7k views

Deprecation of SHA1 code signing certificates on Windows

I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables ...
0
votes
0answers
39 views

DSS digital signing approach

Under the DSS approach to digital signing, what is the advantage of using two pairs of keys for each signature?