A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

28
votes
11answers
1k views

Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
31
votes
2answers
5k views

Why are hand-written signatures still so commonly used?

Why are hand-written signatures still so commonly used? Can they actually prove anything? Two assumptions: If anyone wants to forge my signature I'm sure they will be able to do it. Even my own ...
0
votes
1answer
24 views

Algorithms for transaction authentication

It's unclear to me how transaction signing and transaction authentication work. Industrial solutions use both symmetric and asymmetric algorithms to compute the signature. What does RSA add the ...
1
vote
1answer
35 views

Are there theoretical attacks against ECC Digital Signatures?

I was asked to do a research about attacks on various digital signature schemes. There is one thing that bothers me for which I could not find a direct answer. For digital signatures that are based ...
6
votes
3answers
687 views

How can I prove that I wrote a certain blog post?

I would like to be able to prove that I wrote the article that resides at a given URL on someone else's blog. Is there a way that I can do this with public key cryptography? I know a bit about the ...
0
votes
2answers
32 views

SHA1 - S/MIME and CRL validity after deprecation?

In an internal PKI using SHA1 for hashing, will S/MIME signature and CRL/ARL signature be considered invalid in the next few years (SHA1 Deprecation) ? End certificates can be revoked, CA ...
2
votes
1answer
468 views

ADFS: Verify requests from relying party

In ADFS, serveral certificates are used. This is explained (very clearly) on this page: ...
0
votes
2answers
37 views

Certificates - What about signing again Intermediate CA certificates?

I an thinking about this issue and it is hard to estimate technical impacts. For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by ...
9
votes
4answers
10k views

How do the processes for digital certificates, signatures and ssl work?

I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication. Server has a digital certificate acquired from a CA. It also has public and ...
-1
votes
2answers
71 views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
0
votes
1answer
48 views

PKI - Security concerns when changing a certificate hash algorithm

Suppose I want to change the hash algorithm used for a certificate signature (ex: SHA1 to SHA2). Is it better to revoke the previous certificate and issue a new one with expected hash algorithm ? Or ...
3
votes
2answers
61 views

Corporate PKI - SHA1 deprecation

Here is the context. Suppose you have a corporate PKI with : AC_Root (offline in safe store - SHA1 signature) SubRootA and SubrootB (offline in safe store - SHA1 signature) SubSubRootC, SubSubRootD, ...
0
votes
1answer
33 views

Is there a way to verify a signed XML in Java

.NET has this great way to sign and then verify the signature of an XML file. Is there a way in Java to verify an XML file that .NET has signed this way? thanks - dave
-2
votes
2answers
42 views

TLS - Are signatures still needed?

The story: I'm currently writing a web service that allows for communications to be made remotely via TCP/IP. I first thought about signing each packet using HMAC-SHA1 with a password, appending the ...
1
vote
1answer
93 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...
2
votes
1answer
35 views

What is 0xXXXXXXXX.asc.sig and how can I generate this?

When I am exchanging PGP keys with someone, I receive the regular 0xXXXXXXXX.asc file and regularly receive a file called 0xXXXXXXXX.asc.sig. What is this file? How can I generate one and send it ...
1
vote
1answer
54 views

Use of safe prime in RSA digital signature scheme

For the RSA digital signature scheme , Alice has a pair of public and private keys as denoted by Public key : (e,n) Private key : (d,n) Assuming Alice wants to send a message M to Bob , she would ...
1
vote
1answer
36 views

Using salt or secret for Hmac

I'm working on a web API. We are going to use Hmac256 for signature hashing. From what I can gather, the secret is a key used to initialize the hash algorithm (ie to generate a random number). The ...
11
votes
3answers
9k views

License key / Serial number generator and checker

I need a serial number generator and accompanying checker. I would like to be able to set a salt (and maybe a length). The generator should only produce serial numbers that pass the test of the ...
1
vote
1answer
49 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
3
votes
1answer
129 views

Can Fiddler decrypt HTTPS traffic when using elliptic curves + client cert authetication?

Case 1 involves TLS + client certificate authentication with both client and server using secp384 based EC certificates. In this case, when monitoring traffic via fiddler, the tunneling/handshaking as ...
1
vote
1answer
52 views

Would it be possible to verify ownership of digital currency without a network connection to an authority server?

Lets imagine the Fed start registering digital USD for use in offline e-wallets, and they figure out a way to make it so that only registered wallets can make transactions. Without an online ...
2
votes
1answer
64 views

Why are PGP signatures not more widely used as an authentication method?

Example: Bob generates a key pair for this example. Bob registers at example dot com where he provides his public key. When Bob will try to log in, example dot com will ask him to sign a random ...
0
votes
2answers
102 views

MS-Word and Digital Signatures

We would like to digitally sign DOC (MS-Word) and PDF documents using PKI. Is this possible using an internally deployed CA? I've found lots of articles getting email digitally signed but almost no ...
0
votes
1answer
15 views

What are valid OpenPGP revocation signature types?

I'm working on an analysis of the full OpenPGP keyring (ca. 3.8 million keys). I imported all keys to a local instance of hockeypuck (keyserver implemented in go). Hockeypuck uses a PostgreSQL ...
2
votes
2answers
98 views

Code Signing Confusion

I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. ...
0
votes
1answer
67 views

Understanding Digital Signature

I have just learned Digital Signature and am trying to ensure that I have got my understanding of Digital Signature on the correct track. Assume Alice wants to send a message (M) to Bob where the ...
1
vote
2answers
508 views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
0
votes
2answers
76 views

is Digital Signature vulnerable on the Internet?

We all know about how Digital Signing works. I just have some questions about vulnerability risk. At first, As I know, the Signature and the Data are separated and we can split the document into two ...
6
votes
1answer
141 views

How do systems protect against a stolen code-signing certificate after the certificate expires?

Imagine this scenario: 1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp. 15th December 2014 - the certificate is revoked. Malware will be prevented from ...
10
votes
2answers
234 views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
2
votes
1answer
73 views

What does verified file in windows mean? And does it guarantee related files?

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g Microsoft) or in other case, unknown publisher. I know public key encryption can ...
0
votes
3answers
51 views

Adding a “comment” to PGP mail signature files?

I have started signing my mail with PGP, and it attaches the file signature.asc to my messages to verify that I sent them with content, as you'd expect, like this: -----BEGIN PGP SIGNATURE----- ...
2
votes
1answer
60 views

Is there any asymmetric scheme provides signature with length of 30 bytes?

I want to send short messages to cell phones.Commonly a short message is no longer than 70 bytes. I need 20 bytes or more holding information and the rest bytes are for signature provided by ...
3
votes
3answers
101 views

What are you saying when you sign a PGP key?

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address? To explain what I mean, take the following two ...
0
votes
0answers
14 views

Does this show the proper results for signing an XML file

I did the following use this (sign) and this (verify) example on MSDN. Here are the results of all this (don't worry, I will delete the below key and generate new keys, on a different system); XML ...
3
votes
1answer
71 views

Will PGP signed email be blocked in China?

I generally sign all of my outgoing email with PGP. I don't usually encrypt it because most people I send mail to don't have a public key. Anyway, if I send an unencrypted message with a PGP signature ...
2
votes
2answers
185 views

PGP/GPG verifying authenticity

My boss recently implemented a new security system related to PGP/GPG. The whole idea behind this is to sign files so that people know from who they came. They don't require us to encrypt them, just ...
10
votes
2answers
2k views

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure because if the key is compromised or ...
1
vote
0answers
55 views

Verifying the owner of a signing key

I'm using elliptic curve cryptography (curve25519 and ed25519) for key exchange and signing. The signing and key exchange keypairs are independent. I need two users to be able to verify each other's ...
2
votes
3answers
132 views

Why are apps signed?

From the Android website: Android requires that all apps be digitally signed with a certificate before they can be installed. The signature ensures that only the original developer can publish ...
0
votes
0answers
89 views

Application Privilege Control in Kaspersky blocks program with no digital signature

I made a small application that displays hello world to the console output and attempted to open it in another computer that had Kaspersky fully updated. When I ran the application, Kaspersky gave a ...
0
votes
0answers
21 views

Installer digital signature timestamp inconsistency

I just noticed that the digital signature on an old installer EXE is expired (it's LibreOffice from May 2013, and I'm pretty sure it was valid when I installed it). Investigating further, the time ...
3
votes
2answers
341 views

Why is a CSR hashed?

What are the use cases for defining something other than the default SHA1 hash in a CSR? Is it to protect the digital signature, public/private keys? What is it protecting exactly?
2
votes
1answer
222 views

How does signing work with Elliptic Curve Crypto?

So I have read up and have a decent understanding of how the crypto works with Elliptic Curve Cryptography. I also think I have an understanding of how signing works with things like Elliptic Curve ...
1
vote
2answers
106 views

Are digital signature algorithms subject to the same types of attack as public-key encryption algorithms?

I understand that digital signatures are usually implemented by encrypting a message digest with a private key, decrypting the resulting signature with a public key, and verifying that the message ...
2
votes
1answer
72 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
4
votes
2answers
562 views

Does Authenticode still work offline and with a “fake” certificate

Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
1
vote
2answers
72 views

Is it Possible to use one commercial SSL Certificate to issue end user certs?

My organization is preparing to purchase some 50 "units" from Symantec, with which we can purchase Verisign SSL certificates of varying authentication levels. Our organization does not have--but ...
0
votes
2answers
91 views

Typical mistakes when implementing digital signatures?

I am looking for a list of typical mistakes someone can make when implementing digital signatures for a software. And of course why they are mistakes and how an attacker could take advantage of them. ...