A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

2
votes
2answers
177 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
1
vote
4answers
77 views

Use GnuPG to verify if specified user signed file

To verify if file is signed correctly we use command: gpg --verify <file_name> and the output shows if file is signed correctly. And if it is, then signer name is shown. But is there ...
0
votes
2answers
1k views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
0
votes
0answers
43 views
11
votes
7answers
2k views

Deprecation of SHA1 code signing certificates on Windows

I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables ...
0
votes
0answers
35 views

DSS digital signing approach

Under the DSS approach to digital signing, what is the advantage of using two pairs of keys for each signature?
1
vote
2answers
52 views

Is it possible to digitally sign an email twice?

User A encrypts an email with the public key of user B and digitally signs it. User B receives this message and decrypts it. B wants to forward it to user C, encrypts it with C's public key and signs ...
16
votes
2answers
549 views

Which factors should I consider for devices that accept handwritten digital signatures?

These days many locations ask you to give your signature on a digital signature pad/device. As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
8
votes
1answer
2k views

ADFS: Verify requests from relying party

In ADFS, serveral certificates are used. This is explained (very clearly) on this page: ...
2
votes
2answers
95 views

Advantage of group signing over single signing

As I know, signing is used to ensure integrity and authenticity of sender. What is the advantage of group digital signing over individual signing? Can anyone explain this using a scenario?
0
votes
1answer
49 views

Different Microsoft-signed excecutables have apparently the same signature!

On Windows 10 systems, I found two versions of bootsect.exe (a Microsoft-supplied utility that writes disk boot sector) with different hashes (SHA-1 9b7463c79460a55a36b53bee0889f894b2379ec3 for one ...
1
vote
5answers
8k views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
6
votes
3answers
776 views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
0
votes
2answers
52 views

PGP vs Hash functions

What is the difference (in terms of security strength) between checking a package' integrity using pgp and hashing functions (i.e. sha256)? Isn't pgp less secure as the verifier must trust the ...
0
votes
1answer
70 views

BLS signature java implementation needed (if possible, along with some example code)

I need to sign a string with the shortest digest possible using regular certificate like X.509. As far as I understand, I will have to transform the string to the sequence of bytes, then sign. After ...
24
votes
4answers
31k views

how digital signature verification process works

I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
2
votes
1answer
23 views

Signing a code and application

I want to send my application to different servers/terminals with content integrity and confidentiality. So, I need to some process to sign my code and application before sending it to servers and to ...
11
votes
1answer
12k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
4
votes
1answer
49 views

What does an OpenPGP signature consist of?

I don't understand how OpenPGP signatures work. I have a picture which I want to sign, and a digital certificate which consists of my name and email address and my public key. Additionally, a digital ...
2
votes
0answers
18 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep ...
9
votes
3answers
290 views

Is this a weakness of enveloped XML signature?

There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course). Let's have a simple XML message with an enveloped XML signature: <?xml ...
0
votes
1answer
69 views

Where in the CSR is the public key?

I am reading http://www.akadia.com/services/ssh_test_certificate.html In step 2 openssl req -new -key server.key -out server.csr server.key is generated earlier using openssl genrsa -des3 -out ...
1
vote
2answers
78 views

Self-signed cert - how it works

I am new to SSL / digital certificates / signatures. What I know is that a digital signature must be verified/decrypted using the public key. So a cert that is signed by a CA must be ...
0
votes
1answer
28 views

Authenticating a user by verifying a signature

Background I'm setting up an API which will be used primarily over HTTPS (only calls not needing any security what so ever is available over HTTP). Some aspects of it need to be accessed only by ...
6
votes
1answer
53 views

Subresource Integrity versus signing

The draft spec for subresource integrity is straightforward: This document specifies such a validation scheme, extending two HTML elements with an integrity attribute that contains a ...
0
votes
2answers
92 views

SSL digital certificate process - high level

I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database. In this case, I have an web server and needs to implement SSL ...
4
votes
1answer
406 views

multiple authenticode signatures

Is it possible to have multiple Authenticode signatures in an executable? The Digital Signatures tab suggests you can, so I was wondering if, for example, you can sign an executable with Verisign's ...
3
votes
1answer
169 views

Make signed file from content file and its detached signature?

I have a text file which I will call filename.txt. Firstly I call gpg --output filename.asc --clearsign filename.txt Signed file filename.asc is created. Then I call gpg --armor --output ...
1
vote
2answers
33 views

RSA blind signature vs signing a hash

My understanding is that the key feature of a blind RSA signature is that the signer is unaware of the contents of the message being signed. How is this different from simply hashing some data and ...
2
votes
1answer
176 views

Microsoft and SHA-1 deprecating on Windows 7

Microsoft states: Effective January 1, 2016, Windows (version 7 and higher) and Windows Server will no longer trust any code that is signed with a SHA-1 code signing certificate and that ...
3
votes
2answers
56 views

Sign a callback URL

I have a Single Sign-On system that works this way : User clicks link on clientsite.com that redirect him to mastersite.com?returnTo=http://clientsite.com If auth is valid, the user is redirected ...
2
votes
1answer
36 views

what is worth a digital signature based on email address only? [closed]

I have noticed that most digital signature providers do not try to certify anything but an e-mail address, while it is quite easy to create an email address without disclosing any personal ...
4
votes
2answers
77 views

Why would some Windows executables not have a “Digital Signatures” tab?

Why would some executable on a Windows 7 system not have a "Digital Signatures" tab? (With this question I am referring to those executables that are not part of Windows OS and to which the ...
3
votes
0answers
24 views

Can I do an enveloping XAdES signature on binary content?

I need to sign some binary content (scanned documents) with a digital signature compliant with European norms, CAdES - XAdES. One option would be to use this library to do a XAdES signature. Is there ...
5
votes
2answers
93 views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
2
votes
1answer
169 views

Managing/Deploying a code signature certificate - Java Applet

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the ...
3
votes
1answer
44 views

Verification of a timestamped PDF

I'm kinda new to the process of timestamping files to provide digital integrity. For testing purposes, i use tsa.safecreative.org for PDF files. Now i've signed a couple PDF files and if i open up ...
3
votes
0answers
54 views

How does a Sign tool work?

My basic understanding about sign tool is: 1.It loads the zipfile(may be exe,jar,ddl,apk..) which has to be signed to its memory(cache memory of the sign tool). 2.It will verify it, and unzip the ...
3
votes
2answers
78 views

Client side signing of a file(.exe,.dll,.jar..) using CA issued certificate and signtool [closed]

In a current project we have purchased certificate from a trusted CA and have installed in a host, sign tool is also installed in the same host. All the files which we develop(jar,dll,apk,exe etc..,) ...
2
votes
1answer
65 views

Correct way of signing and verifying a message

I have an object which I need to transmit to clients and I need the clients to know that I actually created the object. Obviously, this process involves in me signing the object with my private key, ...
14
votes
3answers
15k views

License key / Serial number generator and checker

I need a serial number generator and accompanying checker. I would like to be able to set a salt (and maybe a length). The generator should only produce serial numbers that pass the test of the ...
0
votes
1answer
17 views

Standard digital signature data representation

I am creating digital signatures using various scheme, e.g. RSASSA-PSS. The result is bytes that represents signed data with private key. I would like to store signature as a standard data ...
1
vote
0answers
45 views

CMS signed data OpenSSL verification error

I have a CMS signed data that is successfully verified through Java BouncyCastle library. When trying to verify through OpenSSL, I am getting the following error: >openssl smime -verify -inform ...
15
votes
3answers
4k views

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure because if the key is compromised or ...
2
votes
1answer
75 views

Strategy for electronic document (PDF) signatures

I'm treading into the murky waters of electronic document signatures, and I'm having trouble figuring out the right approach to deal with my requirements. I think this should be pretty ...
1
vote
3answers
242 views

Digital signatures and truly validating what was actually agreed to

I am developing an application and part of signing up requires a user to sign a contract agreement of using the service. I have been reading around the subject for a few days, and I am fairly happy ...
59
votes
5answers
17k views

Why should one not use the same asymmetric key for encryption as they do for signing?

In an answer to a question about RSA and PGP, PulpSpy noted this: It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for ...
0
votes
1answer
33 views

For X.509 Certificates where is the actual digital signature?

When you open up the certificate information from your browser and go to the details tab there is a bunch of information for various certificate fields. I am wondering which field contains the actual ...
0
votes
5answers
157 views

How to make sure nobody has read this!

Is there any computer/server which would allow me to get "guaranteed read access history" for files? For example, suppose I made a file with my plaintext passwords and simply wanted to make sure that ...
2
votes
2answers
77 views

Is this a secure Digital Signature + Encryption method?

I am trying to wrap my head around Digital Signatures and how RSA Encryption supports them. And which order to do them along with what specifically to encrypt. So say we have Alice and Bob and a ...