Tag Info

New answers tagged

0

So, what's the point of the signature file, is there any drawback to just signing the manifest directly? JAR files follow RFC822 specification (same thing for ZIP files). That is a good point that this process obeys to a standard. Given this fact, not the complete list of the files contained within a JAR file are listed in the manifest file you ...


2

Ask the owner of the information if they authorize the request. As Neil Smithline points out in his excellent answer to this question, the RFCs on JWT, OAuth, and many other token-based authentication systems rely on the end user maintaining the secrecy of their token. For me personally, this is a hard pill to swallow: a lot of end users don't understand ...


3

In one sentence: you have to trust the client to use TLS and generally protect the token. Like many token systems, JWT relies on the client to secure its token. Clients are already required to maintain credentials needed for authentication (eg: passwords) so this is not a radically different concept. Furthermore, JWTs typically have a much shorter ...


0

Best way seems to use a code signing certificate from a well-known CA. Since well-known CA certificates are already trusted by Client (browser, OS), there is no need for additional maintenance with this setup. Java Applet & Web Start - Code Signing states that ...Users will be better protected by maintaining up-to-date versions of the JRE on ...


1

It depends on what whether you really mean the "most trustworthy". As with many aspects of digital security, there is a sliding scale of strength / reliability vs usability / feasibility. I think some important questions to consider are: Who are your users? To what extent do they care about proof of file integrity? Even if the users don't care, how ...


1

You already have your answer on methods to demonstrate integrity. Any of those techniques are as "trustable" as the entity implementing them is. Perhaps what you meant to say was "most appropriate"? Assuming this is your homework question: A user transfers several files to a destination, and wants to prove that the files have not been altered in ...


0

If I understand your question properly you are asking whether when a certificate (and private key) is used to sign or encrypt data, does that certificate contain the allowed algorithms for that signing or encrypting? The answer is not really. Outside the specific type of public-key crypto implemented in the certs (usually RSA), you can integrate them with ...


1

Yes, creating an internal PKI infrastructure is often very complicated and insecure unless many different issues are understood and handled correctly. See Selenog's answer for more information. Because of these reasons, it is typical that only government agencies and large companies build a PKI infrastructure from the ground up. In this regard the dream of ...


0

There has been some interest of late in using the Bitcoin Blockchain for alternative uses such as this. Information written to the blockchain is digitally signed, irrevocable, and timestamped. See: http://www.latimes.com/business/la-fi-cutting-edge-blockchain-20150809-story.html ...


6

Big certificate authorities use the same technology (mathematical principles) for their certificates as you would when using an internal CA. So from that standpoint there is no disadvantage. However a CA needs to do more than just sign certificates: Deliver the root certificate to the end-users thrust-store. Big CA's have their root certificate shipped ...


2

No, you're not missing anything. Current processors for desktops and laptops are just ridiculously fast. OpenSSL is a native application that can make most of that. In general CPU speed on laptops is not much of an issue. It can be an issue on embedded devices of course. Or on higher level languages. Or when latency is very important (e.g. authentication of ...


0

To be honest, I was expecting larger amount of time to verify the keys 1: Let us say the client is you and the server is this website: The process involved before you get the final response to be able to use this website obeys to a PKI infrastructure where the TLS handshake protocol (where RSA, DSA, AES ... can be evolved) simplified is something ...


4

The EBICS financial protocol (European alternative to SwiftNet) can be a pertinent real life example. It uses three certificates respectively for authentication, signature and encryption. Most (if not all) banks use three different certificates. However the official protocol specifications allows the use of the same certificate for authentication and ...



Top 50 recent answers are included