Tag Info

New answers tagged

4

You can sign with both PGP and S/MIME. Contrary to Oliver Schmidt's response, it is possible to create an external signature using PGP (you can sign any file with a PGP key, not just text - a executable (.exe) is not a good candidate for inline signatures). This is referred to as "PGP/MIME". An external signature on a PGP file will be *.sig and S/MIME will ...


4

To make a long story short: Yes, that will work and it will make sense, too. I'll try to explain this: PGP stores the signature inside the email body. The body of a PGP-signed mail usually begins with -----BEGIN PGP SIGNED MESSAGE-----, followed by the hash algorithm and the message clear text, followed by -----BEGIN PGP SIGNATURE-----, followed by ...


2

No, your update process is flawed, and anybody trying to comprimise it will succeed. I assume you are not using TLS/HTTPS, as you don't mentioned them in your question. That's why: Your public key is to be obtained from the Internet This allows the attacker to intercept the connection and provide a tampered public key. All your verification process was ...


0

No. An attacker can make a binary. They can then make a hash from their binary, and encrypt it with their private key. They then package their binary and supply the malicious binary, public key to the camera. Because the attacker is able to supply the public key and the content, he controls both sides of the check and the system is easily compromised. At ...


-1

I want to produce a signal such that when a cell phone enters that area, I must get all the specifications of that device. That's not how cell phone signals work. Can I do it? Nope. Which signal is good? I don't think this question has a correct answer.


0

The main application of message recovery in digital signature schemes is: You save space. You can sign a message and don't have to send it, just the signature, so you're saving (up to 1 keysize) bytes of transmission. However there are reasons why it's uncommon to use digital signature with message recovery: DSA family of signatures don't support it -> ...


2

From what I'm understand, what you're trying to do is to verify, after you are sure that the page arrived from the network untouched (since it's TLS), that it has not be modified by any client-side malware. Since it's a client-side malware, it's safe to presume it can change anything he wants on the client side, after the session is decrypted from the TLS ...


1

Stumbling upon this email made everything clear (as well as glancing at RFC3156). The email is of type multipart/signed which The multipart/signed body MUST consist of exactly two parts. The first part contains the signed data in MIME canonical format, including a set of appropriate content headers describing the data. The second body ...


1

When a Director sends an Agent with id (A) on a mission, he generates a timestamp (B) and an HMAC of A and B (C), using his secret key. He gives B, and C to the Agent. C becomes the secret key of the Agent. When an Agent sends a message, he calculates an HMAC of it (D) using C and includes it in the message. He also includes A and B. C is of course secret ...


0

To me, the main reasons are related to key management, rather than cryptographic security per se. For asymmetric crypto, especially the period during which you want a public key to be valid may strongly depend on the intended use of that key. For example, consider a system in which a component must authenticate itself towards other components. Next to ...


0

if someone tampered a factory recovery partition to target you, I would doubt if it is wise to buy a second-hand computer to work with. To answer your question, yes the recovery partitions are usually signed. but to check them is somewhat difficult as different resellers might package different version of pre-installed software in the recovery partition, so ...


0

The data in the cert is hashed and the hash is sighed with C's private key. C's public key is in the cert. All of this is hashed and signed by a CA's key. Changing the subject changes the hash, the new cert is bad without even verifying the first signature.



Top 50 recent answers are included