Tag Info

New answers tagged

2

The point of code signing is to prove that the program is from a particular, presumably reliable, source. Typically a CA based certificate ensures that some identity verification has been done so you have a fairly high degree of trust that the code is from the person who signed it. You can self-sign, which will still prove that it was released by the holder ...


5

In order to tell the end user that the YOU are the actual owner of the app, you MUST buy a certificate from a trusted third party (a party which is also trusted by Windows). These third parties are called Certificate Authorities (CA). Here's how you can get a certificate from a CA (according to MSDN). How the end user will know its from him, not from me. ...


1

Be careful, you should not confuse keys used for encryption/decryption and keys used for signature, since there usage is different. So the key couple A-pub/A-priv is used for signature only, while the key couple B-pub/B-priv is used for encryption only. Be also careful that you should sign the ciphertext and not the plaintext, otherwise having the hash of ...


2

You are technically wrong when you say "signed the virus". the CA NEVER signs any code. What CA can do, is issue a code-signing certificate. Then the MAKER of the virus do sign the code. This means the CA never see the code and you can't really blame the CA for issuing a code-signing certificate. The Point of a code-signing certificate, is to bind the code ...


0

It was signed by a certificate of the famous and trusted Comodo company. One of the interesting aspects is that the variant of the malware discovered by security researchers is apparently signed a few hours before the campaign was launched, with a valid digital certificate from Comodo, which makes it more difficult to detect on the affected ...


0

The answer to this question depends on whether point trust certificates are being used or not. A point trust certificate is one that is not issued by a trusted Certificate Authority, but is instead trusted in its own right. Typically these would be provided to the relying party out of band (i.e. using a different method of delivery to the one used for the ...


1

The problem you are outlining is not a problem with digital signature per say, but is part of a bigger problem with establishing identity in PKI systems. A digital signature on some data proves (assuming that your digital signature algorithm is secure) that this data has not been altered except by whoever holds the matching private key. You still need to ...



Top 50 recent answers are included