2

I'm new to the world of digital signatures and encryption and I'm trying to learn more.

I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital signature or not.

I've thought of a scenario in which:

  1. A user creates login credentials (username, password and PIN code). The password and PIN are used to create a private key.

  2. The user tries to login via username & password. The password is compared to the one stored in the database and used to generate a key, which is also to be compared. If both match, then the user can login.

Does make any sense or should a public key be used?

  • I think you are confusing password hashing with digital certificates. They are related but different. The private key is normally as random as possible, but accessed using the password hash comparison. I would suggest Wikipedia which may help you frame your question better. Try "Digital Certificates" to start, but you may need to read a few articles. – Stone True Nov 21 '15 at 15:23
2

Client: I wanna login!

Server: Okay. Here's a piece of data. Do something to it that only you could do!

Client: Okay. Here 's your data back. I've added a signature with my secret key.

Server: Lemme just check ... Okay, welcome in!

This is a less than formal description of a challenge-and-response authentication protocol that uses signature. ;)

1

For authentication using a digital signature, browser should send digitally signed auth token (say UserID:Password) or JWT etc, to server and private key for digitally signing login request may come from USB Token or smartcard connected to user's browser.

For Authentication from Browser using Digital Signature, one such free Chrome extension available is Signer.Digital chrome extension. (Disclosure: Provided by my Company). Local system (host running behind the chrome browser on windows) setup may be downloaded from https://download.cnet.com/Signer-Digital-Chrome-Extension/3000-33362_4-78042540.html Installing this host and restarting Chrome will automatically add Signer.Digital Chrome Extension

Javascript to call method from extension:

To Register Certificate on Server:

//Get Selected Certificate Information 
SignerDigital.getSelectedCertificate()
    .then(
        function (CertInfo) {        
    //Success returns Certificate Subject and Thumbprint
        },
            function (errmsg) {
                //Send errmsg to server or display the result in browser.
              }
     );

To authenticate or Login using Digital Signature:

SignerDigital.signAuthToken(authToken, "SHA-256")       //or "SHA256"
    .then(
        function (SignData) {        //Success returns Signed Auth Token
        },
            function (errmsg) {
                //Send errmsg to server or display the result in browser.
              }
     );

If Failed: returns error msg starting with "SDHost Error:"

The same Browser extension may also be used for Digitally Signing PDF File from Web Browser

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.