0

I have 2 text files used by an application. One is a very large "schema" array (approaching 100,000 lines, JSON format). The other is a .txt.sig file generated somehow from the contents of the schema file, which is used as a check by the application to verify the schema file's composition.

If you modify even one character in the schema file, it is detected as corrupt based on the contents of the signature file.

Is there any way to determine how the .sig file contents are generated from the plain text without some sort of key? I would like to create a new .sig file that matches up with a modified version of the schema file for tinkering purposes.

I can link to the Schema file if there is any possibility based on the info I have. It's too large for Pastebin or else I would include it here.

Thanks in advance for your input.


Contents of cipher text:

ᅝ雐喐弱㿤쪓鐒✉桦Ⲍ垧㇓鋳쓿㚣�뼀⭥켟ಾ퍋薨슥紙缏ிㄾࣻ탕㕾潎쭲㥊귕헔譗䢲鳐ᴍ畽៦뺎瑎쾩鵘嵘貔⨣Ṩᷢ추퐅踥믟顱ꎨ浈軰岗

  • What output is produced if the schema is an empty zero byte file? Often this result can allow for narrowing down the behaviour, if the source code is unavailable and the digest isn't salted. – LateralFractal Oct 16 '14 at 2:32
  • Should your "Is there ... of key?" question be parsed as "Is there any way to [determine ... plain text] without some sort of key?" or "Is there any way to determine [how the ... without some sort of key]?"? i.e., do you have reason to believe that no key was involved? – user49075 Oct 16 '14 at 2:42
  • If I were to empty the schema file or change it, the .sig file isn't modified along with it. When the application is launched it simply checks the schema file based on the contents of the .sig file, and aborted if the schema file is found to be modified. If I change the .sig file it says I have an invalid sig file. If I change the schema it says I have a corrupt schema file. Don't know if a key is used or not, in fact I'm not sure of much of anything other than the fact that these two text files involved. – user58755 Oct 16 '14 at 2:50
  • Here is the Schema file. scribd.com/doc/243176986 – user58755 Oct 16 '14 at 6:49
  • Unicode characters ᅝ雐喐弱㿤쪓鐒✉桦Ⲍ垧㇓鋳쓿㚣�뼀⭥켟ಾ퍋薨슥紙缏ிㄾࣻ탕㕾潎쭲㥊귕헔譗䢲鳐ᴍ畽៦뺎瑎쾩鵘嵘貔⨣Ṩᷢ추퐅踥믟顱ꎨ浈軰岗 – user58755 Oct 16 '14 at 6:51
1

Although you are not explaining what the verification process is, it looks like the .sig file is a digital signature, guaranteeing data integrity, authentication and non-repudiation: it means that, as long as the verification is affermative, anybody knows that the file hasn't been changed by a third party, and that the signer signed the file, with no uncertainty (the verifier knows the identity of the signer). The signature uses a hash function (public) and a private key (by definition, non-public). Then, if you want the verification process still working after your changes you should ask the signer to digitally sign the changed file, producing a new .sig file. No other person can do that, unless the private key of the signer is broken.

Of course you could digitally sign the changed file by yourself and get a new .sig file: in the case, the verification will work, but the verifier will know that the signer is you, and not the original signer.

All the above features are built-in in the digital signature, by design.

A fair description of digitally signing can be found here: https://en.wikipedia.org/wiki/Digital_signature In many cases it is based on a hashing function of the SHA family is used (https://en.wikipedia.org/wiki/Secure_Hash_Algorithm) with the RSA cryptosystem (look for it on wikipedia, stackexchange is saying I can't post a 3rd link)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.