Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

Openssl NID to IANA value

I am trying to parse the signature algorithm off a certificate using Openssl's APIs. Currently I am using the X509_get_signature_info function to get the hash/digest nid and the pkey nid. However, ...
1
vote
0answers
37 views

INTEL-SA-00086 extracting the secret key used to encrypt Intel CPU code: is the digital signature bypassed?

In a recent attack to INTEL-SA-00086, the researchers are able to extract the secret key that encrypts updates to various Intel CPUs. In the arstechnica blog it is mentioned as The key may also allow ...
1
vote
0answers
24 views

New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key

I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu. I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
2
votes
2answers
129 views

Certificates(CA certificate and EE/Local certiificate)

There is a small confusion related to CA certificate and Local certificate. I had asked a similar question before. This time, its a little specific. For authentication using PKI, below are the steps. -...
19
votes
6answers
4k views

Is there a protocol that provides data integrity, but not encryption for HTTP?

HTTP I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed. HTTPS On the other hand, HTTPS sends encrypted text over the network that can ...
0
votes
0answers
34 views

APK file code signing -managing keys

We are developing an android app marketplace platform for connected lighting. 3rd party developer use our SDK to write android app and submit it in the portal and the end-user downloads the app and ...
8
votes
3answers
2k views

What happens when I encrypt something with my RSA Public Key?

I know encrypting something with my private key is used for signing. To prove that the message is indeed coming from me. But what about if I sign something with my public key? That would mean that ...
0
votes
1answer
106 views

Prove Alice Had Sent the Message Before

Alice just sent a message to Bob, but prior to that she had already sent the very same message. How can Bob prove that?
3
votes
0answers
114 views

Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?

I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1) Basically, ...
0
votes
0answers
35 views

Does a signing provider has my private key (digital signatures)

For my essay im writing about digital signatures. Lets talk about an advanced digital signature which works with PKI (private-public key infrastructure). For example, im using ValidSign or GlobalSign ...
0
votes
1answer
68 views

Main Reasons for GPG over hashing for verification

I have recently been introduced to GPG signing as a better way of verifying data than hashing. It was described that if you posted the hash of the file, someone could hack your website, alter the hash ...
1
vote
1answer
51 views

How to list all of the known root keys in docker (Docker Content Trust)

How can I list all of the Docker Content Trust root keys on my system? I am setting up a CI process that will use the debian:stable-latest docker image to build my application's releases in ephemeral ...
0
votes
2answers
96 views

openssl verify error: unable to get local issuer certificate

I have a test certificate chain that I generated and it fails the openssl verify command: openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem The output I get from the ...
0
votes
0answers
28 views

What is the difference between domain certificate and document certificate

I saw some certificate providers offer different certificate types like code signing, document signing, so the question here what would be the difference between a domain certificate and document ...
1
vote
2answers
70 views

Identification through digital signature. How safe is it?

Let's say I want to give some data to Bob. I have his public key. I tell him to generate a digital signature for text "{some_stuff: 1, nonce: 2}". After he does that and after I verify it's ...
1
vote
1answer
117 views

Is certificate signature encoded to ASN.1 format?

I'm working on a diagram to describe the process of issuing digital certificates, with the help of answers on my question here and some other research: I just read in the IETF that: The ...
9
votes
4answers
1k views

What's the point of providing file checksums for verifying downloads? [duplicate]

Many projects offering binaries, also offer hashes (e.g. SHA256) of those binaries, wither as .ASC files, or directly on the web page near the binary. This isn't to protect against network-caused ...
0
votes
0answers
59 views

What prevents me from using a some server's public key and impersonate another server [duplicate]

I read alot regarding RSA encryption/DH key exchange/digital signatures and the whole TLS protocol. There's something i am missing regarding the public key signatue validation. Let say some website ...
2
votes
1answer
292 views

How is public key included in the CSR?

I've read a lot of articles on the PKI and digital certificate topics because it's very rare to find one article covers all the aspects; also the topic is confusing at the beginning, (this beautiful ...
2
votes
2answers
97 views

How to pass both passphrase and password in GPG signed symmetric encryption?

I am new to GPG so I may be going about this all wrong. I have some files I would like to encrypt symmetrically using AES256, but I want to sign them with my GPG key. I need to automate this process ...
2
votes
1answer
111 views

How to authenticate an Add-In on interprocess communication?

We are considering to build a Windows application that is split in 2 parts: one Windows service some Add-Ins for Microsoft Office, Microsoft Management Console (MMC) and PowerShell. Additional info: ...
0
votes
1answer
33 views

Secured Software Update from an unauthenticated entity

Let's suppose we have a software update D, that is encrypted and signed and delivered to some component C. Further we suppose that the receiving entity C can validate the signature and decrypt the ...
2
votes
1answer
112 views

Validity, Owner Trust, Trust Signatures & Certification Level

Two questions on signatures. I am trying to understand the various types of "trust signature". The man page says, "For more information please read the sections “Trust Signature” and “...
1
vote
0answers
75 views

Examples of SSH key exchange algorithms requiring encryption-capable host keys

In the SSH spec, Section 7.1, key exchange algorithms are distinguished based on whether they require an "encryption-capable" or a "signature-capable" host key algorithm. If I ...
2
votes
0answers
42 views

What's the purpose of signatures in Google Maps APIs?

There's something I don't understand about signatures in Google Maps APIs. The documentation says "We strongly recommend that you use both an API key and digital signature, regardless of your ...
1
vote
0answers
47 views

Signing event-stream responses

I am working on an application where the general approach is signing most response payloads with HMAC, but there are a couple of endpoints that return text/event-stream in the response. What is the ...
0
votes
1answer
60 views

control digital signing

What is the secure way to support dev mode and production modes on embedded systems that support digital signing. Dev mode will skip signature verification.
0
votes
0answers
34 views

Authenticating Adobe .pdf electronic signatures

Having created a certificate for electronic signing within Adobe Acrobat DC, can I authenticate documents signed using it by issuing a signed paper statement to recipients stating that it would be ...
0
votes
2answers
71 views

How is the digital certificate sent alongside digital signatures?

Most tutorials on the net only mention sending the digital signature attached to the document, but without the digital signature certificate, it'll be impossible for receivers to verify the signature. ...
0
votes
2answers
51 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
0
votes
2answers
104 views

Sign records in a database [closed]

I have a table in my database where I store records to be processed later (basically orders that need to be invoiced or something similar, but this is not the important part). Since this software runs ...
1
vote
0answers
63 views

Why does PGP create a signature from plaintext?

From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and ...
1
vote
0answers
320 views

Why does keycloak use HS256 algorithm to sign access token when client settings specify RS256?

I have the following setup with a keycloak authentication server and an application: user logs in on application client side, send un/pw to server application server sends un/pw to keycloak server ...
-1
votes
1answer
43 views

Digital signature from hashing encrypted webpage

I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...
0
votes
1answer
91 views

Who am I really trusting?

My trusted root certificates are below. As an exercise, I want to be sure that a MITM is not changing the list. So, can I somehow get this list signed? In my opinion, the list could be signed by my ...
5
votes
1answer
418 views

Validating an Ed25519 public key

Is it possibly to test if an Ed25519 public key is valid without having access to the private key, a signed message or anything except the public key? "Valid" as in "Not just 32 random bytes". I'm ...
0
votes
0answers
21 views

How do i produce keypairs for my users while implementing json web token

I want to check the integrity of my user information; that the information which my website server receives was indeed sent by them. From what I understand, json web tokens (jwt) is the way to go. I ...
0
votes
1answer
84 views

Signing HTTP requests with JWS

Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say,...
0
votes
2answers
69 views

How to “trust” data that is posted from one application to other

We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
0
votes
2answers
56 views

How to establish a secure channel with authenticated and authorized access to a remote entity

I have the following problem: There are 3 parties A, B and X. X is holding 2 entities on behalf of A and B. A communicates with X to operate it's own entity. B also communicates with X to operate ...
5
votes
3answers
1k views

Why is a hash sent with data secure?

Hash values are also useful for verifying the integrity of data sent through insecure channels. The hash value of received data can be compared to the hash value of data as it was sent to determine ...
0
votes
2answers
35 views

Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?

As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
0
votes
0answers
66 views

How does jarsigner -verify work?

Every jar file contains a MANIFEST.MF file containing a hash for every file. With jarsigner -verify you can verify a jar file, but what are the steps taken to verify a signed .class file in a jar? I ...
0
votes
2answers
91 views

What if an attacker gets access to public key through an insecure media in digital signature?

If A encrpyts the message and creates signature using his private key and sends through the network then only B with the public key of A can decrypt that message. But what if the attacker gets access ...
2
votes
1answer
89 views

How misappropriation-resistant are common deployed signature formats?

Given an RSA signature as produced by openssl dgst -sha256 -sign rsapriv.pem -out afile.sig afile and without access to the private key used for that, one can¹ come up with a fully functional RSA ...
2
votes
0answers
431 views

Openssl cms verify signature with timestamp and crl

I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
0
votes
0answers
55 views

Whonix Image Download Bad Signature

Using gpgtools on MacOS, I have attempted multiple times to verify the signature of the Whonix image. I get: $ gpg --verify-options show-notations --verify Whonix-*.ova.asc Whonix-*.ova gpg: ...
5
votes
1answer
118 views

Does signing of HTTP requests have any benefit when using TLS?

Signing HTTP requests is all the rage nowadays. The benefits of doing so when communicating over an insecure channel are clear. With signatures you can bring message integrity and authentication to ...
2
votes
1answer
269 views

API request signing best practices

I am reading how different services are handling API signature and authentication. Particularly I was looking at: AWS Signing v4 WeChat Signature Algorithm Alipay Digital Signature Google Maps API I ...
2
votes
0answers
36 views

Authentication and authorization of a subrequest

A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...

1
2 3 4 5
16