Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
1
vote
1answer
37 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
1
vote
3answers
67 views

Benefits of signing a random number?

Is there any benefit to signing a random number? E.g. a link for password reset, sent to email, often includes a base64 encoded random number to prevent someone guessing what the password reset link ...
0
votes
1answer
30 views

Accept a https connection with invalid certificate and validate the certificate before. Is it possible?

I will integrate with a new application on the next weeks. But something that was told to me by the partner team was very strange. The partner ask us to pass one .CSR file with our company ...
1
vote
1answer
63 views

Example of something that WYSIWYS tries to prevent

Wikipedia's article on WYSIWYS is very brief, and says: It is relatively easy to change the interpretation of a digital document by implementing changes on the computer system where the document is ...
3
votes
2answers
101 views

What is the best strategy for handling a compromised private key within the domain of firmware?

I have a firmware project that uses asymmetric cryptography for assuring integrity and authority of updates. The private key is stored within the company, and the public key is on the firmware to ...
2
votes
1answer
38 views

Why sign SAML authentication requests

In SAML, signing or encrypting the assertions seems to be essential, but I'm not finding much information describing any benefits or drawbacks of signing the authentication request in real world "...
0
votes
1answer
46 views

How to obtain body from RSA signed document without verifying signature?

According to my understanding of computational cryptology, the body of a signed document can be retrieved disregarding whether or not the signature is authentic. However, I cannot apply this ...
5
votes
3answers
1k views

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Let we have a hash function that is second preimage resistant but not collision-resistant. Then an adversary can create a pair of different messages M and M', M is benign and M' is malicious, for ...
0
votes
1answer
71 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
0
votes
0answers
7 views

Kernel Mode Driver Signing using Self Signed Certificates [migrated]

Can anyone help me in signing the .sys files for windows 7 64 bits? I have created the self signed certificates using Openssl and I want to sign the the .sys files with that certificates using ...
0
votes
1answer
67 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me his S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not a ...
1
vote
1answer
49 views

Who should create the keys?

I'm trying to implement a Software deployment & updating function which is part of AUTOSAR AP standard. Background information: There are three parts. Integrator the client which user uses it ...
0
votes
1answer
65 views

How can I apply message digest to the application so that user can validate the accuracy and completeness of the software [closed]

I have developed the application and now it's time to distribute to my users. I was reviewing my application and reading security best practises and found below statement in one of the article. ...
0
votes
0answers
62 views

How to solve this digital signature problem [closed]

I was wondering if it's possible to achieve the following with any cryptographic technique: A set of persons generates a public/private key pair and everyone registers their public key in a public ...
0
votes
1answer
146 views

How to communicate Credit Card details to customers when instantly approved in PCI-DSS compliant way?

Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the ...
1
vote
3answers
85 views

What is the advantage of using a digital signature over simple asymmetric encryption?

If you're sending me a message, you can: a) Encrypt the message using your private key, and I can decrypt is using your public key. b) You can create a digital signature of your message, and then ...
18
votes
3answers
5k views

Can attackers change the public key of certificate during the SSL handshake

The communication is not encrypted during the SSL handshake. If an attacker conducts a man in the middle attack between server and client to capture the certificate, and change the public key in the ...
1
vote
1answer
65 views

What use does verifying a file with a signature downloaded from the same server have? [duplicate]

Now, I understand how PGP signatures work and why they can be useful to check if a file has been manipulated but this has always bugged me, if I download a file from a site/server, and read: "...
0
votes
0answers
41 views

Offline code signature verification scheme

Assume that I want to sign digitally updates for an offline appliance (lets say a limited linux VM). To begin with, such mechanism is not in place and the very limited OS doesn't have any CA ...
1
vote
3answers
135 views

Is a cryptographically signing camera possible?

What kind of digital / cryptographic signing would make it possible to create a camera that cryptographically signs the photos it takes so that the images can be verified to have been taken with that ...
29
votes
2answers
4k views

Can you sign using a digital certificate itself?

Googling I saw several lectures saying that it is possible to sign using digital certificates. I am confused about that, because according to my knowledge it is possible to sign only using the private ...
1
vote
1answer
99 views

Some digitally signed pdfs shown as verified in the pdf viewers while others are not [closed]

I have two pdf documents: 1 - My class 10 marksheet issued by the CISCE that I downloaded through digilocker. 2 - My Domicile certificate issued and downloaded from the aaplesarkar website. Both ...
1
vote
2answers
116 views

Can a document be digitally signed multiple times, successively by different users?

The question is, if a document that is collaboratively edited, one user per time, could be digitally signed by every editor before it is passed to the next editor. And if yes, could the final receiver ...
0
votes
1answer
92 views

Signature of a root certificate - CA authority

Created a root certificate(cacert.pem) and tried viewing the content to primarily understand the contents of certificate, mainly the signature appended to certificate. Below is the text output of ...
2
votes
0answers
142 views

Can I sign with two Code Signing certs to build reputation on the newer one?

I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon. Obviously, the new certificate has no ...
4
votes
1answer
171 views

Is it possible to use WebAuthn for digitally signing documents in the browser?

WebAuthn is a relatively new API for authentication, and it uses public key cryptography instead of something like passwords. I am wondering if it is possible to use the cryptographic part for a ...
0
votes
1answer
139 views

How do digital signatures work - beginner's explanation?

I'm new to cryptography, and I'm confused about digital signatures. How do they work? Please illustrate with an example in a way that a beginner can understand.
1
vote
1answer
80 views

What happens if the private key of a Trusted Timestamp Authority is compromised?

what happens if the private key certificate of a Trusted Timestamp Authority used to sign the timestamps is compromised? If this private key certificate is changed, should all timestamps be re-signed ...
0
votes
0answers
82 views

Windows Smart Screen pops up after EV Code Signing

I am code signing my application's installer using an EV Code Signing that we have bought recently at work. The code signing is performed when the installer is created using Inno Setup (version 5.6.1)....
0
votes
2answers
70 views

How to keep track of file authenticity while offline

I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his ...
3
votes
1answer
63 views

Why isn't the record of a TLS data application exchange signed by the server?

I am inspecting the TLS(1.2) protocol, and I notice that after the key exchange (handshake), data applications flows from server to client freely (because they have the session key). However, I ...
0
votes
0answers
35 views

Protect transaction counter agains roll-back attack

I am designing a application which should be used for transaction processing so required very good performance. There are requirements that transactions originating from the same client must have ...
0
votes
0answers
75 views

What prevents the client from changing the signature in files?

From what I can tell, some software licenses work client side. For example, when looking in to the purchased software for the first time, the server will return a software license. In order to ...
0
votes
1answer
80 views

How do AV vendors select malware signatures?

AVs use signatures to identify malware which are often strings of bytes or regular expressions thought to be unique to that malware. Do reverse engineers select these signatures by hand or do they use ...
1
vote
0answers
169 views

What is the difference between PKCS#7 and CADES, PADES and XADES?

I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
1
vote
1answer
67 views

How to protect file integrity and history containing counters

I would like to create a solution that would sign the data and will have a increasing counter so I can track the number of signatures. One of the requirement is to have an increasing order of ...
0
votes
0answers
36 views

Cracking signing and HOTP blackboxes

If there are these blackboxes, both are using algorithms which are considered secure yet: Blackbox will sign any message, no limit for messages to be signed. Blackbox will generate 8‐digit HOTP code ...
0
votes
1answer
42 views

Server to Server Communication RSA or x509 Certificate

I want to build Server (My) to Server (Other Client parties) web service and I want to add security layer for client verification. Do I need to force clients to create x509 Certificates or RSA key ...
1
vote
2answers
130 views

What's the point of a digital certificate for which no private key exists?

I am only using digital certificates to sign documents, and my understanding is that the correct flow is the following: create a private key (e.g. using openssl) create CSR using the previously ...
2
votes
1answer
143 views

Why is validating the integrity of the plaintext necessary in addition to validating the integrity of the cipher text?

Reading the iOS Security Guide's description of the iMessage encryption protocol I'm trying to figure out why they included a mechanism for verifying the integrity of the plaintext as well as ...
5
votes
1answer
82 views

Is there a file system allowing read-only access enforced by cryptography

Is there a file system standard (like LUKS) that allows anyone who can plug in the hard drive to read files, but requires a passphrase to modify or write? For example, I can do something similar by ...
1
vote
1answer
192 views

How do I create a detached plain text signature?

If I use gpg --detach-sig file, then I get a small file.sig, but it is not plain text, so this is not useful if you wish to send the signature in a plain text format. If I use gpg --clearsign file, ...
0
votes
0answers
20 views

How to understand: digital key encryption, public key decryption in Digital Signature? [duplicate]

How to understand: the sender in the digital signature encrypts the message digest private key and sends it to the receiver. The receiver then decrypts the public key. We say that asymmetric ...
1
vote
3answers
227 views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
3
votes
1answer
87 views

Using same algorithm for signing and encrypting a message

If we use the same algorithm to encrypt and sign a message, what can happen if the message is intercepted and read by a third party?
0
votes
1answer
67 views

What does “probabilistic algorithm with random tape” mean?

I am new to the study of cryptography, and when reading papers they often mention that "probabilistic algorithm G with random tape w ...". What does it mean by "random tape w"? I mean why it does is ...
0
votes
1answer
50 views

Asymmetric Encryption + Signature workflow

Let´s say that Alice wants to send an encrypted message that only Bob can read, plus confirm that Alice is the person that wrote that message. What is the procedure that will take place? When I see ...
0
votes
0answers
60 views

Is it possible to build an ASiC container out of a file and its timestamp token? [duplicate]

If I have: A file, X The RFC3161 timestamp token of X Are these sufficient to build a (single file) ASiC container with the file and the timestamp? In other words, is the timestamp included in the ...
0
votes
1answer
64 views

Signing and encrypting with pairs of keys based on discrete algorithms

In case I've generated pair of keys (public and private) for RSA, I'm able to use it both for signing and encrypting. Is the same statement true also for pairs of keys based on discrete algorithms?
1
vote
0answers
353 views

Verify PKCS#7 (CMS) detached signature with timestamp with OpenSSL

I have a PKCS#7 (i.e., CMS) detached signature of a file that is signed by my signing certificate and then timestamp signed by a TSA that is all generated by an application we wrote. I would like to ...