Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
2
votes
1answer
221 views

When I sign a git commit, what is my signature actually based on?

I'm curious about what data actually gets signed when I sign a git commit or tag? Is it simply the commit message and metadata? How could I manually duplicate the signature, use gpg instead of git?
0
votes
0answers
19 views

How to ensure authenticity of photographic evidence and derived work?

Photographic evidence is not what it used to be before generative ai, reface, deepfake, live deepfake, etc. Is there a way to ensure authenticity of photos/videos, as well as derived work? For example:...
39
votes
9answers
9k views

Is it possible to make a video that is provably non-manipulated?

Suppose a student takes an exam at home. Since home-exams are prone to cheating, the student wants to be able to prove that he/she did not cheat. So the student puts cameras in the room, which ...
0
votes
1answer
95 views

It's secure to store private keys in AWS Secret Manager?

I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
1
vote
1answer
37 views

Proving authenticity of a message from a message app in case of deletion

Say you want to prove that you received a certain message from someone. This can be difficult because many messaging apps (like facebook messenger) allow the sender to delete messages on the recipient'...
2
votes
1answer
93 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
1
vote
2answers
76 views

Private key Proof of Ownership [closed]

Given 2 entities, A and B: A has a public key( x ) and a private key( x* ). B has a A's public key hash( let's call it h(x) ). A has to prove ownership of x* to B. How could this be achieved, ...
1
vote
1answer
46 views

Keysigning and digital message signatures: are they the same thing?

I was reading this wikipedia article on Keysigning: https://en.wikipedia.org/wiki/Keysigning and I then came across this discussion Stack overflow about message signing with RSA: https://stackoverflow....
14
votes
1answer
3k views

How does this unsigned exe launch without the windows 10 SmartScreen warning?

So, I have been working on my own project for which I have been looking into certificates and such. While browsing reddit I found a game which I can launch the exe file, expecting to get a Windows 10 ...
0
votes
1answer
40 views

Are Digital Signatures tuned to become harder as computers become faster?

For example, how long does a typical CPU take to verify a single secp256k1 signature? Wouldn't this need to change in time so that signatures can't be brute forced? How is it decided how "strong&...
0
votes
0answers
23 views

How does AWS verify signed requests?

How does AWS request signing and verification work? Let's say I have created a signed request using this guide. How does AWS service verify this signature? I see 2 options with their respective flaws (...
0
votes
1answer
49 views

Are there any identity providers which support securing RESTful interfaces using digital signature?

I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract: When signing, the sender uses ...
0
votes
0answers
30 views

Digital signature without exposing the private key

If the private key is used in the server for digital signature, once the server is hacked, the private key may be leaked. Is there a way to create a digital signature without exposing the private key?
0
votes
0answers
27 views

Remote digital signature (eidas)

Except the usual implementations of a digital signature there is the "remote" digital signature implementation (is a standard created by eidas). There are some companies that provides remote ...
1
vote
2answers
95 views

Can gnupg sign multiple files in parallel?

I want to sign every file in a directory. I can do so with the following shell command, but it's slow. Serial Execution: find . -type f -printf "Signing %p...\n" -exec gpg --quiet --batch --...
0
votes
0answers
46 views

How to check where all my Digital Signature is used

I have not applied for a DSC(digital signature) but got a message from a vendor that my DSC will expire in 15 days. I have the certificate serial number given by the vendor. How can I check if the DSC ...
0
votes
0answers
43 views

Deciding the kind of key required for implementation of monitoring software

Different companies seek permission to start and run, from our organization. I am approval or permission-giving authority. I am having an inspector who goes to different places and visits companies ...
0
votes
1answer
48 views

Openssl NID to IANA value

I am trying to parse the signature algorithm off a certificate using Openssl's APIs. Currently I am using the X509_get_signature_info function to get the hash/digest nid and the pkey nid. However, ...
4
votes
1answer
128 views

INTEL-SA-00086 extracting the secret key used to encrypt Intel CPU code: is the digital signature bypassed?

In a recent attack to INTEL-SA-00086, the researchers are able to extract the secret key that encrypts updates to various Intel CPUs. In the arstechnica blog it is mentioned as The key may also allow ...
1
vote
0answers
26 views

New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key

I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu. I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
2
votes
2answers
156 views

Certificates(CA certificate and EE/Local certiificate)

There is a small confusion related to CA certificate and Local certificate. I had asked a similar question before. This time, its a little specific. For authentication using PKI, below are the steps. -...
19
votes
7answers
4k views

Is there a protocol that provides data integrity, but not encryption for HTTP?

HTTP I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed. HTTPS On the other hand, HTTPS sends encrypted text over the network that can ...
8
votes
3answers
2k views

What happens when I encrypt something with my RSA Public Key?

I know encrypting something with my private key is used for signing. To prove that the message is indeed coming from me. But what about if I sign something with my public key? That would mean that ...
0
votes
1answer
118 views

Prove Alice Had Sent the Message Before

Alice just sent a message to Bob, but prior to that she had already sent the very same message. How can Bob prove that?
3
votes
0answers
114 views

Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?

I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1) Basically, ...
0
votes
0answers
36 views

Does a signing provider has my private key (digital signatures)

For my essay im writing about digital signatures. Lets talk about an advanced digital signature which works with PKI (private-public key infrastructure). For example, im using ValidSign or GlobalSign ...
0
votes
1answer
73 views

Main Reasons for GPG over hashing for verification

I have recently been introduced to GPG signing as a better way of verifying data than hashing. It was described that if you posted the hash of the file, someone could hack your website, alter the hash ...
1
vote
1answer
63 views

How to list all of the known root keys in docker (Docker Content Trust)

How can I list all of the Docker Content Trust root keys on my system? I am setting up a CI process that will use the debian:stable-latest docker image to build my application's releases in ephemeral ...
0
votes
2answers
449 views

openssl verify error: unable to get local issuer certificate

I have a test certificate chain that I generated and it fails the openssl verify command: openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem The output I get from the ...
0
votes
0answers
28 views

What is the difference between domain certificate and document certificate

I saw some certificate providers offer different certificate types like code signing, document signing, so the question here what would be the difference between a domain certificate and document ...
1
vote
2answers
70 views

Identification through digital signature. How safe is it?

Let's say I want to give some data to Bob. I have his public key. I tell him to generate a digital signature for text "{some_stuff: 1, nonce: 2}". After he does that and after I verify it's ...
1
vote
1answer
205 views

Is certificate signature encoded to ASN.1 format?

I'm working on a diagram to describe the process of issuing digital certificates, with the help of answers on my question here and some other research: I just read in the IETF that: The ...
9
votes
4answers
1k views

What's the point of providing file checksums for verifying downloads? [duplicate]

Many projects offering binaries, also offer hashes (e.g. SHA256) of those binaries, wither as .ASC files, or directly on the web page near the binary. This isn't to protect against network-caused ...
0
votes
0answers
60 views

What prevents me from using a some server's public key and impersonate another server [duplicate]

I read alot regarding RSA encryption/DH key exchange/digital signatures and the whole TLS protocol. There's something i am missing regarding the public key signatue validation. Let say some website ...
2
votes
1answer
318 views

How is public key included in the CSR?

I've read a lot of articles on the PKI and digital certificate topics because it's very rare to find one article covers all the aspects; also the topic is confusing at the beginning, (this beautiful ...
2
votes
2answers
159 views

How to pass both passphrase and password in GPG signed symmetric encryption?

I am new to GPG so I may be going about this all wrong. I have some files I would like to encrypt symmetrically using AES256, but I want to sign them with my GPG key. I need to automate this process ...
2
votes
1answer
126 views

How to authenticate an Add-In on interprocess communication?

We are considering to build a Windows application that is split in 2 parts: one Windows service some Add-Ins for Microsoft Office, Microsoft Management Console (MMC) and PowerShell. Additional info: ...
0
votes
1answer
34 views

Secured Software Update from an unauthenticated entity

Let's suppose we have a software update D, that is encrypted and signed and delivered to some component C. Further we suppose that the receiving entity C can validate the signature and decrypt the ...
3
votes
1answer
159 views

Validity, Owner Trust, Trust Signatures & Certification Level

Two questions on signatures. I am trying to understand the various types of "trust signature". The man page says, "For more information please read the sections “Trust Signature” and “...
1
vote
0answers
87 views

Examples of SSH key exchange algorithms requiring encryption-capable host keys

In the SSH spec, Section 7.1, key exchange algorithms are distinguished based on whether they require an "encryption-capable" or a "signature-capable" host key algorithm. If I ...
2
votes
0answers
45 views

What's the purpose of signatures in Google Maps APIs?

There's something I don't understand about signatures in Google Maps APIs. The documentation says "We strongly recommend that you use both an API key and digital signature, regardless of your ...
1
vote
0answers
47 views

Signing event-stream responses

I am working on an application where the general approach is signing most response payloads with HMAC, but there are a couple of endpoints that return text/event-stream in the response. What is the ...
0
votes
1answer
61 views

control digital signing

What is the secure way to support dev mode and production modes on embedded systems that support digital signing. Dev mode will skip signature verification.
1
vote
0answers
35 views

Authenticating Adobe .pdf electronic signatures

Having created a certificate for electronic signing within Adobe Acrobat DC, can I authenticate documents signed using it by issuing a signed paper statement to recipients stating that it would be ...
0
votes
2answers
75 views

How is the digital certificate sent alongside digital signatures?

Most tutorials on the net only mention sending the digital signature attached to the document, but without the digital signature certificate, it'll be impossible for receivers to verify the signature. ...
0
votes
2answers
52 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
0
votes
2answers
104 views

Sign records in a database [closed]

I have a table in my database where I store records to be processed later (basically orders that need to be invoiced or something similar, but this is not the important part). Since this software runs ...
1
vote
0answers
66 views

Why does PGP create a signature from plaintext?

From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and ...
1
vote
0answers
539 views

Why does keycloak use HS256 algorithm to sign access token when client settings specify RS256?

I have the following setup with a keycloak authentication server and an application: user logs in on application client side, send un/pw to server application server sends un/pw to keycloak server ...
-1
votes
1answer
43 views

Digital signature from hashing encrypted webpage

I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...

1
2 3 4 5
16