Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

Why are LMS and XMSS no candidates in the Post-Quantum Cryptography Standardization process? [migrated]

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) no candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...
1
vote
4answers
92 views

How can digital signatures assure the sender their message has been correctly received?

I am going through a short course on security. One of the videos is talking about non-repudiation in regards to cryptography and sending messages between Alice and Bob. This video talks about how ...
0
votes
0answers
101 views

Understanding public key cryptography example [migrated]

Frankly, I wasn't sure whether this belongs in crypto.stackexchange.com or here, so forgive me. I've been going through a book where in one of the chapters the author tries to illustrate public key ...
1
vote
1answer
65 views

gnu gcc source archives signed with expired GPG key?

I'm in the course of rescuing a legacy app that got left behind and turned out to be needed on rare occasions, one of which occurred yesterday. I need to rebuild some libraries and the libraries have ...
2
votes
2answers
89 views

Possible to generate short signed strings?

I need to receive emails and put them in different "inboxes". Identifying and validating an inbox involves a database hit in order to search for the to-address. I would like to not hit the ...
1
vote
0answers
24 views

XMLDSIG and XAdES for non-XML file types

When I use XAdES for file types other than XML, how is the file digested for signature? My understanding is that XAdES is XMLDSIG with a couple extra fields. For XML signatures, the signature is ...
4
votes
1answer
80 views

Is there some OSS toolchain for disallowing execution of all unsigned binaries on linux?

Say I'm running a server with Ubuntu and an application stack and I want to lock down potential malicious access. Is there some OSS toolchain for disallowing execution of all unsigned binaries on ...
2
votes
1answer
72 views

What's the difference between an executable signed with a Windows Digital Signature and one signed with PGP?

I'm trying to figure out how to establish trust in Windows executables that I download from the internet. Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they ...
1
vote
0answers
44 views

Can an EMV bank card be used to digitally sign documents?

Bank accounts are bound to an identity. Can bank cards be used in the same way as https://www.identrust.com/certificates/document-signing ?
1
vote
1answer
96 views

GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?

according to https://tools.ietf.org/html/rfc8032 EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or 114 bytes) for Ed25519 and Ed448, respectively; But if I sign using Ed25519 in ...
0
votes
1answer
29 views

How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?

Let's say Alice has three secrets: SecretA, SecretB, SecretC Alice shows these three secrets to Bob and gets a single signature from him that signs all three secrets together. Something like Signature ...
0
votes
2answers
78 views

Reject requests from our tampered android apps

I'm working on an Android application with few millions of users. The app has some financial|payment features. We have some public APIs and some authenticated ones (OAuth2). As a part of enhancing our ...
2
votes
2answers
55 views

Is it possible to create a certificate for a key pair which I do not possess?

Perhaps the answer is no, and perhaps this is a dumb question. However I am trying to understand the underlying principles better. My understanding of certificate signing process. I generate a key ...
2
votes
0answers
94 views

How can I get `gpg` to sign with certain key again (end of file error)

Disclaimer: This is a cross-post after I initially was looking for help on the Gentoo forums since I suspected some major update of my Gentoo system to be the reason behind my problem. However, since ...
5
votes
0answers
57 views

What's the merit of storing LTV (long term validation) information for RFC3161 tokens and what happens if a TSA private key would leak?

I'll formulate my question in regards to timestamped PDF, but I wonder actually about the long term validation of RFC3161 tokens in general. So, PAdES has the concept of Long Term Validation, which ...
3
votes
1answer
70 views

Verify that data submitted by user was produced by my app

I'm designing an app (for PC), that is intended to run on users' machines and generate a file with some data. The user will then upload the file to the server, and I want to verify that this file has ...
1
vote
0answers
144 views

Digital Signature uses private key for encryption, and public key for decryption? [duplicate]

Public key is for encryption, and private key is for decryption in PKIs. And digital signature employs the PKIs. How to use a private key for encryption, and using public key for decryption which ...
0
votes
0answers
60 views

How could I improve the security of my design?

I’m building an open-source notes app using electron. I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a ...
0
votes
1answer
87 views

Authentication to offline device

I have an offline safe at a remote location that I want to give people access to at my discretion. I would like to control who and when they have access, without having to travel to the safe. Example: ...
1
vote
2answers
67 views

Check signature of an HTTPS response

So I want to do the following Check the RSA public key of a https server Make a GET request to that server Get a response+signature from the server I should be able to check if ANY reponse+signature ...
1
vote
1answer
55 views

Short digital signature

I want to digitally sign messages with strict size limitations. I am looking for digital signature algorithm providing very short signatures. (as short as possible) Which secure algorithms can I ...
3
votes
2answers
109 views

Why should I go to SHA512withRSA signature for my Android apps?

I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default. Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...
0
votes
1answer
74 views

What is the relation between “signature_algorithms” handshake extension and TLS ciphersuite

I am learning TLS handshake and find client/serve will negotiate a cihpersuite during client/server hello. Usually, the last part of a ciphersuite is a hash algorithm, like SHA256 in ECDHE-ECDSA-...
2
votes
1answer
278 views

When I sign a git commit, what is my signature actually based on?

I'm curious about what data actually gets signed when I sign a git commit or tag? Is it simply the commit message and metadata? How could I manually duplicate the signature, use gpg instead of git?
0
votes
0answers
23 views

How to ensure authenticity of photographic evidence and derived work?

Photographic evidence is not what it used to be before generative ai, reface, deepfake, live deepfake, etc. Is there a way to ensure authenticity of photos/videos, as well as derived work? For example:...
40
votes
10answers
10k views

Is it possible to make a video that is provably non-manipulated?

Suppose a student takes an exam at home. Since home-exams are prone to cheating, the student wants to be able to prove that he/she did not cheat. So the student puts cameras in the room, which ...
0
votes
1answer
221 views

It's secure to store private keys in AWS Secret Manager?

I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
1
vote
1answer
40 views

Proving authenticity of a message from a message app in case of deletion

Say you want to prove that you received a certain message from someone. This can be difficult because many messaging apps (like facebook messenger) allow the sender to delete messages on the recipient'...
2
votes
1answer
99 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
0
votes
2answers
91 views

Private key Proof of Ownership [closed]

Given 2 entities, A and B: A has a public key( x ) and a private key( x* ). B has a A's public key hash( let's call it h(x) ). A has to prove ownership of x* to B. How could this be achieved, ...
1
vote
1answer
51 views

Keysigning and digital message signatures: are they the same thing?

I was reading this wikipedia article on Keysigning: https://en.wikipedia.org/wiki/Keysigning and I then came across this discussion Stack overflow about message signing with RSA: https://stackoverflow....
14
votes
1answer
3k views

How does this unsigned exe launch without the windows 10 SmartScreen warning?

So, I have been working on my own project for which I have been looking into certificates and such. While browsing reddit I found a game which I can launch the exe file, expecting to get a Windows 10 ...
0
votes
1answer
41 views

Are Digital Signatures tuned to become harder as computers become faster?

For example, how long does a typical CPU take to verify a single secp256k1 signature? Wouldn't this need to change in time so that signatures can't be brute forced? How is it decided how "strong&...
0
votes
0answers
28 views

How does AWS verify signed requests?

How does AWS request signing and verification work? Let's say I have created a signed request using this guide. How does AWS service verify this signature? I see 2 options with their respective flaws (...
0
votes
1answer
49 views

Are there any identity providers which support securing RESTful interfaces using digital signature?

I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract: When signing, the sender uses ...
0
votes
1answer
54 views

Digital signature without exposing the private key

If the private key is used in the server for digital signature, once the server is hacked, the private key may be leaked. Is there a way to create a digital signature without exposing the private key?
0
votes
0answers
31 views

Remote digital signature (eidas)

Except the usual implementations of a digital signature there is the "remote" digital signature implementation (is a standard created by eidas). There are some companies that provides remote ...
1
vote
2answers
152 views

Can gnupg sign multiple files in parallel?

I want to sign every file in a directory. I can do so with the following shell command, but it's slow. Serial Execution: find . -type f -printf "Signing %p...\n" -exec gpg --quiet --batch --...
0
votes
0answers
48 views

How to check where all my Digital Signature is used

I have not applied for a DSC(digital signature) but got a message from a vendor that my DSC will expire in 15 days. I have the certificate serial number given by the vendor. How can I check if the DSC ...
0
votes
0answers
44 views

Deciding the kind of key required for implementation of monitoring software

Different companies seek permission to start and run, from our organization. I am approval or permission-giving authority. I am having an inspector who goes to different places and visits companies ...
0
votes
1answer
98 views

Openssl NID to IANA value

I am trying to parse the signature algorithm off a certificate using Openssl's APIs. Currently I am using the X509_get_signature_info function to get the hash/digest nid and the pkey nid. However, ...
4
votes
1answer
321 views

INTEL-SA-00086 extracting the secret key used to encrypt Intel CPU code: is the digital signature bypassed?

In a recent attack to INTEL-SA-00086, the researchers are able to extract the secret key that encrypts updates to various Intel CPUs. In the arstechnica blog it is mentioned as The key may also allow ...
1
vote
0answers
30 views

New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key

I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu. I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
2
votes
2answers
207 views

Certificates(CA certificate and EE/Local certiificate)

There is a small confusion related to CA certificate and Local certificate. I had asked a similar question before. This time, its a little specific. For authentication using PKI, below are the steps. -...
19
votes
7answers
4k views

Is there a protocol that provides data integrity, but not encryption for HTTP?

HTTP I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed. HTTPS On the other hand, HTTPS sends encrypted text over the network that can ...
8
votes
3answers
3k views

What happens when I encrypt something with my RSA Public Key?

I know encrypting something with my private key is used for signing. To prove that the message is indeed coming from me. But what about if I sign something with my public key? That would mean that ...
0
votes
1answer
138 views

Prove Alice Had Sent the Message Before

Alice just sent a message to Bob, but prior to that she had already sent the very same message. How can Bob prove that?
3
votes
0answers
115 views

Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?

I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1) Basically, ...
0
votes
0answers
37 views

Does a signing provider has my private key (digital signatures)

For my essay im writing about digital signatures. Lets talk about an advanced digital signature which works with PKI (private-public key infrastructure). For example, im using ValidSign or GlobalSign ...
0
votes
1answer
80 views

Main Reasons for GPG over hashing for verification

I have recently been introduced to GPG signing as a better way of verifying data than hashing. It was described that if you posted the hash of the file, someone could hack your website, alter the hash ...

1
2 3 4 5
17