Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

How do Cloud-based services provide Qualified Electronic Signatures?

From what I know about QES, they come on smart cards and USB tokens and are password protected. When a site asks you for a client certificate, you need to have it plugged in and enter the password ...
2
votes
1answer
53 views

Git Signing commits in a private repo

Linus mentioned in 2009 that "Signing each commit is totally stupid". Has the common view evolved on this subject since then ? Doesn't it protect against someone usurping your identity to ...
0
votes
0answers
10 views

What hash based digital signature algorithms exist that have reasonably small signature sizes? [migrated]

What hash based digital signature algorithms exist that have reasonably small signature sizes? By reasonably small, I mean not much bigger than what you would get with a 256-bit ECDSA (which I ...
0
votes
1answer
37 views

mTLS Client Authentication by Signing Arbitrary Message using Browser

this is my first post here in the area of ​​security and encryption. I will try to be succinct, and let you know that I am not an expert in security. Context: My client (visitor) has an X509 ...
3
votes
2answers
137 views

How can I prove the content of a PGP-encrypted message to a third party?

Imagine this scenario A StackExchange user sends you a PGP-encrypted message You decrypt the message and discover that you are being blackmailed You report the message to the admins but they are ...
1
vote
1answer
62 views

Parse VBA Macro Digital Signature

When I open up my macro-enabled office files (i.e., .docm, .xlsm, .pptm) that contain signed macros as a Zip file, I see the following three files which I assume contain the digital signatures for the ...
0
votes
1answer
54 views

Why does length of Signatures in two certificates using same Signature Algorithm sha256WithRSAEncryption is different?

I have this recent Wikipedia certificate issued by intermediate CA Let's encrypt: Certificate: Data: Version: 3 (0x2) Serial Number: 03:95:2f:46:69:de:e4:d2:19:35:7f:f0:...
2
votes
2answers
93 views

Digital Signatures validity when changing Certificate Authority

An enterprise has its internal PKI-1 (Root CA) that issues certificates to sign document using CAdES-C (CAdES-LT); with Complete Validation Data References and revocation references. Now this ...
0
votes
0answers
34 views

Strange keystore from payment processor

I am working on an older software for a company at the moment and in my work have been upgrading a number of libraries. The app connects to a web service hosted by the third party payment processor, ...
0
votes
1answer
91 views

Is DSA-1024 safe to sign package repositories ? What are the reasons?

I recently found that the latest release of a major Linux distribution (MX Linux) uses DSA-1024 in /etc/apt/trusted.gpg and in /etc/apt/trusted.gpg.d/*.gpg It also probably uses SHA-1 as the signature ...
0
votes
1answer
85 views

Signing Binaries in CI/CD

I've been considering how continuous integration/delivery environments handle code signing. If I maintain some open source project which uses a CD environment to build binaries to ship to users, I may ...
0
votes
1answer
54 views

Keeping a whitelist of GPG keys on git server

Why don’t git servers (gitlab, github, etc…) allow for a whitelist of public GPG keys allowed to sign commits? For example, Alice owns a GPG key with fingerprint 0A1B2C3D while Bob’s is 4E5F0A0B. They ...
0
votes
1answer
82 views

Possible to limit an SSL certificate holder to issuing redirects?

Is it possible to issue an SSL certificate that limits the certificate holder to issuing https redirects? Or more generally, limiting the holder to issuing specified data through the secure pipe, ...
0
votes
0answers
46 views

Docker: How to download & verify a publisher's root key (out-of-band, distinct-domain cryptographic verification, WoT)

For a given publisher of docker images on Docker Hub (let's say debian), how do I download their root release/image signing key and verify its authenticity from multiple sources out-of-band from each-...
0
votes
1answer
121 views

How hard is to reverse engineer a signature for a given message?

Given the following situation: User makes a request for temporary access to a video Backend responds with a json file containing timeAllowedInSeconds: 5 Backend also responds with the signature of ...
0
votes
1answer
69 views

designing updater with certificate renewal in mind

A program A downloads signed executables and other signed configuration files. Configuration files have signature appended at the end of files. To verify their integrity and creator, it uses the ...
1
vote
0answers
73 views

How to go about checking if Windows is running any untrusted drivers (programatically)

I want to enforce a rule that my program start only if, at the time it launches, there are no untrusted kernel drivers running. I'm aware and have already tested file signature verification using ...
2
votes
1answer
109 views

How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?

Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include: Hosting the website under HTTPS; ...
0
votes
1answer
88 views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
0
votes
2answers
89 views

Is it feasible to calculate an HMAC-SHA512/256 MAC from an environment that only supports HMAC-SHA512?

I need to verify a MAC for something signed with HMAC-SHA512/256, however, the language I'm using (Salesforce's Apex language) doesn't have support for that algorithm. It does have HMAC-SHA512 and ...
0
votes
0answers
70 views

Use an Ethereum signature for API GET authentication

The following situation: I have a web app (stateless) Users are connected the web app using WalletConnect to connect their Ethereum Wallet. Cannot therefore not use any API keys or tokens there is a ...
0
votes
2answers
120 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
0
votes
1answer
103 views

Combining confidentiality, authenticity and data integrity to form secure URL

There are clients (mobile application), they can share links to their profile info, which should be confidential. The link expires in 5 minutes (configured). They set Auth-Code so that the one who ...
0
votes
0answers
55 views

Tooling and serialization format for DNSSEC signture chain

I'm looking for a compact, canonical (and possibly but not necessarily human-readable) format for serializing the signature chain for a RRset (or proof that it lies under an insecure delegation) for ...
0
votes
1answer
135 views

Forging message using the secret key in digital signature?

In Digital Signature Scheme, is it possible to forge a message just by knowing the secret key, or does the attacker should also know the hash function used by the original sender? Also does the secret-...
0
votes
1answer
134 views

If a file is digitally signed, is posting a hash very useful for security purposes?

In this question I asked about how to handle situations when SHA-256 hashes are not available for a file downloaded from the internet that contains executable code. Another community member ...
1
vote
2answers
103 views

Premeditated substitution of ECDSA-signed message by the signer

If I understand correctly section 4.2 in Jacques Stern, David Pointcheval, John Malone-Lee, and Nigel P. Smart's Flaws in Applying Proof Methodologies to Signature Schemes, in proceedings of Crypto ...
1
vote
2answers
77 views

Deriving digital signature key pair deterministically from an arbitrary secret

Is there a scheme that let people derive public/private key pair from arbitrary secrets? As you may know, digital signature schemes have versatile use cases. The problem is, the key pair handling is ...
2
votes
2answers
127 views

Digital Signature verification Automate vs Manual

Digital Signature verification process for software installation can be done automatically during execution or manually by user. (I'm considering PKI Method of certification.) For example, in case of ...
0
votes
1answer
149 views

Standard form of email signature

A little bit of background: I want to sign my emails for my own safety. None of my intended recipients are users of digital signatures. If one day someone were to impersonate me, I can prove my own ...
1
vote
4answers
116 views

How can digital signatures assure the sender their message has been correctly received?

I am going through a short course on security. One of the videos is talking about non-repudiation in regards to cryptography and sending messages between Alice and Bob. This video talks about how ...
1
vote
1answer
228 views

gnu gcc source archives signed with expired GPG key?

I'm in the course of rescuing a legacy app that got left behind and turned out to be needed on rare occasions, one of which occurred yesterday. I need to rebuild some libraries and the libraries have ...
2
votes
2answers
101 views

Possible to generate short signed strings?

I need to receive emails and put them in different "inboxes". Identifying and validating an inbox involves a database hit in order to search for the to-address. I would like to not hit the ...
1
vote
0answers
42 views

XMLDSIG and XAdES for non-XML file types

When I use XAdES for file types other than XML, how is the file digested for signature? My understanding is that XAdES is XMLDSIG with a couple extra fields. For XML signatures, the signature is ...
4
votes
1answer
97 views

Is there some OSS toolchain for disallowing execution of all unsigned binaries on linux?

Say I'm running a server with Ubuntu and an application stack and I want to lock down potential malicious access. Is there some OSS toolchain for disallowing execution of all unsigned binaries on ...
2
votes
1answer
195 views

What's the difference between an executable signed with a Windows Digital Signature and one signed with PGP?

I'm trying to figure out how to establish trust in Windows executables that I download from the internet. Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they ...
1
vote
0answers
58 views

Can an EMV bank card be used to digitally sign documents?

Bank accounts are bound to an identity. Can bank cards be used in the same way as https://www.identrust.com/certificates/document-signing ?
1
vote
1answer
155 views

GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?

according to https://www.rfc-editor.org/rfc/rfc8032 EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or 114 bytes) for Ed25519 and Ed448, respectively; But if I sign using Ed25519 in ...
0
votes
1answer
44 views

How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?

Let's say Alice has three secrets: SecretA, SecretB, SecretC Alice shows these three secrets to Bob and gets a single signature from him that signs all three secrets together. Something like Signature ...
0
votes
2answers
109 views

Reject requests from our tampered android apps

I'm working on an Android application with few millions of users. The app has some financial|payment features. We have some public APIs and some authenticated ones (OAuth2). As a part of enhancing our ...
2
votes
2answers
87 views

Is it possible to create a certificate for a key pair which I do not possess?

Perhaps the answer is no, and perhaps this is a dumb question. However I am trying to understand the underlying principles better. My understanding of certificate signing process. I generate a key ...
2
votes
0answers
134 views

How can I get `gpg` to sign with certain key again (end of file error)

Disclaimer: This is a cross-post after I initially was looking for help on the Gentoo forums since I suspected some major update of my Gentoo system to be the reason behind my problem. However, since ...
5
votes
0answers
114 views

What's the merit of storing LTV (long term validation) information for RFC3161 tokens and what happens if a TSA private key would leak?

I'll formulate my question in regards to timestamped PDF, but I wonder actually about the long term validation of RFC3161 tokens in general. So, PAdES has the concept of Long Term Validation, which ...
3
votes
1answer
85 views

Verify that data submitted by user was produced by my app

I'm designing an app (for PC), that is intended to run on users' machines and generate a file with some data. The user will then upload the file to the server, and I want to verify that this file has ...
1
vote
0answers
145 views

Digital Signature uses private key for encryption, and public key for decryption? [duplicate]

Public key is for encryption, and private key is for decryption in PKIs. And digital signature employs the PKIs. How to use a private key for encryption, and using public key for decryption which ...
0
votes
0answers
76 views

How could I improve the security of my design?

I’m building an open-source notes app using electron. I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a ...
0
votes
1answer
152 views

Authentication to offline device

I have an offline safe at a remote location that I want to give people access to at my discretion. I would like to control who and when they have access, without having to travel to the safe. Example: ...
1
vote
2answers
187 views

Check signature of an HTTPS response

So I want to do the following Check the RSA public key of a https server Make a GET request to that server Get a response+signature from the server I should be able to check if ANY reponse+signature ...
1
vote
1answer
96 views

Short digital signature

I want to digitally sign messages with strict size limitations. I am looking for digital signature algorithm providing very short signatures. (as short as possible) Which secure algorithms can I ...
3
votes
2answers
239 views

Why should I go to SHA512withRSA signature for my Android apps?

I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default. Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...

1
2 3 4 5
17