Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
0
votes
1answer
47 views

Cryptographically signing content / download

Let's say that I have an executable running on a client machine, and, it requires to download some updates on a regular basis. The solution uses TLS to communicate with the download server. I would ...
0
votes
0answers
26 views

Authenticode: Should UAC warn more dramatically for tampered file? [closed]

I have tried out what happens if a digitally signed executable is manipulated. The normal file has a blue UAC dialog: Now, say I change one byte in the file: When I now run this tampered file, the ...
0
votes
0answers
36 views

The RSA-CRT-faults lenstra's attack signature

I was reading this [paper]https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf)1 about the use of faults in the computation of signatures with the CRT optimized version of RSA(see the end of the ...
-1
votes
0answers
17 views

Location of Digital Signature on a certificate [duplicate]

Where do I look up the Signature of a certificate. For instance, if I go to a HTTPS website and open its certificate through the padlock on the URL bar, I see signature algorithm, hash algorithm etc ...
1
vote
1answer
147 views

Is it possible to sign a DVD?

I work on a project where DVDs with configuration files and software updates are delivered periodically to end users, and our software loads those discs. For example, we might load a disc with an ...
1
vote
1answer
44 views

Public Digital Signature Validation with JWE

After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, ...
1
vote
1answer
57 views

How can I preserve the uniqueness of a document without a database?

I’m willing to create a system of transferable documents (identified by it’s ID) whose author can transfer his ownership of that document to another person (identified by his/her ID). For example: ...
0
votes
3answers
126 views

Difference between certificate and digital signature [duplicate]

What is the difference between a digital certificate and a digital signature? Read on the internet that the digital signature is the result of encrypting with a private key, the 'hash' of the message ...
4
votes
1answer
105 views

What guarantees does GPG-signing a git commit provide?

It's pretty clear that GPG signing and GitHub ssh keys serve different purposes But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
0
votes
0answers
33 views

Do the encrypt_and_digest() and decrypt_and_verify() methods of the pycryptodome module in python 3 also perform the electronic signature process?

Do the encrypt_and_digest() and decrypt_and_verify() methods in pycryptodome also perform the electronic signature process? I have seen on the internet that the electronic signature consists of ...
1
vote
0answers
14 views

How to make data content provable for specific timestamp? [duplicate]

Let me explain it with an example: Consider that timestamp of today is 1262304000000 (2010-01-01 00:00:00.00) and you have a web page (or file) with content "AAA". Content on this page may change ...
1
vote
0answers
56 views

Breakdown of signature verification in CertificateVerify (TLS 1.3) with RSA-PSS

I'm debugging a TLS v1.3 client program, which failed to verify the signature in server's CertificateVerify, so I'm learning the procedures for verifying the signature from server's CertificateVerify ...
1
vote
0answers
43 views

Forward secrecy (plausible deniability) and storing messages

How do messengers, like signal or XMPP-omemo messengers, store their messages? Since the session key is only valid for the current session, how can such extensions like MAM (message archiving on XMPP ...
2
votes
2answers
114 views

Hawk vs. API key authentication

For a HTTP(S) API, which is better (/ which is better under which circumstances)? Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...
0
votes
1answer
62 views

How can we use digital signatures for mutual authentication between two computers?

I get the fact that we can use digital signatures for authenticating the signer (since they are using their private key to create the signature, and this is known only to the signer ). But how can the ...
5
votes
1answer
129 views

Alternatives to cryptographic signatures

I have a program I am developing and am currently using ed25519 to cryptographicaly sign messages. However, even those signatures are longer than I would like (64 bytes + the message). The messages ...
0
votes
1answer
63 views

What is a TSA policy OID?

What is TSA policy OID? Is it a unique identifier of a timestamp server given by a world wide authority? Does that mean that no two servers can have the same oid? Or is it an identifier of the ...
2
votes
1answer
73 views

How reliable is Virustotal's file signature check?

I downloaded a setup.msi file from an untrusted website. Virustotal says it's a signed file and valid signature, by the developer company and "GlobalSign Extended Validation CodeSigning CA" 3 times ...
2
votes
1answer
72 views

Questions on TLS 1.2 RFC - Clarification or references needed

I have been reading RFC 5246 on TLS 1.2 and have a few questions on algorithms chosen. Before I start, let me clarify that I am reading on 1.2 and not 1.3 because my ultimate interest is in DTLS 1.2. ...
0
votes
0answers
37 views

Digital signature verification with Client Certificates

We have a client server system implemented. Where client communicates using HTTP request. We have a one time token based authentication system and also sign the URL for authenticity. We do the ...
1
vote
0answers
27 views

How do I check if my key is updated in a keyserver after I resend it with new signatures?

I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures. The thing is that when ...
1
vote
0answers
40 views

What does jarsigner verify in the first place (integrity or authenticity)?

I was reading sth about android code signing and have run into this statement: The second jarsigner command at v in Listing 3-7 first verifies the signature block and signing certificate, ...
2
votes
1answer
124 views

JWT: Choosing between HMAC and RSA

It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 ...
0
votes
1answer
69 views

Does same hash value indicate a valid key?

I send a message to someone along with a public key, which they use to hash the message. If they get the same hash value that I get when I hash the same content with the private key, does that safely ...
1
vote
5answers
201 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
1
vote
1answer
92 views

Does Integrity assures protection from unauthorized read, without any modification?

I'm not quite sure if I understood integrity deep enough. Let's suppose that Alice and Bob are using a public-key algorithm and using signatures to assure their data integrity. A hacker was able to ...
1
vote
1answer
89 views

Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?

I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file: How can I tell if it was signed with an extended validation (EV) code-signing certificate? ...
0
votes
1answer
44 views

Theoretical DKIM Question

I have been playing around with sending emails via telnet using text commands. Theoretically... Say I send an email from a typical mail agent that adds a dkim signature from a@a.com to b@b.com. ...
0
votes
0answers
40 views

Just came to know about Digital Certificates. But did't understand the way clients can verify CA [duplicate]

So I just came to know about Digital certificates, and this is what I understand. Public Key, Message + PK_encrypt(Hash(message))/Message Signing, And other identifiers is what a digital signature is....
2
votes
1answer
122 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
2
votes
3answers
80 views

Benefits of signing a random number?

Is there any benefit to signing a random number? E.g. a link for password reset, sent to email, often includes a base64 encoded random number to prevent someone guessing what the password reset link ...
0
votes
1answer
30 views

Accept a https connection with invalid certificate and validate the certificate before. Is it possible?

I will integrate with a new application on the next weeks. But something that was told to me by the partner team was very strange. The partner ask us to pass one .CSR file with our company ...
1
vote
1answer
68 views

Example of something that WYSIWYS tries to prevent

Wikipedia's article on WYSIWYS is very brief, and says: It is relatively easy to change the interpretation of a digital document by implementing changes on the computer system where the document is ...
3
votes
2answers
110 views

What is the best strategy for handling a compromised private key within the domain of firmware?

I have a firmware project that uses asymmetric cryptography for assuring integrity and authority of updates. The private key is stored within the company, and the public key is on the firmware to ...
2
votes
1answer
51 views

Why sign SAML authentication requests

In SAML, signing or encrypting the assertions seems to be essential, but I'm not finding much information describing any benefits or drawbacks of signing the authentication request in real world "...
0
votes
1answer
77 views

How to obtain body from RSA signed document without verifying signature?

According to my understanding of computational cryptology, the body of a signed document can be retrieved disregarding whether or not the signature is authentic. However, I cannot apply this ...
5
votes
3answers
2k views

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Let we have a hash function that is second preimage resistant but not collision-resistant. Then an adversary can create a pair of different messages M and M', M is benign and M' is malicious, for ...
0
votes
1answer
148 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
0
votes
1answer
106 views

Send a CA certificate via email without a digital signature?

If a friend wants to send me their S/MIME CA certificate containing his public key, why does he need to add a digital signature? A digital signature verifies that the content was sent by him and not ...
1
vote
1answer
73 views

Who should create the keys?

I'm trying to implement a Software deployment & updating function which is part of AUTOSAR AP standard. Background information: There are three parts. Integrator the client which user uses it ...
0
votes
1answer
73 views

How can I apply message digest to the application so that user can validate the accuracy and completeness of the software [closed]

I have developed the application and now it's time to distribute to my users. I was reviewing my application and reading security best practises and found below statement in one of the article. ...
0
votes
1answer
215 views

How to communicate Credit Card details to customers when instantly approved in PCI-DSS compliant way?

Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the ...
1
vote
3answers
145 views

What is the advantage of using a digital signature over simple asymmetric encryption?

If you're sending me a message, you can: a) Encrypt the message using your private key, and I can decrypt is using your public key. b) You can create a digital signature of your message, and then ...
18
votes
3answers
5k views

Can attackers change the public key of certificate during the SSL handshake

The communication is not encrypted during the SSL handshake. If an attacker conducts a man in the middle attack between server and client to capture the certificate, and change the public key in the ...
1
vote
1answer
70 views

What use does verifying a file with a signature downloaded from the same server have? [duplicate]

Now, I understand how PGP signatures work and why they can be useful to check if a file has been manipulated but this has always bugged me, if I download a file from a site/server, and read: "...
0
votes
0answers
47 views

Offline code signature verification scheme

Assume that I want to sign digitally updates for an offline appliance (lets say a limited linux VM). To begin with, such mechanism is not in place and the very limited OS doesn't have any CA ...
1
vote
3answers
162 views

Is a cryptographically signing camera possible?

What kind of digital / cryptographic signing would make it possible to create a camera that cryptographically signs the photos it takes so that the images can be verified to have been taken with that ...
29
votes
2answers
4k views

Can you sign using a digital certificate itself?

Googling I saw several lectures saying that it is possible to sign using digital certificates. I am confused about that, because according to my knowledge it is possible to sign only using the private ...
1
vote
1answer
445 views

Some digitally signed pdfs shown as verified in the pdf viewers while others are not [closed]

I have two pdf documents: 1 - My class 10 marksheet issued by the CISCE that I downloaded through digilocker. 2 - My Domicile certificate issued and downloaded from the aaplesarkar website. Both ...
1
vote
2answers
120 views

Can a document be digitally signed multiple times, successively by different users?

The question is, if a document that is collaboratively edited, one user per time, could be digitally signed by every editor before it is passed to the next editor. And if yes, could the final receiver ...