Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

0
votes
0answers
25 views

Signing JWTs with server's SSL/TLS certificate

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my ...
0
votes
0answers
22 views

Signing webhooks with asymmetric keys

I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography). What is the recommended or ...
0
votes
1answer
64 views

What are the risks in returning digitally signed payloads over an insecure HTTP connection?

Let's say I own a service and a client needs me (for the sake of this question) to provide an endpoint over HTTP (not HTTPS) that doesn't use cryptographically secure authentication. Further, there's ...
0
votes
1answer
27 views

hmac based request signature for verification

say i want an application to integrate my services & need some way of verifying requests from that application, i have an integration key, and a shared secret, i can generate a generate a ...
0
votes
0answers
46 views

In what important ways can a digital signature be invalid?

I am trying to write some code to verify that a digitally signed file came from my company. I was horrified to stumble across this deeply buried answer on Stack Overflow, an out-of-left-field ...
1
vote
1answer
65 views

Does the key size have an effect of the size of the public key and signature

If I have a 2048-bit RSA and a 4096-bit RSA key is my signature and public key smaller when I use a 2048-bit key vs a 4096-bit one ? (In bytes)
0
votes
2answers
46 views

RSA signature security with short keys

RSA keys with the size of 1024 aren’t considered to be safe anymore. Does this also apply if you use this key for signing only? Can a signature be faked easily with a short key length?
2
votes
1answer
87 views

Asymmetric public-key cryptography: can either key be used to encrypt or decrypt?

Key exchange describes a public key encrypting plaintext and the private key decrypting, while in digital signatures the reverse is true where the private key is used to encrypt a hash that the ...
0
votes
1answer
55 views

Signature verification against custom CA [duplicate]

I need to (write a program to) verify signature in a (bunch of) signed XML files. NOTE: I am dealing with XML files signed according to 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315', not just ...
0
votes
1answer
114 views

Signing and timestamping implementation

I am writing a software that records and stores data files. I want to digitally sign and time stamp these files so that I can assure that it's Contemporaneous and Attributable (to comply with 21 CFR ...
3
votes
1answer
111 views

Is it possible to fake ECDSA signatures?

Recently, I came across a reddit post claiming it was easy to mutate bitcoin signatures to generate message/signature pairs. https://www.reddit.com/r/btc/comments/9xpivk/...
4
votes
3answers
213 views

What if somebody sends me genuine certificate that they do not own? [closed]

I just started learning about the digital certificates, its architecture and how it works internally. What will happen if someone sends me a genuine certificate for authentication which does not ...
0
votes
1answer
48 views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
25
votes
5answers
7k views

What does “signing” a file really mean?

I'm a bit new to security and trying to get the concepts properly. I'm wondering what exactly "signing" a file (a certificate, an apk file, or something else) means? Do we sign the whole file so ...
1
vote
1answer
145 views

How can I use 'safe' Elliptic Curve algorithms in .Net Core?

I'm looking to build my own digital signature operations into a program I'm writing, and the nuances of cryptography are a bit beyond me. According to this website the NIST/NSA algorithms (P-224, P-...
1
vote
1answer
46 views

Public Key Crypto - sign Bob's name into Alice's message or encrypt Alice's name

I was reading Defective Sign & Encrypt in S/MIME,  PKCS#7, MOSS, PEM, PGP, and XML and in section 5.1  Naming Repairs By signing Bob's name into her message, Alice explicitly identifies him ...
1
vote
1answer
89 views

Signal Protocol: How is identity exchanged if a key exchange hasn't happened yet?

On Signal's blog they mention that keys for accessing your profile are exchanged normally with your contacts using the Signal Protocol just like messages are (implying they are already contacts and ...
3
votes
3answers
137 views

Is it possible to use “cryptographic hash function” for “digital signature”?

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input. However, is it possible to use a cryptographic hash function for ...
1
vote
0answers
54 views

Working with Security Metadata in APK file

According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
0
votes
2answers
42 views

Allow setting both server URL and public key - security hole?

We have a licensing system where our software, a commercial product we sell to people, contacts our licensing server when starting to get an OK to run. It contacts our licensing URL and passes up an ...
0
votes
2answers
149 views

Is there any list of vulnerabilities and their signatures?

I am looking for a list of known vulnerabilities and their signatures. Is there any publicly available list of security vulnerabilities and their signatures? NVD (NATIONAL VULNERABILITY DATABASE) ...
-3
votes
1answer
105 views

Explain how a digital signature is employed for providing a proof of authenticity (not integrity!) of a file [closed]

Explain how a digital signature is employed for providing a proof of authenticity (not integrity!) of a file.
1
vote
2answers
176 views

Does a File's Checksum Change after it is Digitally Signed?

From my understanding, when you digitally sign a file, it changes that file's checksum because they are bundled together. Example of what I mean: file1.txt only contains the letter 'd' and the ...
1
vote
2answers
90 views

Why digital signatures needs different algorithm

Why digital signatures uses algorithms such as DSA, ECDSA or RSA-PSS, and not just the RSA algorithm to encrypt the message hash with the private key? Is the choice more security or performance ...
3
votes
1answer
89 views

Concepts of PKI Encryption and Digital Signature Authentication [duplicate]

I am trying to understand how SSL uses PKI and Digital Signature authentication to ensure secure and verified communications. I've read various sources online and from what I can tell the basic ...
1
vote
2answers
65 views

What happens when the timestamper's certificate expires?

What happens when the timestampers certificate expires? If the code is now untrusted, can it be re-stamped without re-signing? If not, what good does this timestamp do me if my cert is valid until the ...
1
vote
2answers
55 views

How to overcome slow process of creating and verifying digital signature?

From what I understood is the digital signature is a long process and have following steps: Hashing the Message Plain Text using a well-known (public) hashing algorithm. Encrypting it with sender's (...
2
votes
0answers
24 views

GPG self-signature default check level

I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned. When issuing gpg --check-sigs one ...
2
votes
1answer
94 views

How to programatically verify a file signature?

I have a dll file signed with my private key, here is the signature info in Windows Explorer: Now, using the public key found in the certificate, how can I verify the integrity of the file? I am ...
0
votes
1answer
61 views

What should I consider as a security opt-in?

I'm developing update4j, a Java based update and launch framework. I recently had a small dispute with a fellow contributor and I want to straighten things out. I as few words possible; there is a ...
0
votes
1answer
104 views

Does hashing a file consider its digital signature as well?

I have a signed (using Windows signtool) executable which is hashed by SHA1 algorithm and encrypted using RSA. Now I like to verify the executable to avoid security vulnerabilities. For that I have an ...
2
votes
1answer
46 views

What secure RFID standards are there; for high value item inventory?

I am wanting to use some RFID devices to help with inventory management of some high value items (paintings). The paintings are packed in wooden transport cases, awaiting shipment. Periodically we, ...
0
votes
2answers
43 views

Should binary signature checked before launching from trusted locations?

If need to launch/load binaries from trusted Windows locations like System32 or Windows or Program Files directories, should the binary signature be checked before using it? Only Admin can copy/...
0
votes
1answer
136 views

Using AES encryption to generate MAC (and provide authentication/integrity)

Ignoring that there are far better and more standard approaches to providing authentication and integrity guarantees, what (if any) weaknesses would a system as outlined below that relies on AES (AES/...
1
vote
0answers
58 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
1
vote
2answers
59 views

Confusion about the software and also the digital signature getting modified

I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
1
vote
1answer
125 views

How to encrypt and sign a message with RSA?

I have been doing research on how RSA encryption works (mostly from a math's point of view) and I have come to understand this: By encrypting with the public key of bob, only bob can decrypt it with ...
0
votes
1answer
152 views

Android OS verity signature bypass

I am just getting into custom firmware and rooting phones. I have a phone that appears to be unrootable for whatever reason due to a locked bootloader. The private key was never released and we only ...
2
votes
1answer
50 views

Wrong pgp key was signed

Someone signed my PGP key, by accident (we have never met, but I know the person a little). The wrong signature was uploaded to the SKS pool. Is there anything we can do about it to improve the web ...
-1
votes
1answer
40 views

How do I sign a file using QES(Qualified electronic signature) [closed]

I am to sign a PDF using a QES. How is this done? What provider do you recommend?
1
vote
0answers
90 views

What is the solution to digitally sign email apart from S/MIME and GPG/OpenPGP [closed]

I have tried to implement S/MIME, however, I've found out that S/MIME seems to be obsolete, in my perspective. Since S/MIME cannot operate on Google Chrome or Edge. Another solution I found is ...
2
votes
2answers
141 views

Diffie-Hellman protocol CA, confusing

In the Diffie-Hellman protocol, if the participants have their own private key and a generated public key. How can we determine whether or not they have a trusted CA for authentication or just the ...
1
vote
3answers
178 views

Should I sign software release keys with my own key?

A good practice is verifying software with a team signing key, to ensure the software hasn't been tampered with. The problem When I verify a download, I usually stumble upon the following message: $...
2
votes
1answer
66 views

Sign a lot of messages with same private key [closed]

I'm creating platform where I need to sign a lot of messages (1k/sec), I want to use Ed25519 signature, because it has the best performance. Is it safe to sign that many messages with the same private ...
1
vote
1answer
73 views

How useful is PDF signing in real world usage?

Background senario: So we had a problem where our system (Alice's shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%,...
2
votes
4answers
105 views

Are there any reasons to add payload signature to a rest API with mutual TLS?

We have a B2B Rest API with Client Certificate authentication. Are there any reasons to add also a payload signature check to this API? I'm seeing many service providers which add a digital signature ...
0
votes
2answers
189 views

File carving JPG exif data files

So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving. This ...
3
votes
1answer
120 views

When would a Authenticode signature expire?

I'm curious about how Windows check the Authenticode signature. For example, I would sign test.exe I know that if test.exe doesn't have a TS (timestamp) signature from a TSA (Timestamp Authority)...
1
vote
1answer
61 views

Do any third party time stamping signature services exist?

I'm wondering if there exists any trusted third-party service that I can submit a file, or just a signature of a file, and get back a signature of that file signed with the timestamp of when it was ...
2
votes
0answers
65 views

Which (FOSS) tools (on Linux) support displaying or verifying digital signatures [closed]

So far I have been unable to find any tools on Linux (preferably FOSS) which will display a digital signature when viewing a PDF file and possibly also allow verification of the validity of that ...