Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
1 vote
1 answer
18 views

Managing multiple GPG keys

I'm currently attempting to setup my personal GPG key suite for the next few years, and I'm running into a question I don't have a ready answer for. I own 3 yubikeys, Primary/Secondary/Offsite Backup. ...
user avatar
  • 111
0 votes
0 answers
35 views

Using Openssl for Package signing with timestamp

We started with openssl dgst to sign and verify packages successfully. Then we thought we should do a timestamped signatures. That's when the process is bit unclear. We used the openssl ts commands to ...
user avatar
1 vote
1 answer
38 views

Adobe uses CA signature type as identifier on signatures created with user certificates

I am testing several PKCS12 keystores with ECC type keys, generated by a CA with RSA key, to sign PDF documents. I have also tested with my own certificates from a demo CA certificate. I use Adobe ...
user avatar
0 votes
0 answers
23 views

How reliable is Window's verified publisher system?

I assume anyone can with some effort add their certificate under name X to their database, in that case, is there anything stopping a fake publisher from adding themselves with the name of a legit ...
user avatar
  • 153
0 votes
1 answer
52 views

Why REST APIs that do not use RSA encryption to secure API keys?

After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key. The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
user avatar
7 votes
4 answers
2k views

Why trust a PGP signature if it is distributed along with the data being verified?

Many downloads offer an OpenPGP signature, which can be used to verify the file, but if a hacker manages to manipulate the file, then he can also simply change the signature key, or not?
user avatar
  • 71
1 vote
2 answers
57 views

How to prove the authenticity of the telemetry message?

I'm curious what is the most widespread way nowadays to sign the telemetry message from a software program to prove its authenticity to the receiver? Imagine the software (which can run on-premise, at ...
user avatar
-1 votes
1 answer
181 views

How to generate SSH keys inside yubikey?

How do I generate SSH keys inside my yubikey, on Ubuntu? There seems to be nowhere to look for this info.
user avatar
0 votes
1 answer
101 views

How to license an offline software that automatically expired in the given amount of time? [duplicate]

Suppose I have a software which I sell to customer to use. I want to include a license that will be expired in let's say 1 year, so that customer need to renew their package. I want to prevent the ...
user avatar
0 votes
0 answers
39 views

Strip CMS Signature from file (using openssl?)

I have a lot of binary files that contain some data that is signed using CMS. The files have the form: $ openssl cms -inform DER -in test.cms -cmsout -print CMS_ContentInfo: contentType: pkcs7-...
user avatar
  • 73
6 votes
1 answer
369 views

How can a .exe be modified and still keep a valid digital signature?

When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true. ...
user avatar
0 votes
1 answer
59 views

PGP "real" encryption with private key

When explaining the concept of signing a message, often it is presented as "encrypting with your private key", so that somebody who has the public key can "decrypt" the signature ...
user avatar
  • 131
0 votes
2 answers
43 views

Digital signature for API authentication feasible?

Could it be practical to authenticate API request through digital signature (based on headers and message body)? This would be asymmetric instead of something like HMAC which is not a signature. ...
user avatar
  • 101
1 vote
1 answer
66 views

Should refresh tokens be signed?

I'm not using an identity provider. I have a small system with access and refresh tokens and it works well. Assume the system follows the "typical" approach: when user authenticates or ...
user avatar
  • 333
1 vote
0 answers
32 views

Terminology for exchanging one piece of signed information for another

Applications that use cryptographically signed information for multiple purposes have the risk that one piece of signed information can be exchanged with another. When you use JWTs as session tokens, ...
user avatar
  • 28.6k
0 votes
0 answers
52 views

Is it possible for a company to buy a signing certificate so that everything it signs (Software,SSL, Documents) states its from that company?

If I work for a company that wants to sign its own certificates for its website, documents and software it writes, is it possible? I have read a couple of post on here from around 10/8 years ago but ...
user avatar
  • 109
3 votes
1 answer
502 views

What signature and certificate signing is all about

I know that X.509 certificate signing process includes creating a CSR (certificate signing request) and then the following happens: Some data's from the certificate to be signed hash is computed ...
user avatar
  • 143
0 votes
0 answers
34 views

How does "./" affects signature generation for files, in a PHP based web application?

I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
user avatar
1 vote
0 answers
49 views

Does Google Update perform cryptographic checks against releases?

My company is looking to allow Google Chrome to self-update, a necessity as we are finding it difficult to keep up with their release cycle in order to mitigate vulnerabilities. On the pro side, ...
user avatar
  • 169
1 vote
0 answers
28 views

Role of public and private keys of client certificate in mTLS [duplicate]

I'm curious to know how mTLS works in more detail in regard to client authentication. Firstly, I issued 3 certificates: root CA, server and client. The last two are signed with the root CA. Secondly, ...
user avatar
  • 143
0 votes
1 answer
73 views

Looking for a solution: trusted identity with corresponding digital signatures (QES) for intercontinental charity

We are looking for a solution to meet the needs of a UK incorporated charity (CIO) that has three to seven trustees from at least three continents. Obligations as trustees of a board include signing (...
user avatar
  • 605
0 votes
0 answers
22 views

Is there any way I can verify that my app in not modified or tempered (code is changed or something) on clients phone? [duplicate]

I have created an App and made clients install it on there phone. When my app tries to connect to server or request data from my server I want to verify if that app is genuinely my app and not ...
user avatar
0 votes
2 answers
135 views

Exact meaning of RSA key in `gpg --verify` output

When verifying a pgp signed message using GnuPG, one gets an output similar to the following: gpg: Signature made Fr 07 Jan 2022 13:42:21 CET gpg: using RSA key ...
user avatar
0 votes
0 answers
63 views

double hashing for code signing and verification

I have environmental constraints where the cyber and safety functions are segregated such that safety operations are handled by one unit and cyber operations such as firewall, HIDS, secure storage etc....
user avatar
0 votes
2 answers
103 views

HSM High Volume Keys

Our project is to apply digital signature to PDF, so each user should have their own key pairs and a certificate. To keep key securely, we plan to purchase HSM, but from what I understand HSM have a ...
user avatar
  • 101
0 votes
0 answers
48 views

How do Cloud-based services provide Qualified Electronic Signatures?

From what I know about QES, they come on smart cards and USB tokens and are password protected. When a site asks you for a client certificate, you need to have it plugged in and enter the password ...
user avatar
  • 101
2 votes
1 answer
133 views

Git Signing commits in a private repo

Linus mentioned in 2009 that "Signing each commit is totally stupid". Has the common view evolved on this subject since then ? Doesn't it protect against someone usurping your identity to ...
user avatar
  • 21
0 votes
1 answer
69 views

mTLS Client Authentication by Signing Arbitrary Message using Browser

this is my first post here in the area of ​​security and encryption. I will try to be succinct, and let you know that I am not an expert in security. Context: My client (visitor) has an X509 ...
user avatar
3 votes
2 answers
180 views

How can I prove the content of a PGP-encrypted message to a third party?

Imagine this scenario A StackExchange user sends you a PGP-encrypted message You decrypt the message and discover that you are being blackmailed You report the message to the admins but they are ...
user avatar
  • 33
1 vote
1 answer
121 views

Parse VBA Macro Digital Signature

When I open up my macro-enabled office files (i.e., .docm, .xlsm, .pptm) that contain signed macros as a Zip file, I see the following three files which I assume contain the digital signatures for the ...
user avatar
  • 215
0 votes
1 answer
166 views

Why does length of Signatures in two certificates using same Signature Algorithm sha256WithRSAEncryption is different?

I have this recent Wikipedia certificate issued by intermediate CA Let's encrypt: Certificate: Data: Version: 3 (0x2) Serial Number: 03:95:2f:46:69:de:e4:d2:19:35:7f:f0:...
user avatar
2 votes
2 answers
129 views

Digital Signatures validity when changing Certificate Authority

An enterprise has its internal PKI-1 (Root CA) that issues certificates to sign document using CAdES-C (CAdES-LT); with Complete Validation Data References and revocation references. Now this ...
user avatar
0 votes
0 answers
61 views

Strange keystore from payment processor

I am working on an older software for a company at the moment and in my work have been upgrading a number of libraries. The app connects to a web service hosted by the third party payment processor, ...
user avatar
  • 1,082
0 votes
1 answer
238 views

Is DSA-1024 safe to sign package repositories ? What are the reasons?

I recently found that the latest release of a major Linux distribution (MX Linux) uses DSA-1024 in /etc/apt/trusted.gpg and in /etc/apt/trusted.gpg.d/*.gpg It also probably uses SHA-1 as the signature ...
user avatar
0 votes
1 answer
176 views

Signing Binaries in CI/CD

I've been considering how continuous integration/delivery environments handle code signing. If I maintain some open source project which uses a CD environment to build binaries to ship to users, I may ...
user avatar
0 votes
1 answer
105 views

Keeping a whitelist of GPG keys on git server

Why don’t git servers (gitlab, github, etc…) allow for a whitelist of public GPG keys allowed to sign commits? For example, Alice owns a GPG key with fingerprint 0A1B2C3D while Bob’s is 4E5F0A0B. They ...
user avatar
  • 121
0 votes
1 answer
116 views

Possible to limit an SSL certificate holder to issuing redirects?

Is it possible to issue an SSL certificate that limits the certificate holder to issuing https redirects? Or more generally, limiting the holder to issuing specified data through the secure pipe, ...
user avatar
0 votes
0 answers
80 views

Docker: How to download & verify a publisher's root key (out-of-band, distinct-domain cryptographic verification, WoT)

For a given publisher of docker images on Docker Hub (let's say debian), how do I download their root release/image signing key and verify its authenticity from multiple sources out-of-band from each-...
user avatar
0 votes
1 answer
233 views

How hard is to reverse engineer a signature for a given message?

Given the following situation: User makes a request for temporary access to a video Backend responds with a json file containing timeAllowedInSeconds: 5 Backend also responds with the signature of ...
user avatar
  • 101
0 votes
1 answer
104 views

designing updater with certificate renewal in mind

A program A downloads signed executables and other signed configuration files. Configuration files have signature appended at the end of files. To verify their integrity and creator, it uses the ...
user avatar
  • 639
1 vote
0 answers
113 views

How to go about checking if Windows is running any untrusted drivers (programatically)

I want to enforce a rule that my program start only if, at the time it launches, there are no untrusted kernel drivers running. I'm aware and have already tested file signature verification using ...
user avatar
  • 111
2 votes
1 answer
190 views

How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?

Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include: Hosting the website under HTTPS; ...
user avatar
  • 5,587
0 votes
1 answer
196 views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
user avatar
0 votes
2 answers
136 views

Is it feasible to calculate an HMAC-SHA512/256 MAC from an environment that only supports HMAC-SHA512?

I need to verify a MAC for something signed with HMAC-SHA512/256, however, the language I'm using (Salesforce's Apex language) doesn't have support for that algorithm. It does have HMAC-SHA512 and ...
user avatar
  • 627
0 votes
0 answers
147 views

Use an Ethereum signature for API GET authentication

The following situation: I have a web app (stateless) Users are connected the web app using WalletConnect to connect their Ethereum Wallet. Cannot therefore not use any API keys or tokens there is a ...
user avatar
  • 1
0 votes
2 answers
188 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
user avatar
  • 103
0 votes
1 answer
136 views

Combining confidentiality, authenticity and data integrity to form secure URL

There are clients (mobile application), they can share links to their profile info, which should be confidential. The link expires in 5 minutes (configured). They set Auth-Code so that the one who ...
user avatar
  • 147
1 vote
0 answers
80 views

Tooling and serialization format for DNSSEC signture chain

I'm looking for a compact, canonical (and possibly but not necessarily human-readable) format for serializing the signature chain for a RRset (or proof that it lies under an insecure delegation) for ...
user avatar
0 votes
1 answer
300 views

Forging message using the secret key in digital signature?

In Digital Signature Scheme, is it possible to forge a message just by knowing the secret key, or does the attacker should also know the hash function used by the original sender? Also does the secret-...
user avatar
0 votes
1 answer
254 views

If a file is digitally signed, is posting a hash very useful for security purposes?

In this question I asked about how to handle situations when SHA-256 hashes are not available for a file downloaded from the internet that contains executable code. Another community member ...
user avatar

1
2 3 4 5
17