Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

4
votes
3answers
140 views

What if somebody sends me genuine certificate that they do not own? [on hold]

I just started learning about the digital certificates, its architecture and how it works internally. What will happen if someone sends me a genuine certificate for authentication which does not ...
0
votes
1answer
23 views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
0
votes
0answers
32 views

How to sign ECDSA with pem private key? [migrated]

I have private key with pem format. -----BEGIN EC PRIVATE KEY----- MHQCAQEEIBAFWFAlCWPb8IvM4yHLLKBIN/mEJU9cZnM5JD2U2EmAoAcGBSuBBAAK oUQDQgAErMGUjbHcEf7Gk9gVOOlWdqSaGc0YhE5HBPqhoniBUG8MTx5AT7mxtuyn ...
0
votes
0answers
18 views

Can a ring signature be used to prove that entities agreed on a statement?

I recently developed some interest in ring signatures. According to wiki the original paper mentions two possible application: make it possible to verify that a messages comes from a group of ...
1
vote
0answers
31 views

How to sign a .jar file using XMSS (PQC) Signature Scheme with JarSigner

I am trying to use JarSigner to sign .jar files with XMSS Signatures. With the use of the JCA/JCE Post-Quantum Cryptography Provider from BouncyCastle it is possible to generate XMSS and XMSSMT ...
0
votes
0answers
41 views

Debian repository security: Is switching mirrors dangerous?

I have been recently alerted about https://blog.packagecloud.io/eng/2018/02/21/attacks-against-secure-apt-repositories/ . The site claims that "Acquire::AllowInsecureRepositories" is enabled by ...
25
votes
5answers
7k views

What does “signing” a file really mean?

I'm a bit new to security and trying to get the concepts properly. I'm wondering what exactly "signing" a file (a certificate, an apk file, or something else) means? Do we sign the whole file so ...
0
votes
0answers
11 views

Extended key usage attributes for PKCS#7 signatures of backup files

We are considering creating timestamped PKCS#7 detached signatures for our backup files for audit purposes (timestamp would be created by an external trusted TSA). Which extended key usage (EKU) ...
0
votes
0answers
67 views

Authenticate user with AD and obtain user private key

I have built an application which is for signing a document (Digital Signature). Is it possible that I prompt for AD Username and Password for anyone who accessing the application? How can I ...
1
vote
1answer
96 views

How can I use 'safe' Elliptic Curve algorithms in .Net Core?

I'm looking to build my own digital signature operations into a program I'm writing, and the nuances of cryptography are a bit beyond me. According to this website the NIST/NSA algorithms (P-224, P-...
1
vote
1answer
41 views

Public Key Crypto - sign Bob's name into Alice's message or encrypt Alice's name

I was reading Defective Sign & Encrypt in S/MIME,  PKCS#7, MOSS, PEM, PGP, and XML and in section 5.1  Naming Repairs By signing Bob's name into her message, Alice explicitly identifies him ...
1
vote
1answer
80 views

Signal Protocol: How is identity exchanged if a key exchange hasn't happened yet?

On Signal's blog they mention that keys for accessing your profile are exchanged normally with your contacts using the Signal Protocol just like messages are (implying they are already contacts and ...
3
votes
3answers
127 views

Is it possible to use “cryptographic hash function” for “digital signature”?

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input. However, is it possible to use a cryptographic hash function for ...
1
vote
0answers
33 views

Working with Security Metadata in APK file

According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
0
votes
2answers
40 views

Allow setting both server URL and public key - security hole?

We have a licensing system where our software, a commercial product we sell to people, contacts our licensing server when starting to get an OK to run. It contacts our licensing URL and passes up an ...
0
votes
2answers
135 views

Is there any list of vulnerabilities and their signatures?

I am looking for a list of known vulnerabilities and their signatures. Is there any publicly available list of security vulnerabilities and their signatures? NVD (NATIONAL VULNERABILITY DATABASE) ...
-3
votes
1answer
100 views

Explain how a digital signature is employed for providing a proof of authenticity (not integrity!) of a file [closed]

Explain how a digital signature is employed for providing a proof of authenticity (not integrity!) of a file.
1
vote
2answers
93 views

Does a File's Checksum Change after it is Digitally Signed?

From my understanding, when you digitally sign a file, it changes that file's checksum because they are bundled together. Example of what I mean: file1.txt only contains the letter 'd' and the ...
1
vote
2answers
78 views

Why digital signatures needs different algorithm

Why digital signatures uses algorithms such as DSA, ECDSA or RSA-PSS, and not just the RSA algorithm to encrypt the message hash with the private key? Is the choice more security or performance ...
3
votes
1answer
65 views

Concepts of PKI Encryption and Digital Signature Authentication [duplicate]

I am trying to understand how SSL uses PKI and Digital Signature authentication to ensure secure and verified communications. I've read various sources online and from what I can tell the basic ...
1
vote
2answers
59 views

What happens when the timestamper's certificate expires?

What happens when the timestampers certificate expires? If the code is now untrusted, can it be re-stamped without re-signing? If not, what good does this timestamp do me if my cert is valid until the ...
0
votes
2answers
42 views

How to overcome slow process of creating and verifying digital signature?

From what I understood is the digital signature is a long process and have following steps: Hashing the Message Plain Text using a well-known (public) hashing algorithm. Encrypting it with sender's (...
2
votes
0answers
16 views

GPG self-signature default check level

I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned. When issuing gpg --check-sigs one ...
2
votes
1answer
87 views

How to programatically verify a file signature?

I have a dll file signed with my private key, here is the signature info in Windows Explorer: Now, using the public key found in the certificate, how can I verify the integrity of the file? I am ...
0
votes
1answer
58 views

What should I consider as a security opt-in?

I'm developing update4j, a Java based update and launch framework. I recently had a small dispute with a fellow contributor and I want to straighten things out. I as few words possible; there is a ...
0
votes
1answer
96 views

Does hashing a file consider its digital signature as well?

I have a signed (using Windows signtool) executable which is hashed by SHA1 algorithm and encrypted using RSA. Now I like to verify the executable to avoid security vulnerabilities. For that I have an ...
2
votes
1answer
42 views

What secure RFID standards are there; for high value item inventory?

I am wanting to use some RFID devices to help with inventory management of some high value items (paintings). The paintings are packed in wooden transport cases, awaiting shipment. Periodically we, ...
0
votes
2answers
35 views

Should binary signature checked before launching from trusted locations?

If need to launch/load binaries from trusted Windows locations like System32 or Windows or Program Files directories, should the binary signature be checked before using it? Only Admin can copy/...
0
votes
1answer
89 views

Using AES encryption to generate MAC (and provide authentication/integrity)

Ignoring that there are far better and more standard approaches to providing authentication and integrity guarantees, what (if any) weaknesses would a system as outlined below that relies on AES (AES/...
1
vote
0answers
56 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
1
vote
2answers
57 views

Confusion about the software and also the digital signature getting modified

I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
1
vote
1answer
104 views

How to encrypt and sign a message with RSA?

I have been doing research on how RSA encryption works (mostly from a math's point of view) and I have come to understand this: By encrypting with the public key of bob, only bob can decrypt it with ...
0
votes
1answer
88 views

Android OS verity signature bypass

I am just getting into custom firmware and rooting phones. I have a phone that appears to be unrootable for whatever reason due to a locked bootloader. The private key was never released and we only ...
2
votes
1answer
47 views

Wrong pgp key was signed

Someone signed my PGP key, by accident (we have never met, but I know the person a little). The wrong signature was uploaded to the SKS pool. Is there anything we can do about it to improve the web ...
0
votes
0answers
39 views

python-gnupg sign & verify a tar archive

I am using python-gpg to sign / encrypt / verify / decrypt a tar archive. code snippet - # import private key into gnupghome _pvtKey = urllib2.urlopen(_certurl) _pv_data = _pvtKey.read() gpg....
-1
votes
1answer
31 views

How do I sign a file using QES(Qualified electronic signature) [closed]

I am to sign a PDF using a QES. How is this done? What provider do you recommend?
1
vote
0answers
71 views

What is the solution to digitally sign email apart from S/MIME and GPG/OpenPGP [closed]

I have tried to implement S/MIME, however, I've found out that S/MIME seems to be obsolete, in my perspective. Since S/MIME cannot operate on Google Chrome or Edge. Another solution I found is ...
2
votes
2answers
113 views

Diffie-Hellman protocol CA, confusing

In the Diffie-Hellman protocol, if the participants have their own private key and a generated public key. How can we determine whether or not they have a trusted CA for authentication or just the ...
1
vote
3answers
158 views

Should I sign software release keys with my own key?

A good practice is verifying software with a team signing key, to ensure the software hasn't been tampered with. The problem When I verify a download, I usually stumble upon the following message: $...
2
votes
1answer
64 views

Sign a lot of messages with same private key [closed]

I'm creating platform where I need to sign a lot of messages (1k/sec), I want to use Ed25519 signature, because it has the best performance. Is it safe to sign that many messages with the same private ...
1
vote
1answer
72 views

How useful is PDF signing in real world usage?

Background senario: So we had a problem where our system (Alice's shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%,...
2
votes
4answers
79 views

Are there any reasons to add payload signature to a rest API with mutual TLS?

We have a B2B Rest API with Client Certificate authentication. Are there any reasons to add also a payload signature check to this API? I'm seeing many service providers which add a digital signature ...
0
votes
2answers
144 views

File carving JPG exif data files

So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving. This ...
2
votes
1answer
88 views

When would a Authenticode signature expire?

I'm curious about how Windows check the Authenticode signature. For example, I would sign test.exe I know that if test.exe doesn't have a TS (timestamp) signature from a TSA (Timestamp Authority)...
0
votes
1answer
45 views

Do any third party time stamping signature services exist?

I'm wondering if there exists any trusted third-party service that I can submit a file, or just a signature of a file, and get back a signature of that file signed with the timestamp of when it was ...
2
votes
0answers
64 views

Which (FOSS) tools (on Linux) support displaying or verifying digital signatures [closed]

So far I have been unable to find any tools on Linux (preferably FOSS) which will display a digital signature when viewing a PDF file and possibly also allow verification of the validity of that ...
0
votes
1answer
53 views

Comparison of signature algorithms HMACSHA1 and RSASHA1

Compare and contrast the signature algorithms HMACSHA1 and RSASHA1. Assume that the aim here is to make it infeasible to generate valid message+sig pairs without knowing a certain private token/key (...
2
votes
1answer
141 views

Can't understand how stuxnet was bogusly signed

Wikipedia says that Its device drivers have been digitally signed with the private keys of two certificates that were stolen from separate well-known companies, JMicron and Realtek, both ...
7
votes
2answers
2k views

Is it safe to store APK signing passwords in private git repository?

I develop android game using cocos2d-x. For android release, it contain this fields in proj.android/gradle.properties: # uncomment it and fill in sign information for release mode #RELEASE_STORE_FILE=...
0
votes
1answer
479 views

Amazon AWS KMS - Concept of signing in general and with JWT

Looking into Amazon AWS KMS (Key Management System). Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/...