Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
1 vote
2 answers
93 views

How does a CA-backed signature works?

I would like to understand how certificate-based signature works, I understand the standard asymmetric key signature where one party signs using their private key, and anyone else can validate this is ...
felartu's user avatar
  • 43
2 votes
4 answers
77 views

Using FIX over TLS, is there a need to sign FIX mesages?

We have 2 servers communicating, server A (a server that I own), and server B (server on the internet that I trust). I get some info from server B, which are FIX messages (https://en.wikipedia.org/...
ethicalhacker's user avatar
0 votes
0 answers
16 views

What protection does the /INTEGRITYCHECK MSVC linker option offer, if a malicious file without it can simply be substituted for the authentic file?

The /INTEGRITYCHECK linker option sets a flag that "tells the memory manager to check for a digital signature in order to load the image in Windows". So the general idea is that this ...
Aaron Huskerson's user avatar
0 votes
1 answer
46 views

are files sent in a TLS channel signed? [duplicate]

I have 2 endpoints that are exchanging data (FIX messages), and the originating endpoint is genrating the fix files are sending them on an ecrypted channel (TLS or Stunnel). In a security audit, it ...
ethicalhacker's user avatar
0 votes
1 answer
90 views

How does RS256 work in a website

I'm developing a website and trying to use the algorithm RS256 to generate and verify the signatures of clients (JWT). Here is how I generate a signature at the client side (I use the Python script to ...
Yves's user avatar
  • 331
0 votes
0 answers
17 views

How XAdES protects against tampering if the certificate is embedded?

Signing XML file with XAdES extension provides the X509 certificate. What is the security point if the certificate is given? Anyone can tamper the data with its own certificate, right? I used to work ...
JessWest's user avatar
-1 votes
1 answer
44 views

Digital Signatures [closed]

In RSA signatures, Alice signs the message using her private key, and Bob verifies the message using Alice's public key. If an attacker has the signed encrypted message, then can they also verify the ...
MxML's user avatar
  • 1
1 vote
1 answer
88 views

Java Cryptography classes - program agnostic usage

We are planning on implementing encryption or digital signatures using any of the available classes provided by the Java Cryptography Architecture (e.g. KeyPair, MessageDigest, Cipher, KeyStore, ...
StephenG's user avatar
2 votes
2 answers
179 views

My web application needs to have my users' private keys to sign documents on their behalf. How do I handle that?

Our web application issues governmental documents for our users. Every one of those documents needs to be signed with a private key. However, because our users find it cumbersome to point their ...
H. Sérvio's user avatar
3 votes
1 answer
342 views

OIDC ID Token nonce as "poor mans digital signature"

In absence of better solutions, is the nonce is an OpenID Connect ID Token usable to serve as digital signature. The process would be as follows: A hash is created from the to-be-signed document/...
Cochise Ruhulessin's user avatar
0 votes
1 answer
91 views

Over what fields is the X509 hash computed over? [duplicate]

Is this how X509 certificates are verified to be valid? The receiver receives the certificate Look at the issuer of the cert, and find the public key of that CA (its hardcoded in the application or ...
user289431's user avatar
0 votes
2 answers
69 views

What could be the correct and secure ways to store and manage public keys?

I am developing an open source project(PKDSA) that uses ED25519 and ED448. My purpose of this project was to help others to enable user-secretless based passwordless authentication. There're a lot of ...
Hern's user avatar
  • 3
1 vote
1 answer
95 views

How does the client get the certificate (and public key) of the delegated authority (OCSP responder) to confirm the response in OCSP?

I have one question regarding the OCSP protocol to check if the certificate is revoked or not. The question is about checking whether the intermediate CA certificate immediately below the root CA is ...
Filip's user avatar
  • 113
0 votes
1 answer
69 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
Vlad A.'s user avatar
0 votes
1 answer
104 views

Payment Gateway rejecting Digitally Signed Payment Message

I am new to digital signatures. I read many problem statements, solutions, and documents but nothing came to my rescue. Payment Message (Text) needs to be digitally signed with the following specs as ...
Vishal's user avatar
  • 1
0 votes
3 answers
128 views

Need for authentication in an offline system

I need to design a scheme, where access to an offline System is granted based on some kind of information/proof of knowledge, provided by a separete system, Prover system. I'm in position where I can ...
pwes's user avatar
  • 111
1 vote
1 answer
56 views

qualified e-signature long-term security

I'm considering to obtain a QES (Qualified electronic signature). But I'm concerned about long term security. The hypothetical scenario is lets say after 10-15 years the algorithms are cracked or ...
akostadinov's user avatar
0 votes
2 answers
71 views

Does verifying a code signature require making a network connection?

Does Windows 11 need to make a network connection to verify a code signature for a .exe or .dll file?
greyyit's user avatar
0 votes
1 answer
93 views

Can an attacker flip bits of a signature to create DoS?

Assume two parties communicating. A sends a message to B signed with its private key. B received the message and verify it using the public key of A. Can an attacker launch a DoS attack by flipping ...
lll's user avatar
  • 3
4 votes
0 answers
226 views

Secure boot + full disk encryption, should I sign the kernel?

I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain. Here's what I did so far : Enroll my own keys in the UEFI firmware Sign my grub bootloader Full disk ...
ShellCode's user avatar
  • 140
0 votes
1 answer
39 views

e-signature + digital signature aws md5

I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents. My question are: Is MD5 (...
user286122's user avatar
1 vote
1 answer
42 views

What is the most secure hardware option for the use of personal eIDAS compliant QES in the EU?

I know that there are two approaches, one with local capsulated storage, such as USB token or smartcard, and the other with cloud-based key vault. Both are secured with a PIN that has to be entered in ...
simeonz's user avatar
  • 113
0 votes
0 answers
82 views

Help understanding PKI MTLS and digital signature architecture

I'm building an identity service using PKI and MTLS for authentication where users are supposed to be able to sign data e.g. a json string or a document. Where I am now I have implemented working MTLS ...
user3677636's user avatar
1 vote
0 answers
40 views

Is there any use case of DAA (Direct Anonymous Attestation) in TPM?

I want to know the use cases of DAA (Direct Anonymous Attestation) in the real world.
user97821's user avatar
0 votes
0 answers
31 views

Is it possible for an app to sign data it generates so that the data can be guaranteed to come from the app? [duplicate]

Is it possible for an app binary to sign content generated by the app such that a verifier can confirm the data was indeed generated by a specific version of the app? For example: A mobile app from a ...
aphoniko's user avatar
1 vote
1 answer
50 views

Confusion Regarding TLS Handshake and Key Exchanges

I know much has been written on this topic, but I am still stuck on some on the details of TLS handshake and I would like to have a better understanding of what happens. I've been using several ...
DoubtingThomas3005's user avatar
1 vote
5 answers
166 views

How does a digital certificate prove authenticity?

Imagine the following scenario: We have Bob that wants to send a message to Alice. Both have a public/private key. Bob uses his private key to sign the digest (hash of the message) with it's private ...
muyat's user avatar
  • 13
1 vote
0 answers
71 views

mTLS on webhooks

I'm not understanding how does Sendgrid verify that's it's me who's sending them the HTTPS request on their webhook endpoint. Specifically, in their docs they show how to obtain their public key (to ...
Jenia Ivanov's user avatar
0 votes
1 answer
84 views

Does signing make any sense when encrypting with secret key is used?

When I use secret key which only one server know for symmetric encryption done with XChaCha20-Poly1305, is any benefit to use signing aswell? As long as only one server knows the secret, doesn't it ...
Szyszka947's user avatar
0 votes
1 answer
167 views

Do git commit signatures reveal key uid if different from git email?

I have a gpg key linked to my identity and real email address. I also use github with their private email functionality "id+username@users.noreply.github.com", which I set as my git email. ...
ahmedsabriz's user avatar
19 votes
2 answers
4k views

What exactly happens when I "validate" a digital signature?

Context: I'm filling my taxes and my country requires me to upload certain documents from my employer to verify the numbers I give to the government. These documents are "digitally signed", ...
WorldGov's user avatar
  • 333
0 votes
1 answer
38 views

Encrypting content with assymetric key pairs as a form of signing [closed]

The use-case is as follows: There is a signer that have a claim or document D who wants any client to be able to verify that D has not been tampered with. I suppose one way to do this is to use ...
Decaf Sux's user avatar
  • 103
0 votes
0 answers
60 views

Reset forgotten subkey password using master key?

Problem For some reason I forgot the passphrase for my GnuPG signing subkey, but I have my master key stored in a separate device. Is there a way to regain access to my subkey? Or should I replace my ...
Christian's user avatar
  • 101
1 vote
3 answers
108 views

Is it normal, that some companies just sign the txt file which contains the sha value of the program?

Scenario A: Suppose I have an .exe file, the provider offers a sha1 txt file with hash value and this txt file is gpg signed. So I check if the hash value matches the exe file and then download the ...
iwab's user avatar
  • 81
2 votes
1 answer
350 views

Best practices for verifying authenticity of public key

When one desires to share their public key openly, besides sharing just the key itself: How does one verify that the key belongs to who it claims to be owned by? What is the use case of the key's ...
a79ce734e1's user avatar
1 vote
1 answer
199 views

Why a public key must be signed with its private pair in PGP

I know about the trust web in PGP. When you sign a key, everybody that trusts you will trust the person with that key. But what is the point of self-signing a key when anybody else can do that with ...
Fish_n_Chips's user avatar
0 votes
0 answers
422 views

Can't sign commit with yubikey, GPG missing something

I don't know much about how yubikeys work, but I'm trying to sign a commit with one of them and I don't even know how to debug the problem. I got: gpg --list-keys /home/lz/.gnupg/pubring.kbx ----------...
Rafaelo's user avatar
  • 11
2 votes
1 answer
392 views

Managing multiple GPG keys

I'm currently attempting to setup my personal GPG key suite for the next few years, and I'm running into a question I don't have a ready answer for. I own 3 yubikeys, Primary/Secondary/Offsite Backup. ...
J Atkin's user avatar
  • 121
0 votes
0 answers
226 views

Using Openssl for Package signing with timestamp

We started with openssl dgst to sign and verify packages successfully. Then we thought we should do a timestamped signatures. That's when the process is bit unclear. We used the openssl ts commands to ...
Progress P's user avatar
2 votes
1 answer
62 views

Adobe uses CA signature type as identifier on signatures created with user certificates

I am testing several PKCS12 keystores with ECC type keys, generated by a CA with RSA key, to sign PDF documents. I have also tested with my own certificates from a demo CA certificate. I use Adobe ...
RobertGG's user avatar
0 votes
1 answer
457 views

Why REST APIs that do not use RSA encryption to secure API keys?

After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key. The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
jojupiter's user avatar
7 votes
4 answers
3k views

Why trust a PGP signature if it is distributed along with the data being verified?

Many downloads offer an OpenPGP signature, which can be used to verify the file, but if a hacker manages to manipulate the file, then he can also simply change the signature key, or not?
iwab's user avatar
  • 81
1 vote
2 answers
69 views

How to prove the authenticity of the telemetry message?

I'm curious what is the most widespread way nowadays to sign the telemetry message from a software program to prove its authenticity to the receiver? Imagine the software (which can run on-premise, at ...
Anton Golubev's user avatar
-1 votes
2 answers
2k views

How to generate SSH keys inside yubikey?

How do I generate SSH keys inside my yubikey, on Ubuntu? There seems to be nowhere to look for this info.
Guerlando OCs's user avatar
0 votes
1 answer
354 views

How to license an offline software that automatically expired in the given amount of time? [duplicate]

Suppose I have a software which I sell to customer to use. I want to include a license that will be expired in let's say 1 year, so that customer need to renew their package. I want to prevent the ...
Wasenshi's user avatar
1 vote
1 answer
252 views

Strip CMS Signature from file (using openssl?)

I have a lot of binary files that contain some data that is signed using CMS. The files have the form: $ openssl cms -inform DER -in test.cms -cmsout -print CMS_ContentInfo: contentType: pkcs7-...
Niklas's user avatar
  • 83
7 votes
1 answer
1k views

How can a .exe be modified and still keep a valid digital signature?

When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true. ...
tree1234's user avatar
0 votes
1 answer
155 views

PGP "real" encryption with private key

When explaining the concept of signing a message, often it is presented as "encrypting with your private key", so that somebody who has the public key can "decrypt" the signature ...
Danya02's user avatar
  • 153
0 votes
2 answers
322 views

Digital signature for API authentication feasible?

Could it be practical to authenticate API request through digital signature (based on headers and message body)? This would be asymmetric instead of something like HMAC which is not a signature. ...
jhurtas's user avatar
  • 101
1 vote
1 answer
510 views

Should refresh tokens be signed?

I'm not using an identity provider. I have a small system with access and refresh tokens and it works well. Assume the system follows the "typical" approach: when user authenticates or ...
lonix's user avatar
  • 415

1
2 3 4 5
18