Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
0
votes
1answer
29 views

JWS: signing HTTP requests

Looking over the spec for JSON Web Signature / JWS https://tools.ietf.org/html/rfc7515, I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, ...
0
votes
0answers
22 views

Certificates for authentication and signing [closed]

Cross posting from SO to here for better reach https://stackoverflow.com/questions/62137112/certificates-for-authentication-and-signing I have a client server scenario. I have both thick client and ...
0
votes
2answers
39 views

How to “trust” data that is posted from one application to other

We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
0
votes
2answers
41 views

How to establish a secure channel with authenticated and authorized access to a remote entity

I have the following problem: There are 3 parties A, B and X. X is holding 2 entities on behalf of A and B. A communicates with X to operate it's own entity. B also communicates with X to operate ...
5
votes
3answers
1k views

Why is a hash sent with data secure?

Hash values are also useful for verifying the integrity of data sent through insecure channels. The hash value of received data can be compared to the hash value of data as it was sent to determine ...
0
votes
2answers
30 views

Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?

As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
0
votes
0answers
38 views

How does jarsigner -verify work?

Every jar file contains a MANIFEST.MF file containing a hash for every file. With jarsigner -verify you can verify a jar file, but what are the steps taken to verify a signed .class file in a jar? I ...
0
votes
2answers
78 views

What if an attacker gets access to public key through an insecure media in digital signature?

If A encrpyts the message and creates signature using his private key and sends through the network then only B with the public key of A can decrypt that message. But what if the attacker gets access ...
2
votes
1answer
86 views

How misappropriation-resistant are common deployed signature formats?

Given an RSA signature as produced by openssl dgst -sha256 -sign rsapriv.pem -out afile.sig afile and without access to the private key used for that, one can¹ come up with a fully functional RSA ...
2
votes
0answers
115 views

Openssl cms verify signature with timestamp and crl

I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
0
votes
0answers
26 views

Whonix Image Download Bad Signature

Using gpgtools on MacOS, I have attempted multiple times to verify the signature of the Whonix image. I get: $ gpg --verify-options show-notations --verify Whonix-*.ova.asc Whonix-*.ova gpg: ...
5
votes
1answer
113 views

Does signing of HTTP requests have any benefit when using TLS?

Signing HTTP requests is all the rage nowadays. The benefits of doing so when communicating over an insecure channel are clear. With signatures you can bring message integrity and authentication to ...
2
votes
1answer
92 views

API request signing best practices

I am reading how different services are handling API signature and authentication. Particularly I was looking at: AWS Signing v4 WeChat Signature Algorithm Alipay Digital Signature Google Maps API I ...
2
votes
0answers
34 views

Authentication and authorization of a subrequest

A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...
0
votes
0answers
38 views

Are there any security implications of signing a hex digest over the binary digest?

Hash functions usually used for signing output a fixed amount of bytes. However, some tools output the data as an ASCII hex string, and other tools use the binary bytes. It is clear that from a ...
0
votes
0answers
58 views

How to store ECDSA public key securely in Android

I am writing an Android application that needs to verify that a request is sent from a trusted party (me). This is my current solution: Storing keys: Generate ECDSA public key / private key from a ...
4
votes
2answers
125 views

Generate digital certificates for employees using the organization's certificate

I live in Peru and we have a small problem in the organization where I work. Dozens of documents are physically signed daily but this is a waste of time since there are documents that must be signed ...
0
votes
0answers
50 views

How to measure security level of digital signature?

I want to measure the guarantee of integrity of a digital signature. I use RSA with a 4096 bit key, and SHA 256, and a passphrase. The level of security is going to depend on these three factors, ...
0
votes
1answer
40 views

Proving a software deployment's origin sourcecode [duplicate]

Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL? sourcecode from commit #10020 at ...
0
votes
0answers
38 views

How to import pgp backup back into smartcard?

I generated a backup of my master key and 3 sub keys following this into these archives: gpg.conf mastersub.key openpgp-recovs.d private-keys-v1.d (contains 4 .key files) pubring.kbx random_seed ...
3
votes
2answers
146 views

“Digital” signatures on real life objects

Although this question may be out of scope, I'm wondering if there's a reliable way to apply a "digital signature" to real life objects in order to prove your ownership of them to a degree. As an ...
0
votes
2answers
126 views

Can I use Let's Encrypt to verify my signing key?

I've made a signing key with GPG and I would like to have it verified since GPG displays a warning whenever a file signed with my key is verified. I've heard of Let's Encrypt but it only talks about ...
0
votes
0answers
34 views

When signature dont guarantee non repudiation

Ehy guys, I read that signature guarantee non repudiation. But in generale exist a way ti no guarantee non repudiation with signature? Ad example Enc(signature(m) should be guarantee Instead for ...
0
votes
0answers
45 views

QES AdESQC TL based Signature Validation Policy

Reading the ETSI EN 319 102-1 V1.1.1 (2016-05) Electronic Signatures and Infrastructures (ESI); Procedures for Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation. The ...
1
vote
1answer
167 views

APK Signature Scheme v1 vs APK Signature Scheme v2/v3

What are the security implications of using the APK Signature Scheme v1 instead of the APK Signature Scheme v2/v3? Are there any additional attack vectors for v1 except for direct attack vectors in an ...
0
votes
1answer
57 views

Cryptographically signing content / download

Let's say that I have an executable running on a client machine, and, it requires to download some updates on a regular basis. The solution uses TLS to communicate with the download server. I would ...
0
votes
0answers
62 views

The RSA-CRT-faults lenstra's attack signature

I was reading this [paper]https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf)1 about the use of faults in the computation of signatures with the CRT optimized version of RSA(see the end of the ...
1
vote
1answer
159 views

Is it possible to sign a DVD?

I work on a project where DVDs with configuration files and software updates are delivered periodically to end users, and our software loads those discs. For example, we might load a disc with an ...
1
vote
1answer
55 views

Public Digital Signature Validation with JWE

After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, ...
1
vote
1answer
57 views

How can I preserve the uniqueness of a document without a database?

I’m willing to create a system of transferable documents (identified by it’s ID) whose author can transfer his ownership of that document to another person (identified by his/her ID). For example: ...
1
vote
3answers
175 views

Difference between certificate and digital signature [duplicate]

What is the difference between a digital certificate and a digital signature? Read on the internet that the digital signature is the result of encrypting with a private key, the 'hash' of the message ...
5
votes
1answer
163 views

What guarantees does GPG-signing a git commit provide?

It's pretty clear that GPG signing and GitHub ssh keys serve different purposes But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
0
votes
0answers
80 views

Do the encrypt_and_digest() and decrypt_and_verify() methods of the pycryptodome module in python 3 also perform the electronic signature process?

Do the encrypt_and_digest() and decrypt_and_verify() methods in pycryptodome also perform the electronic signature process? I have seen on the internet that the electronic signature consists of ...
1
vote
0answers
14 views

How to make data content provable for specific timestamp? [duplicate]

Let me explain it with an example: Consider that timestamp of today is 1262304000000 (2010-01-01 00:00:00.00) and you have a web page (or file) with content "AAA". Content on this page may change ...
1
vote
0answers
107 views

Breakdown of signature verification in CertificateVerify (TLS 1.3) with RSA-PSS

I'm debugging a TLS v1.3 client program, which failed to verify the signature in server's CertificateVerify, so I'm learning the procedures for verifying the signature from server's CertificateVerify ...
1
vote
0answers
54 views

Forward secrecy (plausible deniability) and storing messages

How do messengers, like signal or XMPP-omemo messengers, store their messages? Since the session key is only valid for the current session, how can such extensions like MAM (message archiving on XMPP ...
2
votes
2answers
144 views

Hawk vs. API key authentication

For a HTTP(S) API, which is better (/ which is better under which circumstances)? Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...
0
votes
1answer
102 views

How can we use digital signatures for mutual authentication between two computers?

I get the fact that we can use digital signatures for authenticating the signer (since they are using their private key to create the signature, and this is known only to the signer ). But how can the ...
5
votes
1answer
140 views

Alternatives to cryptographic signatures

I have a program I am developing and am currently using ed25519 to cryptographicaly sign messages. However, even those signatures are longer than I would like (64 bytes + the message). The messages ...
0
votes
1answer
118 views

What is a TSA policy OID?

What is TSA policy OID? Is it a unique identifier of a timestamp server given by a world wide authority? Does that mean that no two servers can have the same oid? Or is it an identifier of the ...
2
votes
1answer
87 views

How reliable is Virustotal's file signature check?

I downloaded a setup.msi file from an untrusted website. Virustotal says it's a signed file and valid signature, by the developer company and "GlobalSign Extended Validation CodeSigning CA" 3 times ...
2
votes
1answer
76 views

Questions on TLS 1.2 RFC - Clarification or references needed

I have been reading RFC 5246 on TLS 1.2 and have a few questions on algorithms chosen. Before I start, let me clarify that I am reading on 1.2 and not 1.3 because my ultimate interest is in DTLS 1.2. ...
0
votes
0answers
49 views

Digital signature verification with Client Certificates

We have a client server system implemented. Where client communicates using HTTP request. We have a one time token based authentication system and also sign the URL for authenticity. We do the ...
1
vote
0answers
32 views

How do I check if my key is updated in a keyserver after I resend it with new signatures?

I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures. The thing is that when ...
1
vote
0answers
43 views

What does jarsigner verify in the first place (integrity or authenticity)?

I was reading sth about android code signing and have run into this statement: The second jarsigner command at v in Listing 3-7 first verifies the signature block and signing certificate, ...
5
votes
1answer
492 views

JWT: Choosing between HMAC and RSA

It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 ...
0
votes
1answer
70 views

Does same hash value indicate a valid key?

I send a message to someone along with a public key, which they use to hash the message. If they get the same hash value that I get when I hash the same content with the private key, does that safely ...
1
vote
5answers
264 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
1
vote
1answer
95 views

Does Integrity assures protection from unauthorized read, without any modification?

I'm not quite sure if I understood integrity deep enough. Let's suppose that Alice and Bob are using a public-key algorithm and using signatures to assure their data integrity. A hacker was able to ...
2
votes
1answer
140 views

Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?

I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file: How can I tell if it was signed with an extended validation (EV) code-signing certificate? ...

1
2 3 4 5
15