Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

0
votes
2answers
27 views

How to overcome slow process of creating and verifying digital signature?

From what I understood is the digital signature is a long process and have following steps: Hashing the Message Plain Text using a well-known (public) hashing algorithm. Encrypting it with sender's (...
1
vote
0answers
5 views

GPG self-signature default check level

I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned. When issuing gpg --check-sigs one ...
2
votes
1answer
69 views

How to programatically verify a file signature?

I have a dll file signed with my private key, here is the signature info in Windows Explorer: Now, using the public key found in the certificate, how can I verify the integrity of the file? I am ...
0
votes
1answer
50 views

What should I consider as a security opt-in?

I'm developing update4j, a Java based update and launch framework. I recently had a small dispute with a fellow contributor and I want to straighten things out. I as few words possible; there is a ...
0
votes
1answer
89 views

Does hashing a file consider its digital signature as well?

I have a signed (using Windows signtool) executable which is hashed by SHA1 algorithm and encrypted using RSA. Now I like to verify the executable to avoid security vulnerabilities. For that I have an ...
1
vote
0answers
24 views

What secure RFID standards are there; for high value item inventory?

I am wanting to use some RFID devices to help with inventory management of some high value items (paintings). The paintings are packed in wooden transport cases, awaiting shipment. Periodically we, ...
0
votes
0answers
33 views

iPhone hardware certificate / MIC?

Do iOS devices have some sort of unique hardware certificates signed by Apple? I mean built-in in every device, pre-installed by manufacturer (Apple). Is it possible with iOS SDK to sign the data ...
0
votes
1answer
24 views

Should binary signature checked before launching from trusted locations?

If need to launch/load binaries from trusted Windows locations like System32 or Windows or Program Files directories, should the binary signature be checked before using it? Only Admin can copy/...
0
votes
1answer
51 views

Using AES encryption to generate MAC (and provide authentication/integrity)

Ignoring that there are far better and more standard approaches to providing authentication and integrity guarantees, what (if any) weaknesses would a system as outlined below that relies on AES (AES/...
1
vote
0answers
49 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
1
vote
2answers
54 views

Confusion about the software and also the digital signature getting modified

I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
1
vote
2answers
56 views

How to encrypt and sign a message with RSA?

I have been doing research on how RSA encryption works (mostly from a math's point of view) and I have come to understand this: By encrypting with the public key of bob, only bob can decrypt it with ...
0
votes
1answer
57 views

Android OS verity signature bypass

I am just getting into custom firmware and rooting phones. I have a phone that appears to be unrootable for whatever reason due to a locked bootloader. The private key was never released and we only ...
1
vote
1answer
43 views

Wrong pgp key was signed

Someone signed my PGP key, by accident (we have never met, but I know the person a little). The wrong signature was uploaded to the SKS pool. Is there anything we can do about it to improve the web ...
0
votes
0answers
9 views

python-gnupg sign & verify a tar archive

I am using python-gpg to sign / encrypt / verify / decrypt a tar archive. code snippet - # import private key into gnupghome _pvtKey = urllib2.urlopen(_certurl) _pv_data = _pvtKey.read() gpg....
-1
votes
1answer
22 views

How do I sign a file using QES(Qualified electronic signature) [closed]

I am to sign a PDF using a QES. How is this done? What provider do you recommend?
1
vote
0answers
59 views

What is the solution to digitally sign email apart from S/MIME and GPG/OpenPGP [closed]

I have tried to implement S/MIME, however, I've found out that S/MIME seems to be obsolete, in my perspective. Since S/MIME cannot operate on Google Chrome or Edge. Another solution I found is ...
2
votes
2answers
86 views

Diffie-Hellman protocol CA, confusing

In the Diffie-Hellman protocol, if the participants have their own private key and a generated public key. How can we determine whether or not they have a trusted CA for authentication or just the ...
1
vote
3answers
138 views

Should I sign software release keys with my own key?

A good practice is verifying software with a team signing key, to ensure the software hasn't been tampered with. The problem When I verify a download, I usually stumble upon the following message: $...
2
votes
1answer
64 views

Sign a lot of messages with same private key [closed]

I'm creating platform where I need to sign a lot of messages (1k/sec), I want to use Ed25519 signature, because it has the best performance. Is it safe to sign that many messages with the same private ...
1
vote
1answer
71 views

How useful is PDF signing in real world usage?

Background senario: So we had a problem where our system (Alice's shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%,...
2
votes
4answers
65 views

Are there any reasons to add payload signature to a rest API with mutual TLS?

We have a B2B Rest API with Client Certificate authentication. Are there any reasons to add also a payload signature check to this API? I'm seeing many service providers which add a digital signature ...
0
votes
2answers
76 views

File carving JPG exif data files

So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving. This ...
2
votes
1answer
63 views

When would a Authenticode signature expire?

I'm curious about how Windows check the Authenticode signature. For example, I would sign test.exe I know that if test.exe doesn't have a TS (timestamp) signature from a TSA (Timestamp Authority)...
0
votes
1answer
44 views

Do any third party time stamping signature services exist?

I'm wondering if there exists any trusted third-party service that I can submit a file, or just a signature of a file, and get back a signature of that file signed with the timestamp of when it was ...
2
votes
0answers
63 views

Which (FOSS) tools (on Linux) support displaying or verifying digital signatures [closed]

So far I have been unable to find any tools on Linux (preferably FOSS) which will display a digital signature when viewing a PDF file and possibly also allow verification of the validity of that ...
0
votes
1answer
41 views

Comparison of signature algorithms HMACSHA1 and RSASHA1

Compare and contrast the signature algorithms HMACSHA1 and RSASHA1. Assume that the aim here is to make it infeasible to generate valid message+sig pairs without knowing a certain private token/key (...
2
votes
1answer
131 views

Can't understand how stuxnet was bogusly signed

Wikipedia says that Its device drivers have been digitally signed with the private keys of two certificates that were stolen from separate well-known companies, JMicron and Realtek, both ...
7
votes
2answers
1k views

Is it safe to store APK signing passwords in private git repository?

I develop android game using cocos2d-x. For android release, it contain this fields in proj.android/gradle.properties: # uncomment it and fill in sign information for release mode #RELEASE_STORE_FILE=...
0
votes
1answer
246 views

Amazon AWS KMS - Concept of signing in general and with JWT

Looking into Amazon AWS KMS (Key Management System). Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/...
2
votes
1answer
142 views

Is Ed25519 still secure, despite the fault attack published in 2017?

I heard that Ed25519 is a new digital signature. It has smaller public key size and generates a public key more quickly. I read an article about Ed25519 titled Practical fault attack against the ...
1
vote
1answer
23 views

Can I describe the PDF's certificate-based signatures using W3C's DSIG Core?

Can I map the specialized specifications of PDF's certificate-based signatures into the [XML DSIG Core] standard? I'm imagining PDF as an "XML file analog", to be mapped into the W3C's ecosystem. ......
1
vote
0answers
30 views

How to assign not-PDF file by digital certificate?

XML, EPUB, etc. formats need also to be signed by digital certificate, like in the PDF's certificate-based signatures. There are reliable open-standards and open-source software to accomplish it? PS: ...
3
votes
1answer
127 views

How can you change the plaintext of the given secret message which is in AES-256 CBC

Say you have the secret message encrypted with AES-256 in CBC mode 5a04ec902686fb05a6b7a338b6e07760 14c4e6965fc2ed2cd358754494aceffa where the first 16 Byte is the initial vector, the second 16 Byte ...
1
vote
1answer
77 views

How to cryptographically guarantee that data came from a trusted application on a mobile device?

I'd like to have an open source application generate data and sign it in such a way that anyone with access to the data alone can know for sure it was generated by that open source code. More ...
1
vote
1answer
57 views

How can I limit which key sizes and signature algorithm of the next certificate in the certificate chain are allowed?

I have walked through the different fields of x509 certificates and came across some fields which enable to limit the usage of the certificate (for example for certain domains). Is it possible to ...
0
votes
1answer
76 views

DNSSEC - does the domain owner owns a key?

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
-2
votes
1answer
122 views

How do I detect if the public key in a digital certificate is modified?

I know how the basic process of digital certificate, but how do I detect if the public key in a digital certificate is modified?
0
votes
2answers
151 views

Self-signed CA and digital signatures

I am asked to design the public key crypto system for an IoT-like devices. These devices are going to be talking to each other over TCP/IP as well as communicating with a cloud-based API server. The ...
0
votes
0answers
143 views

Why RSA is used in TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ciphersuite [duplicate]

I try to understand where the signature is used in TLS 1.2. The ciphersuite of google.com is TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256. However, if I look at the certificate, I can find an ECDSA key ...
1
vote
0answers
50 views

Signing with multiple end entity certificates

Let's assume we are having a structure with a root certificate with lots of "child" certificates. A message is transmitted which is signed by any of the child certificates. The receiver has stored ...
2
votes
0answers
138 views

computing the exchange hash for ecdsa-sha2-nistp256

I am writing code for an SSH server and can not get past the Elliptic Curve Diffie-Hellman Key Exchange Reply part of the connection. The client also closes the connection and says "Host Key does not ...
0
votes
3answers
217 views

Token FIPS 140-2 level 3 with support for Android, iPhone and Web

I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines. I would like to create applications that use level 3 tokens. Is ...
-1
votes
1answer
231 views

How does digital signatures provide integrity? [duplicate]

Digital signature provides authentication by encrypting the text with the sender's private key and decrypting the text with the sender's public key. But how do we add integrity to it so that the text ...
2
votes
2answers
246 views

Does asymmetric encryption guarantee data integrity?

I have some unusual size constraints for my data which may be relevant to the prescribed solution. The scenario is as follows. Secure server A generates 240 bytes of data that need to be consumed by ...
1
vote
1answer
92 views

Checking Certificate Signature

Here's my problem: I'm trying to enable HTTPS on a local site for learning reasons. The thing is, I don't want to generate the certificate with some well-known application, but i want to create a ...
0
votes
1answer
59 views

Server pagination with key in response to fetch next page

I want to introduce pagination in one of my server endpoints. The endpoint will have an option to include in the parameter the last index of the previous page, and if included, the "page" returned ...
3
votes
1answer
162 views

Is it safe to use jku, kid and x5u in JSON Web Signature (JWS) header?

I don't get what header parameters like jku, kid, x5u are for in JSON Web Signature (JWS). Since We have to verify the integrity of the content against secret key/public key, is it safe to leave jku, ...
4
votes
1answer
182 views

Does a signed hash reveal any information about the original message?

As part of the end to end encryption for my app, I am following the standard procedure of using RSA to exchange the temporary AES256 key. Currently when A decides the key to send to B, he encrypts it ...
2
votes
1answer
51 views

Is it wise to remove redundant self-signatures from my PGP key?

I have changed expiration date of my pgp key several times. Recently I looked at it and started to worry about the mess I can see there: $ gpg --list-sigs AAAAAAAAAAAAAAAA pub 4096R/AAAAAAAA 2014-...