Questions tagged [digital-signature]
A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).
801
questions
1
vote
0answers
14 views
Is there some OSS toolchain for disallowing execution of all unsigned binaries on linux?
Say I'm running a server with Ubuntu and an application stack and I want to lock down potential malicious access.
Is there some OSS toolchain for disallowing execution of all unsigned binaries on ...
0
votes
1answer
44 views
What's the difference between an executable signed with a Windows Digital Signature and one signed with PGP?
I'm trying to figure out how to establish trust in Windows executables that I download from the internet.
Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they ...
1
vote
0answers
43 views
Can an EMV bank card be used to digitally sign documents?
Bank accounts are bound to an identity. Can bank cards be used in the same way as https://www.identrust.com/certificates/document-signing ?
0
votes
1answer
83 views
Authentication to offline device
I have an offline safe at a remote location that I want to give people access to at my discretion. I would like to control who and when they have access, without having to travel to the safe.
Example:
...
2
votes
1answer
266 views
Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?
I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file:
How can I tell if it was signed with an extended validation (EV) code-signing certificate?
...
0
votes
1answer
136 views
Prove Alice Had Sent the Message Before
Alice just sent a message to Bob, but prior to that she had already sent the very same message. How can Bob prove that?
0
votes
0answers
5 views
Security level of DSA when $q$ is a 224 bit prime? [migrated]
What is the security level of DSA algorithm when $q$ is a 224 bit prime?
Is it always a simple rule that the security level is the bit length of $q$ divided by two ?
1
vote
1answer
38 views
GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?
according to https://tools.ietf.org/html/rfc8032
EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or
114 bytes) for Ed25519 and Ed448, respectively;
But if I sign using Ed25519 in ...
0
votes
2answers
83 views
How to “trust” data that is posted from one application to other
We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
0
votes
2answers
945 views
openssl verify error: unable to get local issuer certificate
I have a test certificate chain that I generated and it fails the openssl verify command:
openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem
The output I get from the ...
1
vote
2answers
68 views
How to establish a secure channel with authenticated and authorized access to a remote entity
I have the following problem:
There are 3 parties A, B and X.
X is holding 2 entities on behalf of A and B.
A communicates with X to operate it's own entity. B also communicates with X to operate ...
0
votes
1answer
28 views
How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?
Let's say Alice has three secrets: SecretA, SecretB, SecretC
Alice shows these three secrets to Bob and gets a single signature from him that signs all three secrets together. Something like
Signature ...
0
votes
2answers
553 views
Android OS verity signature bypass
I am just getting into custom firmware and rooting phones.
I have a phone that appears to be unrootable for whatever reason due to a locked bootloader. The private key was never released and we only ...
0
votes
2answers
74 views
Reject requests from our tampered android apps
I'm working on an Android application with few millions of users. The app has some financial|payment features. We have some public APIs and some authenticated ones (OAuth2). As a part of enhancing our ...
2
votes
0answers
88 views
How can I get `gpg` to sign with certain key again (end of file error)
Disclaimer: This is a cross-post after I initially was looking for help on the Gentoo forums since I suspected some major update of my Gentoo system to be the reason behind my problem.
However, since ...
0
votes
0answers
26 views
DSA parameter selection [migrated]
In the Digital Signature Algorithm, is there a reason why the larger prime parameter should be an $N$-bit prime where $N$ is a multiple of 64 ?
Is this strictly necessary for proper working of the ...
2
votes
2answers
49 views
Is it possible to create a certificate for a key pair which I do not possess?
Perhaps the answer is no, and perhaps this is a dumb question. However I am trying to understand the underlying principles better.
My understanding of certificate signing process.
I generate a key ...
1
vote
1answer
689 views
USBlyzer - Safe Or Not?
I need to use a USB analyzer. I've been looking at a couple of different options. This one came up. As far as I can tell, it's not open source, but seems to be quite popular. Seeing that the data ...
5
votes
0answers
43 views
What's the merit of storing LTV (long term validation) information for RFC3161 tokens and what happens if a TSA private key would leak?
I'll formulate my question in regards to timestamped PDF, but I wonder actually about the long term validation of RFC3161 tokens in general.
So, PAdES has the concept of Long Term Validation, which ...
1
vote
1answer
77 views
Public Digital Signature Validation with JWE
After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, ...
3
votes
1answer
65 views
Verify that data submitted by user was produced by my app
I'm designing an app (for PC), that is intended to run on users' machines and generate a file with some data. The user will then upload the file to the server, and I want to verify that this file has ...
1
vote
0answers
132 views
Digital Signature uses private key for encryption, and public key for decryption? [duplicate]
Public key is for encryption, and private key is for decryption in PKIs.
And digital signature employs the PKIs.
How to use a private key for encryption, and using public key for decryption which ...
0
votes
0answers
56 views
How could I improve the security of my design?
I’m building an open-source notes app using electron.
I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a ...
1
vote
2answers
64 views
Check signature of an HTTPS response
So I want to do the following
Check the RSA public key of a https server
Make a GET request to that server
Get a response+signature from the server
I should be able to check if ANY reponse+signature ...
1
vote
1answer
48 views
Short digital signature
I want to digitally sign messages with strict size limitations. I am looking for digital signature algorithm providing very short signatures. (as short as possible)
Which secure algorithms can I ...
Gilles 'SO- stop being evil'
46.3k13 gold badges108 silver badges163 bronze badges
40
votes
10answers
10k views
Is it possible to make a video that is provably non-manipulated?
Suppose a student takes an exam at home. Since home-exams are prone to cheating, the student wants to be able to prove that he/she did not cheat. So the student puts cameras in the room, which ...
3
votes
2answers
92 views
Why should I go to SHA512withRSA signature for my Android apps?
I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default.
Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...
5
votes
1answer
285 views
Does a signed hash reveal any information about the original message?
As part of the end to end encryption for my app, I am following the standard procedure of using RSA to exchange the temporary AES256 key. Currently when A decides the key to send to B, he encrypts it ...
0
votes
1answer
55 views
What is the relation between “signature_algorithms” handshake extension and TLS ciphersuite
I am learning TLS handshake and find client/serve will negotiate a cihpersuite during client/server hello.
Usually, the last part of a ciphersuite is a hash algorithm, like SHA256 in ECDHE-ECDSA-...
0
votes
1answer
51 views
Digital signature without exposing the private key
If the private key is used in the server for digital signature, once the server is hacked, the private key may be leaked. Is there a way to create a digital signature without exposing the private key?
2
votes
1answer
262 views
When I sign a git commit, what is my signature actually based on?
I'm curious about what data actually gets signed when I sign a git commit or tag? Is it simply the commit message and metadata?
How could I manually duplicate the signature, use gpg instead of git?
2
votes
0answers
709 views
Openssl cms verify signature with timestamp and crl
I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
2
votes
1answer
1k views
What does 'verified file' in Windows mean? And does it guarantee related files?
Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g. Microsoft) or in other case, unknown publisher.
I know public key encryption can ...
0
votes
0answers
22 views
How to ensure authenticity of photographic evidence and derived work?
Photographic evidence is not what it used to be before generative ai, reface, deepfake, live deepfake, etc.
Is there a way to ensure authenticity of photos/videos, as well as derived work?
For example:...
0
votes
1answer
139 views
It's secure to store private keys in AWS Secret Manager?
I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
1
vote
1answer
39 views
Proving authenticity of a message from a message app in case of deletion
Say you want to prove that you received a certain message from someone.
This can be difficult because many messaging apps (like facebook messenger) allow the sender to delete messages on the recipient'...
2
votes
1answer
98 views
Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]
When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
1
vote
1answer
77 views
Signing and encrypting with pairs of keys based on discrete algorithms
In case I've generated pair of keys (public and private) for RSA, I'm able to use it both for signing and encrypting. Is the same statement true also for pairs of keys based on discrete algorithms?
1
vote
2answers
752 views
Are all fields of the PE certificate directory hashed during authenticode signing?
In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
0
votes
2answers
81 views
Private key Proof of Ownership [closed]
Given 2 entities, A and B:
A has a public key( x ) and a private key( x* ).
B has a A's public key hash( let's call it h(x) ).
A has to prove ownership of x* to B.
How could this be achieved, ...
1
vote
1answer
49 views
Keysigning and digital message signatures: are they the same thing?
I was reading this wikipedia article on Keysigning: https://en.wikipedia.org/wiki/Keysigning and I then came across this discussion Stack overflow about message signing with RSA: https://stackoverflow....
0
votes
1answer
195 views
How can we use digital signatures for mutual authentication between two computers?
I get the fact that we can use digital signatures for authenticating the signer (since they are using their private key to create the signature, and this is known only to the signer ). But how can the ...
14
votes
1answer
3k views
How does this unsigned exe launch without the windows 10 SmartScreen warning?
So, I have been working on my own project for which I have been looking into certificates and such. While browsing reddit I found a game which I can launch the exe file, expecting to get a Windows 10 ...
1
vote
1answer
194 views
Server pagination with key in response to fetch next page
I want to introduce pagination in one of my server endpoints.
The endpoint will have an option to include in the parameter the last index of the previous page, and if included, the "page" returned ...
23
votes
9answers
27k views
Deprecation of SHA1 code signing certificates on Windows
EDIT (7/7/2016) - see addition at the end of post
I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables (http:...
0
votes
1answer
228 views
What is a TSA policy OID?
What is TSA policy OID? Is it a unique identifier of a timestamp server given by a world wide authority? Does that mean that no two servers can have the same oid? Or is it an identifier of the ...
0
votes
1answer
41 views
Are Digital Signatures tuned to become harder as computers become faster?
For example, how long does a typical CPU take to verify a single secp256k1 signature? Wouldn't this need to change in time so that signatures can't be brute forced? How is it decided how "strong&...
0
votes
2answers
1k views
File carving JPG exif data files
So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving.
This ...
26
votes
7answers
9k views
Why do we need HTTPS for static content? If we can have a checksum at the end signed by the private key, won't that prove the validity?
This method which I am talking about can improve caching of images, videos, and CSS by the ISP rather than just depending on the browser cache. And it also proves the validity of the sender. Is there ...
0
votes
1answer
49 views
Are there any identity providers which support securing RESTful interfaces using digital signature?
I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract:
When signing, the sender uses ...
