Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
4 votes
1 answer
544 views

Git Signing commits in a private repo

Linus mentioned in 2009 that "Signing each commit is totally stupid". Has the common view evolved on this subject since then ? Doesn't it protect against someone usurping your identity to ...
0 votes
1 answer
114 views

e-signature + digital signature aws md5

I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents. My question are: Is MD5 (...
1 vote
0 answers
37 views

How to verify the downloaded Mozilla Firefox binary? [duplicate]

I'm wondering about the correct steps when you want to download Firefox from their server and validate it has not been tampered with. Assume you download the latest Firefox tar-bz2-package from https:/...
8 votes
1 answer
3k views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key? Which behavior is the best as to signing user IDs and Keys? How and when to use "Local signatures" (non-exportable)? (I was ...
94 votes
4 answers
87k views

SSL Certificate framework 101: How does the browser verify the validity of a given server certificate?

(I have a basic understanding of public/private key, hashing, digital signatures... I have been searching online & stack forums last couple days but cannot seem to find a satisfactory answer.) ...
3 votes
0 answers
116 views

Does a signature service provider level digital certificate for electronic signature comply with eIDAS requirement for Advanced Electronic Signatures?

I have some basic questions regarding eIDAS and 'Advanced Electronic Signatures'. Say, if I create a product under my company Acme Inc that offers a simple electronic signature where I sign every ...
1 vote
1 answer
436 views

Server pagination with key in response to fetch next page

I want to introduce pagination in one of my server endpoints. The endpoint will have an option to include in the parameter the last index of the previous page, and if included, the "page" returned ...
0 votes
1 answer
411 views

PGP "real" encryption with private key

When explaining the concept of signing a message, often it is presented as "encrypting with your private key", so that somebody who has the public key can "decrypt" the signature ...
0 votes
0 answers
41 views

How to securely store signature file

I am using TPM to to encrypt and sign my data. But since I am not security expert, I need to come to you guys :D I am developing this app to verify file content. I already has this part sorted out ...
3 votes
2 answers
6k views

RSA-Based Signature Algorithms

From Beginning Cryptography with Java - chapter 4, digital signatures: Signatures are created using the RSA algorithm by applying the RSA algorithm using the private key and then distributing the ...
0 votes
1 answer
60 views

Is Digital Signature really necessary for an open system considered by FDA's 21 CFR Part 11?

21 CFR Part 11's Subpart B for Electronic Records has a section on 'Controls for Open Systems" stating that: Persons who use open systems to create, modify, maintain, or transmit electronic ...
16 votes
5 answers
4k views

Is it possible to sign Git commits on a different computer?

I'm doing some development work on an untrusted computer. I'd like to sign my commits I make from it, but I don't want my personal PGP key to touch this computer. Or maybe I'm using a PGP smart card ...
1 vote
1 answer
586 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
31 votes
6 answers
16k views

Are documents truly "signed" by DocuSign?

I've never been happy with the explanation DocuSign gives for themselves in their own marketing material (e.g. https://www.docusign.com/how-it-works/electronic-signature/digital-signature/digital-...
1 vote
1 answer
188 views

Payment Gateway rejecting Digitally Signed Payment Message

I am new to digital signatures. I read many problem statements, solutions, and documents but nothing came to my rescue. Payment Message (Text) needs to be digitally signed with the following specs as ...
3 votes
1 answer
852 views

Managing multiple GPG keys

I'm currently attempting to setup my personal GPG key suite for the next few years, and I'm running into a question I don't have a ready answer for. I own 3 yubikeys, Primary/Secondary/Offsite Backup. ...
1 vote
1 answer
148 views

Looking for a solution: trusted identity with corresponding digital signatures (QES) for intercontinental charity

We are looking for a solution to meet the needs of a UK incorporated charity (CIO) that has three to seven trustees from at least three continents. Obligations as trustees of a board include signing (...
0 votes
0 answers
78 views

Is hashing a digital signature for quick (but incomplete) validation a known and/or acceptable practice?

Let's say that there's a known digital signature issued by a trusted CA. Normally, digital signatures need to be evaluated: checked if they are expired, revoked, if there's a problem in the chain of ...
3 votes
2 answers
2k views

Exact meaning of RSA key in `gpg --verify` output

When verifying a pgp signed message using GnuPG, one gets an output similar to the following: gpg: Signature made Fr 07 Jan 2022 13:42:21 CET gpg: using RSA key ...
1 vote
0 answers
88 views

Certify using Yubikey

I just started using a Yubikey 5. I've set up GPG according to this excellent guide, and now I have 3 working ECC key pairs on my Yubikey: Sign/S :: ed25519, Encrypt/E :: cv25519, Authentication/A :: ...
0 votes
0 answers
87 views

Revoking a digital signature at the cryptographic level

How do I indicate that a specific document or transaction associated with a particular signature should no longer be considered valid? I'm talking of recalling a signed document, not revoking the ...
0 votes
1 answer
217 views

How to check e-mail message authenticity? Suspected EML file forging

In a small company, we have an issue suspecting a former employee has forged an e-mail to our company from his Hotmail account by changing its date and recipients in the EML file, claiming that the ...
0 votes
1 answer
83 views

Validate server-side code using hash?

If you have a client-side script (e.g client.py) communicating with a server-side script (e.g server.py). Using SSL certificates the identity of the server is automatically verified. But how do you ...
1 vote
0 answers
77 views

Which server CA to use for device fleet management?

(I likely didn't use correct keywords, but I was not able to have a complete info about below question). Working on a IoT device, capable to connect to our own server, using MQTT and HTTPS connections,...
0 votes
0 answers
138 views

How to prevent public key tampering

I have to store a document (e.g. a JSON file) on a remote PC (that my App is running on) alongside a signature to be able to verify that this file was signed by me. I have no access to this PC nor ...
6 votes
3 answers
3k views

What happens when the timestamper's certificate expires?

What happens when the timestampers certificate expires? If the code is now untrusted, can it be re-stamped without re-signing? If not, what good does this timestamp do me if my cert is valid until the ...
3 votes
1 answer
2k views

How does actually countersignature work in authenticode?

I'm trying to understand the timestamp processing in the Microsoft Authenticode verification mechanism and it looks pretty simple, but I really do not understand how signature can be valid while both ...
2 votes
1 answer
115 views

How to feasibly digital sign high volume documents with CA issued digital certificate?

My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
0 votes
2 answers
145 views

What happens behind the scene when I install an SSL certificate for a website?

I understand I need to upload my digital certificate that I obtained from CA and also my private key. But what happens in the server after I uploaded? Does the server actually read my certificate and ...
3 votes
1 answer
188 views

How can a server recover from its secret key stolen?

Suppose a server use digital signature to prove the files it sends to users. If someone steals the secret key in the server, what should it do?
9 votes
2 answers
5k views

Can a zero knowledge proof of voting be made using a trusted auth server (without client side crypto)?

Questions Can one implement a secure voting system having all the features described below? e.g. without disclosing any individual's vote to the government server (or the third party), preserving ...
0 votes
0 answers
76 views

Remote eIDAS Qualified Signatures: Control of Signature Activation Data

In eIDAS Remote Qualified Signatures, but also in other Remote-Signature Solutions, the cryptographic keys are held by the Remote Signature Provider. The user uses some method, e.g., a smartphone app, ...
1 vote
2 answers
222 views

Designing an updater with certificate renewal in mind

A program A downloads signed executables and other signed configuration files. Configuration files have a signature appended at the end. To verify their integrity and creator, it uses the public key ...
0 votes
0 answers
36 views

Do `Signature` headers have real benefits? [duplicate]

I'm working with an HTTPS API that requires me to include a Signature header, the signature is calculated as codeBase64(hmacWithSha384(key, body)). I'm wondering if it provides any real-life benefits ...
0 votes
1 answer
162 views

Can an attacker flip bits of a signature to create DoS?

Assume two parties communicating. A sends a message to B signed with its private key. B received the message and verify it using the public key of A. Can an attacker launch a DoS attack by flipping ...
1 vote
1 answer
123 views

Write message that can be verified by any member of a group

I am trying to develop a scheme for publishing a message to a group of recipients. Any recipient needs to be able to verify who the message was sent by. There may be tens of messages generated each ...
0 votes
1 answer
116 views

How to provide signature for a thin client app?

If I have a Java thin client app that connects to a server, and I want to protect my client from a malicious use, so I want to implement a sort of signature. Now the struggle is, if I want to sign the ...
0 votes
0 answers
206 views

How is client side JWT signature validation beneficial from a security perspective?

I’ve been reading about how clients can verify JWT signatures using a public key provided by the server. I’m struggling to understand how this solves any issues. The only attack I’ve seen which this ...
2 votes
2 answers
628 views

Can I sign with two Code Signing certs to build reputation on the newer one?

I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon. Obviously, the new certificate has no ...
68 votes
10 answers
38k views

Proving creation time/date of a screenshot

I have to produce a screenshot of a web page, and want to make sure others will know without any doubt that this screenshot has been produced today. That is, I would like to embed today's date in the ...
0 votes
1 answer
260 views

Are the public keys of root certificate and intermediate certificate contained in an SSL certificate?

I read this, but it doesn't say if the public keys of the root and intermediaries are inside.
2 votes
1 answer
458 views

How do digital signatures work - beginner's explanation?

I'm new to cryptography, and I'm confused about digital signatures. How do they work? Please illustrate with an example in a way that a beginner can understand.
1 vote
2 answers
169 views

How does a CA-backed signature works?

I would like to understand how certificate-based signature works, I understand the standard asymmetric key signature where one party signs using their private key, and anyone else can validate this is ...
2 votes
4 answers
308 views

Using FIX over TLS, is there a need to sign FIX mesages?

We have 2 servers communicating, server A (a server that I own), and server B (server on the internet that I trust). I get some info from server B, which are FIX messages (https://en.wikipedia.org/...
0 votes
1 answer
104 views

are files sent in a TLS channel signed? [duplicate]

I have 2 endpoints that are exchanging data (FIX messages), and the originating endpoint is genrating the fix files are sending them on an ecrypted channel (TLS or Stunnel). In a security audit, it ...
2 votes
2 answers
110 views

Terminology for exchanging one piece of signed information for another

Applications that use cryptographically signed information for multiple purposes have the risk that one piece of signed information can be exchanged with another. When you use JWTs as session tokens, ...
0 votes
1 answer
357 views

How does RS256 work in a website

I'm developing a website and trying to use the algorithm RS256 to generate and verify the signatures of clients (JWT). Here is how I generate a signature at the client side (I use the Python script to ...
22 votes
2 answers
21k views

JWT: Choosing between HMAC and RSA

It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 ...
-1 votes
1 answer
104 views

Digital Signatures [closed]

In RSA signatures, Alice signs the message using her private key, and Bob verifies the message using Alice's public key. If an attacker has the signed encrypted message, then can they also verify the ...
1 vote
1 answer
180 views

Java Cryptography classes - program agnostic usage

We are planning on implementing encryption or digital signatures using any of the available classes provided by the Java Cryptography Architecture (e.g. KeyPair, MessageDigest, Cipher, KeyStore, ...

1
2 3 4 5
18