Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
0 votes
1 answer
21 views

Digital signing of invoices when exchanged between entities [closed]

Use of digital certificate for signing the files which are auto-generated by the applications that belong to a sister-concern entity that is into products/services to the other sister-concern entity ...
1 vote
2 answers
85 views

How does a CA-backed signature works?

I would like to understand how certificate-based signature works, I understand the standard asymmetric key signature where one party signs using their private key, and anyone else can validate this is ...
0 votes
1 answer
92 views

Can an attacker flip bits of a signature to create DoS?

Assume two parties communicating. A sends a message to B signed with its private key. B received the message and verify it using the public key of A. Can an attacker launch a DoS attack by flipping ...
2 votes
4 answers
71 views

Using FIX over TLS, is there a need to sign FIX mesages?

We have 2 servers communicating, server A (a server that I own), and server B (server on the internet that I trust). I get some info from server B, which are FIX messages (https://en.wikipedia.org/...
1 vote
1 answer
369 views

Server pagination with key in response to fetch next page

I want to introduce pagination in one of my server endpoints. The endpoint will have an option to include in the parameter the last index of the previous page, and if included, the "page" returned ...
7 votes
1 answer
2k views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ? (I was told ...
0 votes
0 answers
12 views

What protection does the /INTEGRITYCHECK MSVC linker option offer, if a malicious file without it can simply be substituted for the authentic file?

The /INTEGRITYCHECK linker option sets a flag that "tells the memory manager to check for a digital signature in order to load the image in Windows". So the general idea is that this ...
0 votes
1 answer
46 views

are files sent in a TLS channel signed? [duplicate]

I have 2 endpoints that are exchanging data (FIX messages), and the originating endpoint is genrating the fix files are sending them on an ecrypted channel (TLS or Stunnel). In a security audit, it ...
0 votes
1 answer
150 views

PGP "real" encryption with private key

When explaining the concept of signing a message, often it is presented as "encrypting with your private key", so that somebody who has the public key can "decrypt" the signature ...
2 votes
2 answers
70 views

Terminology for exchanging one piece of signed information for another

Applications that use cryptographically signed information for multiple purposes have the risk that one piece of signed information can be exchanged with another. When you use JWTs as session tokens, ...
0 votes
1 answer
80 views

How does RS256 work in a website

I'm developing a website and trying to use the algorithm RS256 to generate and verify the signatures of clients (JWT). Here is how I generate a signature at the client side (I use the Python script to ...
19 votes
2 answers
16k views

JWT: Choosing between HMAC and RSA

It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 ...
-1 votes
1 answer
44 views

Digital Signatures [closed]

In RSA signatures, Alice signs the message using her private key, and Bob verifies the message using Alice's public key. If an attacker has the signed encrypted message, then can they also verify the ...
0 votes
0 answers
17 views

How XAdES protects against tampering if the certificate is embedded?

Signing XML file with XAdES extension provides the X509 certificate. What is the security point if the certificate is given? Anyone can tamper the data with its own certificate, right? I used to work ...
1 vote
1 answer
85 views

Java Cryptography classes - program agnostic usage

We are planning on implementing encryption or digital signatures using any of the available classes provided by the Java Cryptography Architecture (e.g. KeyPair, MessageDigest, Cipher, KeyStore, ...
2 votes
2 answers
176 views

My web application needs to have my users' private keys to sign documents on their behalf. How do I handle that?

Our web application issues governmental documents for our users. Every one of those documents needs to be signed with a private key. However, because our users find it cumbersome to point their ...
6 votes
7 answers
890 views

Is there a way to prove some content came from a specific website?

I guess we can all agree that a screenshot of a website proves nothing; one can edit the HTML as much as one likes, take a screenshot and show a website displaying false information. As far as I know,...
1 vote
2 answers
162 views

Designing an updater with certificate renewal in mind

A program A downloads signed executables and other signed configuration files. Configuration files have a signature appended at the end. To verify their integrity and creator, it uses the public key ...
1 vote
1 answer
462 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
3 votes
1 answer
338 views

OIDC ID Token nonce as "poor mans digital signature"

In absence of better solutions, is the nonce is an OpenID Connect ID Token usable to serve as digital signature. The process would be as follows: A hash is created from the to-be-signed document/...
0 votes
1 answer
68 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
0 votes
1 answer
102 views

Payment Gateway rejecting Digitally Signed Payment Message

I am new to digital signatures. I read many problem statements, solutions, and documents but nothing came to my rescue. Payment Message (Text) needs to be digitally signed with the following specs as ...
23 votes
4 answers
23k views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
2 votes
1 answer
367 views

Managing multiple GPG keys

I'm currently attempting to setup my personal GPG key suite for the next few years, and I'm running into a question I don't have a ready answer for. I own 3 yubikeys, Primary/Secondary/Offsite Backup. ...
0 votes
1 answer
79 views

Over what fields is the X509 hash computed over? [duplicate]

Is this how X509 certificates are verified to be valid? The receiver receives the certificate Look at the issuer of the cert, and find the public key of that CA (its hardcoded in the application or ...
1 vote
1 answer
94 views

Looking for a solution: trusted identity with corresponding digital signatures (QES) for intercontinental charity

We are looking for a solution to meet the needs of a UK incorporated charity (CIO) that has three to seven trustees from at least three continents. Obligations as trustees of a board include signing (...
2 votes
1 answer
384 views

How do digital signatures work - beginner's explanation?

I'm new to cryptography, and I'm confused about digital signatures. How do they work? Please illustrate with an example in a way that a beginner can understand.
0 votes
2 answers
69 views

What could be the correct and secure ways to store and manage public keys?

I am developing an open source project(PKDSA) that uses ED25519 and ED448. My purpose of this project was to help others to enable user-secretless based passwordless authentication. There're a lot of ...
1 vote
1 answer
92 views

How does the client get the certificate (and public key) of the delegated authority (OCSP responder) to confirm the response in OCSP?

I have one question regarding the OCSP protocol to check if the certificate is revoked or not. The question is about checking whether the intermediate CA certificate immediately below the root CA is ...
2 votes
2 answers
787 views

Exact meaning of RSA key in `gpg --verify` output

When verifying a pgp signed message using GnuPG, one gets an output similar to the following: gpg: Signature made Fr 07 Jan 2022 13:42:21 CET gpg: using RSA key ...
1 vote
1 answer
53 views

qualified e-signature long-term security

I'm considering to obtain a QES (Qualified electronic signature). But I'm concerned about long term security. The hypothetical scenario is lets say after 10-15 years the algorithms are cracked or ...
4 votes
1 answer
2k views

What is the difference between PKCS#7 and CADES, PADES and XADES?

I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
2 votes
1 answer
436 views

Can I sign with two Code Signing certs to build reputation on the newer one?

I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon. Obviously, the new certificate has no ...
0 votes
3 answers
127 views

Need for authentication in an offline system

I need to design a scheme, where access to an offline System is granted based on some kind of information/proof of knowledge, provided by a separete system, Prover system. I'm in position where I can ...
11 votes
3 answers
801 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...
118 votes
6 answers
48k views

Why should one not use the same asymmetric key for encryption as they do for signing?

In an answer to a question about RSA and PGP, PulpSpy noted this: It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both). ...
-1 votes
1 answer
279 views

Device authentication, common method

What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the web service The ...
0 votes
2 answers
65 views

Does verifying a code signature require making a network connection?

Does Windows 11 need to make a network connection to verify a code signature for a .exe or .dll file?
12 votes
3 answers
2k views

Is it possible to use WebAuthn for digitally signing documents in the browser?

WebAuthn is a relatively new API for authentication, and it uses public key cryptography instead of something like passwords. I am wondering if it is possible to use the cryptographic part for a ...
5 votes
0 answers
239 views

What's the merit of storing LTV (long term validation) information for RFC3161 tokens and what happens if a TSA private key would leak?

I'll formulate my question in regards to timestamped PDF, but I wonder actually about the long term validation of RFC3161 tokens in general. So, PAdES has the concept of Long Term Validation, which ...
-1 votes
3 answers
937 views

Request/Creating a Code Signing Certificate

I have a need for a code signing certificate which is trusted by a CA in the Windows domain. How do I request/create this certificate? Do I have to request a code signing certificate on the ...
1 vote
1 answer
240 views

Strip CMS Signature from file (using openssl?)

I have a lot of binary files that contain some data that is signed using CMS. The files have the form: $ openssl cms -inform DER -in test.cms -cmsout -print CMS_ContentInfo: contentType: pkcs7-...
4 votes
0 answers
219 views

Secure boot + full disk encryption, should I sign the kernel?

I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain. Here's what I did so far : Enroll my own keys in the UEFI firmware Sign my grub bootloader Full disk ...
0 votes
1 answer
38 views

e-signature + digital signature aws md5

I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents. My question are: Is MD5 (...
1 vote
1 answer
276 views

Prove Alice Had Sent the Message Before

Alice just sent a message to Bob, but prior to that she had already sent the very same message. How can Bob prove that?
1 vote
1 answer
42 views

What is the most secure hardware option for the use of personal eIDAS compliant QES in the EU?

I know that there are two approaches, one with local capsulated storage, such as USB token or smartcard, and the other with cloud-based key vault. Both are secured with a PIN that has to be entered in ...
0 votes
0 answers
72 views

Help understanding PKI MTLS and digital signature architecture

I'm building an identity service using PKI and MTLS for authentication where users are supposed to be able to sign data e.g. a json string or a document. Where I am now I have implemented working MTLS ...
1 vote
0 answers
36 views

Is there any use case of DAA (Direct Anonymous Attestation) in TPM?

I want to know the use cases of DAA (Direct Anonymous Attestation) in the real world.
0 votes
0 answers
31 views

Is it possible for an app to sign data it generates so that the data can be guaranteed to come from the app? [duplicate]

Is it possible for an app binary to sign content generated by the app such that a verifier can confirm the data was indeed generated by a specific version of the app? For example: A mobile app from a ...
1 vote
1 answer
48 views

Confusion Regarding TLS Handshake and Key Exchanges

I know much has been written on this topic, but I am still stuck on some on the details of TLS handshake and I would like to have a better understanding of what happens. I've been using several ...

1
2 3 4 5
18