Questions tagged [digital-signature]
A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).
89
questions with no upvoted or accepted answers
5
votes
0
answers
241
views
What's the merit of storing LTV (long term validation) information for RFC3161 tokens and what happens if a TSA private key would leak?
I'll formulate my question in regards to timestamped PDF, but I wonder actually about the long term validation of RFC3161 tokens in general.
So, PAdES has the concept of Long Term Validation, which ...
5
votes
0
answers
2k
views
Openssl cms verify signature with timestamp and crl
I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
- 768
4
votes
0
answers
224
views
Secure boot + full disk encryption, should I sign the kernel?
I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain.
Here's what I did so far :
Enroll my own keys in the UEFI firmware
Sign my grub bootloader
Full disk ...
- 140
3
votes
0
answers
155
views
Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?
I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1)
Basically, ...
- 31
3
votes
0
answers
245
views
Examples of SSH key exchange algorithms requiring encryption-capable host keys
In the SSH spec, Section 7.1, key exchange algorithms are distinguished based on whether they require an "encryption-capable" or a "signature-capable" host key algorithm.
If I ...
3
votes
0
answers
2k
views
Verify PKCS#7 (CMS) detached signature with timestamp with OpenSSL
I have a PKCS#7 (i.e., CMS) detached signature of a file that is signed by my signing certificate and then timestamp signed by a TSA that is all generated by an application we wrote. I would like to ...
- 235
3
votes
0
answers
534
views
How does a Sign tool work?
My basic understanding of how a sign tool works is:
Load the zip-file (may be exe, jar, ddl, apk, etc.) which has to be signed to its memory (cache memory of the sign tool).
Verify it and unzip the ...
3
votes
1
answer
304
views
Git Signing commits in a private repo
Linus mentioned in 2009 that "Signing each commit is totally stupid".
Has the common view evolved on this subject since then ? Doesn't it protect against someone usurping your identity to ...
- 31
2
votes
1
answer
385
views
Managing multiple GPG keys
I'm currently attempting to setup my personal GPG key suite for the next few years, and I'm running into a question I don't have a ready answer for. I own 3 yubikeys, Primary/Secondary/Offsite Backup. ...
- 121
2
votes
2
answers
802
views
Exact meaning of RSA key in `gpg --verify` output
When verifying a pgp signed message using GnuPG, one gets an output similar to the following:
gpg: Signature made Fr 07 Jan 2022 13:42:21 CET
gpg: using RSA key ...
2
votes
0
answers
267
views
How can I get `gpg` to sign with certain key again (end of file error)
Disclaimer: This is a cross-post after I initially was looking for help on the Gentoo forums since I suspected some major update of my Gentoo system to be the reason behind my problem.
However, since ...
- 121
2
votes
0
answers
78
views
Authentication and authorization of a subrequest
A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...
- 153
2
votes
2
answers
448
views
Can I sign with two Code Signing certs to build reputation on the newer one?
I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon.
Obviously, the new certificate has no ...
- 21
2
votes
1
answer
387
views
How do digital signatures work - beginner's explanation?
I'm new to cryptography, and I'm confused about digital signatures.
How do they work? Please illustrate with an example in a way that a beginner can understand.
- 21
2
votes
0
answers
181
views
GPG self-signature default check level
I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned.
When issuing gpg --check-sigs one ...
- 21
2
votes
0
answers
1k
views
computing the exchange hash for ecdsa-sha2-nistp256
I am writing code for an SSH server and can not get past the Elliptic Curve Diffie-Hellman Key Exchange Reply part of the connection. The client also closes the connection and says "Host Key does not ...
- 21
2
votes
0
answers
75
views
Can ECC correctness issues in CVE-2015-2730 allow "remote attackers to spoof ECDSA signatures"?
CVE-2015-2730: Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly ...
- 141
2
votes
0
answers
112
views
Is common_schema safe?
Edit: this already has an answer here.
I just ran across common_schema, a utility for MySQL database administrators. It is a SQL script that creates a schema called common_schema in your database and ...
- 153
2
votes
0
answers
115
views
Secure Golden Boot Key without Microsoft keys
I'm an Arch Linux user. I'd like to protect myself from the live-usb hack by using SecureBoot:
Create my own Platform Key and sign the kernel with my own key.
Delete the Microsoft PKs
Enable ...
- 141
2
votes
0
answers
387
views
Algorithm to generate (and verify) string of 4 quad alpha numeric code
I am writing a system, for which I need to generate unique transaction numbers (which can be verified by myself). I want to use something similar to that used by credit cards, where a string of the ...
2
votes
0
answers
106
views
Out of band signature application for banking transactions
I work on a banking signature project.
Signing transactions must be carried out on another application to respect the mechanism "Out Of Band". When the user makes a transaction, he must pass to a ...
2
votes
0
answers
848
views
CMS signed data OpenSSL verification error
I have a CMS signed data that is successfully verified through Java BouncyCastle library.
When trying to verify through OpenSSL, I am getting the following error:
>openssl smime -verify -inform ...
- 1,109
2
votes
0
answers
606
views
What is the point of signature file in signed JAR/ZIP files
The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
- 561
2
votes
0
answers
524
views
CMS/PKCS#7: specifying signatureAlgorithm with digest?
I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1).
The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
- 386
2
votes
0
answers
536
views
Digital signature based authentication schema using two passwords
I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
- 121
1
vote
0
answers
37
views
Is there any use case of DAA (Direct Anonymous Attestation) in TPM?
I want to know the use cases of DAA (Direct Anonymous Attestation) in the real world.
- 11
1
vote
0
answers
71
views
mTLS on webhooks
I'm not understanding how does Sendgrid verify that's it's me who's sending them the HTTPS request on their webhook endpoint.
Specifically, in their docs they show how to obtain their public key (to ...
- 111
1
vote
0
answers
59
views
Does Google Update perform cryptographic checks against releases?
My company is looking to allow Google Chrome to self-update, a necessity as we are finding it difficult to keep up with their release cycle in order to mitigate vulnerabilities.
On the pro side, ...
- 169
1
vote
1
answer
94
views
Looking for a solution: trusted identity with corresponding digital signatures (QES) for intercontinental charity
We are looking for a solution to meet the needs of a UK incorporated charity (CIO) that has three to seven trustees from at least three continents.
Obligations as trustees of a board include signing (...
- 615
1
vote
2
answers
162
views
Designing an updater with certificate renewal in mind
A program A downloads signed executables and other signed configuration files. Configuration files have a signature appended at the end. To verify their integrity and creator, it uses the public key ...
- 639
1
vote
0
answers
194
views
How to go about checking if Windows is running any untrusted drivers (programatically)
I want to enforce a rule that my program start only if, at the time it launches, there are no untrusted kernel drivers running. I'm aware and have already tested file signature verification using ...
- 111
1
vote
0
answers
80
views
Tooling and serialization format for DNSSEC signture chain
I'm looking for a compact, canonical (and possibly but not necessarily human-readable) format for serializing the signature chain for a RRset (or proof that it lies under an insecure delegation) for ...
1
vote
0
answers
90
views
Can an EMV bank card be used to digitally sign documents?
Bank accounts are bound to an identity. Can bank cards be used in the same way as https://www.identrust.com/certificates/document-signing ?
user197634
1
vote
0
answers
84
views
New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key
I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu.
I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
- 111
1
vote
0
answers
84
views
Signing event-stream responses
I am working on an application where the general approach is signing most response payloads with HMAC, but there are a couple of endpoints that return text/event-stream in the response. What is the ...
- 11
1
vote
0
answers
81
views
Authenticating Adobe .pdf electronic signatures
Having created a certificate for electronic signing within Adobe Acrobat DC, can I authenticate documents signed using it by issuing a signed paper statement to recipients stating that it would be ...
- 11
1
vote
0
answers
182
views
Why does PGP create a signature from plaintext?
From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and ...
- 11
1
vote
0
answers
710
views
Breakdown of signature verification in CertificateVerify (TLS 1.3) with RSA-PSS
I'm debugging a TLS v1.3 client program, which failed to verify the signature in server's CertificateVerify, so I'm learning the procedures for verifying the signature from server's CertificateVerify ...
- 121
1
vote
0
answers
168
views
Forward secrecy (plausible deniability) and storing messages
How do messengers, like signal or XMPP-omemo messengers, store their messages?
Since the session key is only valid for the current session, how can such extensions like MAM (message archiving on XMPP ...
- 11
1
vote
0
answers
83
views
How do I check if my key is updated in a keyserver after I resend it with new signatures?
I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures.
The thing is that when ...
- 111
1
vote
0
answers
101
views
What does jarsigner verify in the first place (integrity or authenticity)?
I was reading sth about android code signing and have run into this statement:
The second jarsigner command at v in Listing 3-7 first verifies the
signature block and signing certificate, ...
- 491
1
vote
0
answers
436
views
Windows Smart Screen pops up after EV Code Signing
I am code signing my application's installer using an EV Code Signing that we have bought recently at work. The code signing is performed when the installer is created using Inno Setup (version 5.6.1)....
- 11
1
vote
0
answers
99
views
Why is digital signature enforcement on webservers not common practice?
Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
- 162
1
vote
0
answers
214
views
Working with Security Metadata in APK file
According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
- 131
1
vote
1
answer
463
views
What is a trans-cipher?
While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering").
I ...
- 268
1
vote
0
answers
80
views
How to assign not-PDF file by digital certificate?
XML, EPUB, etc. formats need also to be signed by digital certificate, like in the PDF's certificate-based signatures. There are reliable open-standards and open-source software to accomplish it?
PS: ...
- 129
1
vote
0
answers
188
views
Signing with multiple end entity certificates
Let's assume we are having a structure with a root certificate with lots of "child" certificates.
A message is transmitted which is signed by any of the child certificates. The receiver has stored ...
- 11
1
vote
1
answer
369
views
Server pagination with key in response to fetch next page
I want to introduce pagination in one of my server endpoints.
The endpoint will have an option to include in the parameter the last index of the previous page, and if included, the "page" returned ...
- 193
1
vote
0
answers
75
views
GPG RSA Authenticity Mechanism Minimum Requirement
The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity:
the public key
the signature
the fingerprint of the public key
Assuming that the author keeps his ...
1
vote
0
answers
2k
views
Private key to sign a XML file
I’ve never dealt with cryptography before so my question may be sound trivial.
I need to create an app that sends messages as digitally signed XML files.
The messages are sent to a CA entity.
...
- 11