Questions tagged [digital-signature]
A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).
85
questions with no upvoted or accepted answers
5
votes
0answers
43 views
What's the merit of storing LTV (long term validation) information for RFC3161 tokens and what happens if a TSA private key would leak?
I'll formulate my question in regards to timestamped PDF, but I wonder actually about the long term validation of RFC3161 tokens in general.
So, PAdES has the concept of Long Term Validation, which ...
3
votes
0answers
114 views
Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?
I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1)
Basically, ...
3
votes
0answers
410 views
How does a Sign tool work?
My basic understanding of how a sign tool works is:
Load the zip-file (may be exe, jar, ddl, apk, etc.) which has to be signed to its memory (cache memory of the sign tool).
Verify it and unzip the ...
2
votes
0answers
88 views
How can I get `gpg` to sign with certain key again (end of file error)
Disclaimer: This is a cross-post after I initially was looking for help on the Gentoo forums since I suspected some major update of my Gentoo system to be the reason behind my problem.
However, since ...
2
votes
0answers
48 views
What's the purpose of signatures in Google Maps APIs?
There's something I don't understand about signatures in Google Maps APIs.
The documentation says "We strongly recommend that you use both an API key and digital signature, regardless of your ...
2
votes
0answers
713 views
Openssl cms verify signature with timestamp and crl
I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
2
votes
0answers
36 views
Authentication and authorization of a subrequest
A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...
2
votes
1answer
267 views
Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?
I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file:
How can I tell if it was signed with an extended validation (EV) code-signing certificate?
...
2
votes
0answers
309 views
Can I sign with two Code Signing certs to build reputation on the newer one?
I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon.
Obviously, the new certificate has no ...
2
votes
0answers
703 views
What is the difference between PKCS#7 and CADES, PADES and XADES?
I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
2
votes
0answers
821 views
Verify PKCS#7 (CMS) detached signature with timestamp with OpenSSL
I have a PKCS#7 (i.e., CMS) detached signature of a file that is signed by my signing certificate and then timestamp signed by a TSA that is all generated by an application we wrote. I would like to ...
2
votes
0answers
107 views
GPG self-signature default check level
I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned.
When issuing gpg --check-sigs one ...
2
votes
0answers
741 views
computing the exchange hash for ecdsa-sha2-nistp256
I am writing code for an SSH server and can not get past the Elliptic Curve Diffie-Hellman Key Exchange Reply part of the connection. The client also closes the connection and says "Host Key does not ...
2
votes
0answers
41 views
Can ECC correctness issues in CVE-2015-2730 allow “remote attackers to spoof ECDSA signatures”?
CVE-2015-2730: Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly ...
2
votes
0answers
76 views
Is common_schema safe?
Edit: this already has an answer here.
I just ran across common_schema, a utility for MySQL database administrators. It is a SQL script that creates a schema called common_schema in your database and ...
2
votes
0answers
69 views
Secure Golden Boot Key without Microsoft keys
I'm an Arch Linux user. I'd like to protect myself from the live-usb hack by using SecureBoot:
Create my own Platform Key and sign the kernel with my own key.
Delete the Microsoft PKs
Enable ...
2
votes
0answers
344 views
Algorithm to generate (and verify) string of 4 quad alpha numeric code
I am writing a system, for which I need to generate unique transaction numbers (which can be verified by myself). I want to use something similar to that used by credit cards, where a string of the ...
2
votes
0answers
67 views
Out of band signature application for banking transactions
I work on a banking signature project.
Signing transactions must be carried out on another application to respect the mechanism "Out Of Band". When the user makes a transaction, he must pass to a ...
2
votes
0answers
764 views
CMS signed data OpenSSL verification error
I have a CMS signed data that is successfully verified through Java BouncyCastle library.
When trying to verify through OpenSSL, I am getting the following error:
>openssl smime -verify -inform ...
2
votes
0answers
508 views
What is the point of signature file in signed JAR/ZIP files
The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
2
votes
0answers
470 views
CMS/PKCS#7: specifying signatureAlgorithm with digest?
I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1).
The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
2
votes
0answers
487 views
Digital signature based authentication schema using two passwords
I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
20 views
XMLDSIG and XAdES for non-XML file types
When I use XAdES for file types other than XML, how is the file digested for signature?
My understanding is that XAdES is XMLDSIG with a couple extra fields. For XML signatures, the signature is ...
1
vote
0answers
44 views
Can an EMV bank card be used to digitally sign documents?
Bank accounts are bound to an identity. Can bank cards be used in the same way as https://www.identrust.com/certificates/document-signing ?
1
vote
0answers
27 views
New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key
I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu.
I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
1
vote
0answers
89 views
Examples of SSH key exchange algorithms requiring encryption-capable host keys
In the SSH spec, Section 7.1, key exchange algorithms are distinguished based on whether they require an "encryption-capable" or a "signature-capable" host key algorithm.
If I ...
1
vote
0answers
47 views
Signing event-stream responses
I am working on an application where the general approach is signing most response payloads with HMAC, but there are a couple of endpoints that return text/event-stream in the response. What is the ...
1
vote
0answers
37 views
Authenticating Adobe .pdf electronic signatures
Having created a certificate for electronic signing within Adobe Acrobat DC, can I authenticate documents signed using it by issuing a signed paper statement to recipients stating that it would be ...
1
vote
0answers
66 views
Why does PGP create a signature from plaintext?
From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and ...
1
vote
0answers
753 views
Why does keycloak use HS256 algorithm to sign access token when client settings specify RS256?
I have the following setup with a keycloak authentication server and an application:
user logs in on application client side, send un/pw to server
application server sends un/pw to keycloak server ...
1
vote
1answer
79 views
Public Digital Signature Validation with JWE
After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, ...
1
vote
0answers
250 views
Breakdown of signature verification in CertificateVerify (TLS 1.3) with RSA-PSS
I'm debugging a TLS v1.3 client program, which failed to verify the signature in server's CertificateVerify, so I'm learning the procedures for verifying the signature from server's CertificateVerify ...
1
vote
0answers
68 views
Forward secrecy (plausible deniability) and storing messages
How do messengers, like signal or XMPP-omemo messengers, store their messages?
Since the session key is only valid for the current session, how can such extensions like MAM (message archiving on XMPP ...
1
vote
0answers
38 views
How do I check if my key is updated in a keyserver after I resend it with new signatures?
I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures.
The thing is that when ...
1
vote
0answers
44 views
What does jarsigner verify in the first place (integrity or authenticity)?
I was reading sth about android code signing and have run into this statement:
The second jarsigner command at v in Listing 3-7 first verifies the
signature block and signing certificate, ...
1
vote
0answers
251 views
Windows Smart Screen pops up after EV Code Signing
I am code signing my application's installer using an EV Code Signing that we have bought recently at work. The code signing is performed when the installer is created using Inno Setup (version 5.6.1)....
1
vote
0answers
64 views
Why is digital signature enforcement on webservers not common practice?
Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
1
vote
2answers
756 views
Are all fields of the PE certificate directory hashed during authenticode signing?
In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
1
vote
0answers
158 views
Working with Security Metadata in APK file
According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
1
vote
0answers
193 views
What is a trans-cipher?
While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering").
I ...
1
vote
0answers
36 views
How to assign not-PDF file by digital certificate?
XML, EPUB, etc. formats need also to be signed by digital certificate, like in the PDF's certificate-based signatures. There are reliable open-standards and open-source software to accomplish it?
PS: ...
1
vote
0answers
112 views
Signing with multiple end entity certificates
Let's assume we are having a structure with a root certificate with lots of "child" certificates.
A message is transmitted which is signed by any of the child certificates. The receiver has stored ...
1
vote
1answer
194 views
Server pagination with key in response to fetch next page
I want to introduce pagination in one of my server endpoints.
The endpoint will have an option to include in the parameter the last index of the previous page, and if included, the "page" returned ...
1
vote
0answers
35 views
GPG RSA Authenticity Mechanism Minimum Requirement
The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity:
the public key
the signature
the fingerprint of the public key
Assuming that the author keeps his ...
1
vote
0answers
1k views
Private key to sign a XML file
I’ve never dealt with cryptography before so my question may be sound trivial.
I need to create an app that sends messages as digitally signed XML files.
The messages are sent to a CA entity.
...
1
vote
0answers
149 views
Choosing a more or less secure signature algorithm with very short signature length
For a software registration code, I would like to sign a phone number of around 14 digits with a private key and then check it in an app.
I would imagine to use RSA or something but the signature ...
1
vote
0answers
1k views
How to force a full Client SSL handshake and ignore abbreviated client SSL handshake? Is it insecure?
I understand the SSL handshake flow, but I'm facing a logic problem with an abbreviated SSL handshake.
Use case:
The user is authenticated on system for common ways, such as passwords. But for some ...
1
vote
0answers
68 views
What is the advantage of using Digital Signature Standard over other Digital Signature Schemes?
From what I understand, the digital signature standard (DSS) makes use of an additional global public key at signing and verification end, along with the sender's private and public key respectively ...
1
vote
0answers
271 views
Can Windows AppLocker validate the Authenticode digital signatures of programs and DLLs when it runs them?
By "validate", I mean the same as Windows Explorer (or "signtool verify /pa") does: compute the file digest and verify that it's the same as the one stored encrypted in the signature, and check the ...
1
vote
0answers
382 views
Create a signed file from the detached signature and the clear text file content
Assuming I have the following:
data.txt
data.ps7 (the detached signature)
Can I generate the bundled signed file ?
Any example would be great, using C#, Java or openssl or any other tool ?
