Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
0
votes
1answer
33 views

control digital signing

Here is the use case: Router vendor to support 3rd party app hosting on their Routers with apps digitally signed by Router vendor only. Router to support skipping signature verification for App ...
0
votes
0answers
32 views

Authenticating Adobe .pdf electronic signatures

Having created a certificate for electronic signing within Adobe Acrobat DC, can I authenticate documents signed using it by issuing a signed paper statement to recipients stating that it would be ...
0
votes
2answers
62 views

How is the digital certificate sent alongside digital signatures?

Most tutorials on the net only mention sending the digital signature attached to the document, but without the digital signature certificate, it'll be impossible for receivers to verify the signature. ...
0
votes
2answers
48 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
0
votes
2answers
102 views

Sign records in a database [closed]

I have a table in my database where I store records to be processed later (basically orders that need to be invoiced or something similar, but this is not the important part). Since this software runs ...
1
vote
0answers
58 views

Why does PGP create a signature from plaintext?

From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and ...
0
votes
0answers
65 views

Why does keycloak use HS256 algorithm to sign access token when client settings specify RS256?

I have the following setup with a keycloak authentication server and an application: user logs in on application client side, send un/pw to server application server sends un/pw to keycloak server ...
-1
votes
1answer
39 views

Digital signature from hashing encrypted webpage

I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...
0
votes
1answer
77 views

Who am I really trusting?

My trusted root certificates are below. As an exercise, I want to be sure that a MITM is not changing the list. So, can I somehow get this list signed? In my opinion, the list could be signed by my ...
5
votes
1answer
326 views

Validating an Ed25519 public key

Is it possibly to test if an Ed25519 public key is valid without having access to the private key, a signed message or anything except the public key? "Valid" as in "Not just 32 random bytes". I'm ...
0
votes
0answers
21 views

How do i produce keypairs for my users while implementing json web token

I want to check the integrity of my user information; that the information which my website server receives was indeed sent by them. From what I understand, json web tokens (jwt) is the way to go. I ...
0
votes
1answer
52 views

Signing HTTP requests with JWS

Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say,...
0
votes
2answers
58 views

How to “trust” data that is posted from one application to other

We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
0
votes
2answers
47 views

How to establish a secure channel with authenticated and authorized access to a remote entity

I have the following problem: There are 3 parties A, B and X. X is holding 2 entities on behalf of A and B. A communicates with X to operate it's own entity. B also communicates with X to operate ...
5
votes
3answers
1k views

Why is a hash sent with data secure?

Hash values are also useful for verifying the integrity of data sent through insecure channels. The hash value of received data can be compared to the hash value of data as it was sent to determine ...
0
votes
2answers
33 views

Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?

As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
0
votes
0answers
53 views

How does jarsigner -verify work?

Every jar file contains a MANIFEST.MF file containing a hash for every file. With jarsigner -verify you can verify a jar file, but what are the steps taken to verify a signed .class file in a jar? I ...
0
votes
2answers
81 views

What if an attacker gets access to public key through an insecure media in digital signature?

If A encrpyts the message and creates signature using his private key and sends through the network then only B with the public key of A can decrypt that message. But what if the attacker gets access ...
2
votes
1answer
87 views

How misappropriation-resistant are common deployed signature formats?

Given an RSA signature as produced by openssl dgst -sha256 -sign rsapriv.pem -out afile.sig afile and without access to the private key used for that, one can¹ come up with a fully functional RSA ...
2
votes
0answers
209 views

Openssl cms verify signature with timestamp and crl

I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
0
votes
0answers
31 views

Whonix Image Download Bad Signature

Using gpgtools on MacOS, I have attempted multiple times to verify the signature of the Whonix image. I get: $ gpg --verify-options show-notations --verify Whonix-*.ova.asc Whonix-*.ova gpg: ...
5
votes
1answer
113 views

Does signing of HTTP requests have any benefit when using TLS?

Signing HTTP requests is all the rage nowadays. The benefits of doing so when communicating over an insecure channel are clear. With signatures you can bring message integrity and authentication to ...
2
votes
1answer
114 views

API request signing best practices

I am reading how different services are handling API signature and authentication. Particularly I was looking at: AWS Signing v4 WeChat Signature Algorithm Alipay Digital Signature Google Maps API I ...
2
votes
0answers
34 views

Authentication and authorization of a subrequest

A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...
0
votes
0answers
39 views

Are there any security implications of signing a hex digest over the binary digest?

Hash functions usually used for signing output a fixed amount of bytes. However, some tools output the data as an ASCII hex string, and other tools use the binary bytes. It is clear that from a ...
0
votes
0answers
73 views

How to store ECDSA public key securely in Android

I am writing an Android application that needs to verify that a request is sent from a trusted party (me). This is my current solution: Storing keys: Generate ECDSA public key / private key from a ...
4
votes
2answers
139 views

Generate digital certificates for employees using the organization's certificate

I live in Peru and we have a small problem in the organization where I work. Dozens of documents are physically signed daily but this is a waste of time since there are documents that must be signed ...
0
votes
0answers
50 views

How to measure security level of digital signature?

I want to measure the guarantee of integrity of a digital signature. I use RSA with a 4096 bit key, and SHA 256, and a passphrase. The level of security is going to depend on these three factors, ...
0
votes
1answer
40 views

Proving a software deployment's origin sourcecode [duplicate]

Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL? sourcecode from commit #10020 at ...
0
votes
0answers
42 views

How to import pgp backup back into smartcard?

I generated a backup of my master key and 3 sub keys following this into these archives: gpg.conf mastersub.key openpgp-recovs.d private-keys-v1.d (contains 4 .key files) pubring.kbx random_seed ...
3
votes
2answers
159 views

“Digital” signatures on real life objects

Although this question may be out of scope, I'm wondering if there's a reliable way to apply a "digital signature" to real life objects in order to prove your ownership of them to a degree. As an ...
1
vote
2answers
133 views

Can I use Let's Encrypt to verify my signing key?

I've made a signing key with GPG and I would like to have it verified since GPG displays a warning whenever a file signed with my key is verified. I've heard of Let's Encrypt but it only talks about ...
0
votes
0answers
34 views

When signature dont guarantee non repudiation

Ehy guys, I read that signature guarantee non repudiation. But in generale exist a way ti no guarantee non repudiation with signature? Ad example Enc(signature(m) should be guarantee Instead for ...
0
votes
0answers
55 views

QES AdESQC TL based Signature Validation Policy

Reading the ETSI EN 319 102-1 V1.1.1 (2016-05) Electronic Signatures and Infrastructures (ESI); Procedures for Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation. The ...
1
vote
1answer
233 views

APK Signature Scheme v1 vs APK Signature Scheme v2/v3

What are the security implications of using the APK Signature Scheme v1 instead of the APK Signature Scheme v2/v3? Are there any additional attack vectors for v1 except for direct attack vectors in an ...
0
votes
1answer
57 views

Cryptographically signing content / download

Let's say that I have an executable running on a client machine, and, it requires to download some updates on a regular basis. The solution uses TLS to communicate with the download server. I would ...
0
votes
0answers
63 views

The RSA-CRT-faults lenstra's attack signature

I was reading this [paper]https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf)1 about the use of faults in the computation of signatures with the CRT optimized version of RSA(see the end of the ...
1
vote
1answer
160 views

Is it possible to sign a DVD?

I work on a project where DVDs with configuration files and software updates are delivered periodically to end users, and our software loads those discs. For example, we might load a disc with an ...
1
vote
1answer
59 views

Public Digital Signature Validation with JWE

After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, ...
1
vote
1answer
57 views

How can I preserve the uniqueness of a document without a database?

I’m willing to create a system of transferable documents (identified by it’s ID) whose author can transfer his ownership of that document to another person (identified by his/her ID). For example: ...
1
vote
3answers
178 views

Difference between certificate and digital signature [duplicate]

What is the difference between a digital certificate and a digital signature? Read on the internet that the digital signature is the result of encrypting with a private key, the 'hash' of the message ...
5
votes
1answer
181 views

What guarantees does GPG-signing a git commit provide?

It's pretty clear that GPG signing and GitHub ssh keys serve different purposes But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
0
votes
0answers
93 views

Do the encrypt_and_digest() and decrypt_and_verify() methods of the pycryptodome module in python 3 also perform the electronic signature process?

Do the encrypt_and_digest() and decrypt_and_verify() methods in pycryptodome also perform the electronic signature process? I have seen on the internet that the electronic signature consists of ...
1
vote
0answers
14 views

How to make data content provable for specific timestamp? [duplicate]

Let me explain it with an example: Consider that timestamp of today is 1262304000000 (2010-01-01 00:00:00.00) and you have a web page (or file) with content "AAA". Content on this page may change ...
1
vote
0answers
123 views

Breakdown of signature verification in CertificateVerify (TLS 1.3) with RSA-PSS

I'm debugging a TLS v1.3 client program, which failed to verify the signature in server's CertificateVerify, so I'm learning the procedures for verifying the signature from server's CertificateVerify ...
1
vote
0answers
55 views

Forward secrecy (plausible deniability) and storing messages

How do messengers, like signal or XMPP-omemo messengers, store their messages? Since the session key is only valid for the current session, how can such extensions like MAM (message archiving on XMPP ...
2
votes
2answers
157 views

Hawk vs. API key authentication

For a HTTP(S) API, which is better (/ which is better under which circumstances)? Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...
0
votes
1answer
106 views

How can we use digital signatures for mutual authentication between two computers?

I get the fact that we can use digital signatures for authenticating the signer (since they are using their private key to create the signature, and this is known only to the signer ). But how can the ...
5
votes
1answer
140 views

Alternatives to cryptographic signatures

I have a program I am developing and am currently using ed25519 to cryptographicaly sign messages. However, even those signatures are longer than I would like (64 bytes + the message). The messages ...
0
votes
1answer
129 views

What is a TSA policy OID?

What is TSA policy OID? Is it a unique identifier of a timestamp server given by a world wide authority? Does that mean that no two servers can have the same oid? Or is it an identifier of the ...

1
2 3 4 5
15