Skip to main content

Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
2 votes
0 answers
20 views

Forgable and unconfidential short-term signature [migrated]

I have a very unusual set of requirements for a cryptographic system and hope someone can help me. My requirements are: Asymmetric: A private key is needed to sign, and a public key is used for ...
pils_user_'s user avatar
1 vote
0 answers
24 views
+100

EIDAS compliant advanced digital signature in company name

The company I work for is developing a digital signature application very similar to DocuSign, but we aim to make our signatures EIDAS compliant. For the first version we aim to do the same thing ...
Michael Munta's user avatar
1 vote
0 answers
46 views

How to verify the downloaded Mozilla Firefox binary? [duplicate]

I'm wondering about the correct steps when you want to download Firefox from their server and validate it has not been tampered with. Assume you download the latest Firefox tar-bz2-package from https:/...
Gere's user avatar
  • 147
0 votes
0 answers
50 views

How to securely store signature file

I am using TPM to to encrypt and sign my data. But since I am not security expert, I need to come to you guys :D I am developing this app to verify file content. I already has this part sorted out ...
Croksie's user avatar
0 votes
1 answer
65 views

Is Digital Signature really necessary for an open system considered by FDA's 21 CFR Part 11?

21 CFR Part 11's Subpart B for Electronic Records has a section on 'Controls for Open Systems" stating that: Persons who use open systems to create, modify, maintain, or transmit electronic ...
BambiBundle's user avatar
16 votes
5 answers
5k views

Is it possible to sign Git commits on a different computer?

I'm doing some development work on an untrusted computer. I'd like to sign my commits I make from it, but I don't want my personal PGP key to touch this computer. Or maybe I'm using a PGP smart card ...
Danya02's user avatar
  • 373
0 votes
0 answers
81 views

Is hashing a digital signature for quick (but incomplete) validation a known and/or acceptable practice?

Let's say that there's a known digital signature issued by a trusted CA. Normally, digital signatures need to be evaluated: checked if they are expired, revoked, if there's a problem in the chain of ...
TAbdiukov's user avatar
  • 186
1 vote
0 answers
97 views

Certify using Yubikey

I just started using a Yubikey 5. I've set up GPG according to this excellent guide, and now I have 3 working ECC key pairs on my Yubikey: Sign/S :: ed25519, Encrypt/E :: cv25519, Authentication/A :: ...
telephone's user avatar
  • 111
0 votes
0 answers
96 views

Revoking a digital signature at the cryptographic level

How do I indicate that a specific document or transaction associated with a particular signature should no longer be considered valid? I'm talking of recalling a signed document, not revoking the ...
microwth's user avatar
  • 2,483
0 votes
1 answer
235 views

How to check e-mail message authenticity? Suspected EML file forging

In a small company, we have an issue suspecting a former employee has forged an e-mail to our company from his Hotmail account by changing its date and recipients in the EML file, claiming that the ...
Asdf's user avatar
  • 101
0 votes
1 answer
87 views

Validate server-side code using hash?

If you have a client-side script (e.g client.py) communicating with a server-side script (e.g server.py). Using SSL certificates the identity of the server is automatically verified. But how do you ...
O'Niel's user avatar
  • 2,916
1 vote
0 answers
79 views

Which server CA to use for device fleet management?

(I likely didn't use correct keywords, but I was not able to have a complete info about below question). Working on a IoT device, capable to connect to our own server, using MQTT and HTTPS connections,...
unalignedmemoryaccess's user avatar
0 votes
0 answers
148 views

How to prevent public key tampering

I have to store a document (e.g. a JSON file) on a remote PC (that my App is running on) alongside a signature to be able to verify that this file was signed by me. I have no access to this PC nor ...
Croksie's user avatar
2 votes
1 answer
117 views

How to feasibly digital sign high volume documents with CA issued digital certificate?

My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
BambiBundle's user avatar
0 votes
0 answers
80 views

Remote eIDAS Qualified Signatures: Control of Signature Activation Data

In eIDAS Remote Qualified Signatures, but also in other Remote-Signature Solutions, the cryptographic keys are held by the Remote Signature Provider. The user uses some method, e.g., a smartphone app, ...
ARGYROU MINAS's user avatar
3 votes
0 answers
119 views

Does a signature service provider level digital certificate for electronic signature comply with eIDAS requirement for Advanced Electronic Signatures?

I have some basic questions regarding eIDAS and 'Advanced Electronic Signatures'. Say, if I create a product under my company Acme Inc that offers a simple electronic signature where I sign every ...
BambiBundle's user avatar
0 votes
0 answers
36 views

Do `Signature` headers have real benefits? [duplicate]

I'm working with an HTTPS API that requires me to include a Signature header, the signature is calculated as codeBase64(hmacWithSha384(key, body)). I'm wondering if it provides any real-life benefits ...
hangyas's user avatar
1 vote
1 answer
125 views

Write message that can be verified by any member of a group

I am trying to develop a scheme for publishing a message to a group of recipients. Any recipient needs to be able to verify who the message was sent by. There may be tens of messages generated each ...
gilbertbw's user avatar
  • 111
0 votes
1 answer
120 views

How to provide signature for a thin client app?

If I have a Java thin client app that connects to a server, and I want to protect my client from a malicious use, so I want to implement a sort of signature. Now the struggle is, if I want to sign the ...
ethicalhacker's user avatar
0 votes
0 answers
212 views

How is client side JWT signature validation beneficial from a security perspective?

I’ve been reading about how clients can verify JWT signatures using a public key provided by the server. I’m struggling to understand how this solves any issues. The only attack I’ve seen which this ...
JoffLobster's user avatar
0 votes
1 answer
271 views

Are the public keys of root certificate and intermediate certificate contained in an SSL certificate?

I read this, but it doesn't say if the public keys of the root and intermediaries are inside.
warnerque's user avatar
0 votes
2 answers
148 views

What happens behind the scene when I install an SSL certificate for a website?

I understand I need to upload my digital certificate that I obtained from CA and also my private key. But what happens in the server after I uploaded? Does the server actually read my certificate and ...
warnerque's user avatar
1 vote
2 answers
171 views

How does a CA-backed signature works?

I would like to understand how certificate-based signature works, I understand the standard asymmetric key signature where one party signs using their private key, and anyone else can validate this is ...
felartu's user avatar
  • 43
2 votes
4 answers
319 views

Using FIX over TLS, is there a need to sign FIX mesages?

We have 2 servers communicating, server A (a server that I own), and server B (server on the internet that I trust). I get some info from server B, which are FIX messages (https://en.wikipedia.org/...
ethicalhacker's user avatar
0 votes
1 answer
107 views

are files sent in a TLS channel signed? [duplicate]

I have 2 endpoints that are exchanging data (FIX messages), and the originating endpoint is genrating the fix files are sending them on an ecrypted channel (TLS or Stunnel). In a security audit, it ...
ethicalhacker's user avatar
0 votes
1 answer
371 views

How does RS256 work in a website

I'm developing a website and trying to use the algorithm RS256 to generate and verify the signatures of clients (JWT). Here is how I generate a signature at the client side (I use the Python script to ...
Yves's user avatar
  • 361
-1 votes
1 answer
107 views

Digital Signatures [closed]

In RSA signatures, Alice signs the message using her private key, and Bob verifies the message using Alice's public key. If an attacker has the signed encrypted message, then can they also verify the ...
MxML's user avatar
  • 1
1 vote
1 answer
186 views

Java Cryptography classes - program agnostic usage

We are planning on implementing encryption or digital signatures using any of the available classes provided by the Java Cryptography Architecture (e.g. KeyPair, MessageDigest, Cipher, KeyStore, ...
StephenG's user avatar
3 votes
2 answers
610 views

My web application needs to have my users' private keys to sign documents on their behalf. How do I handle that?

Our web application issues governmental documents for our users. Every one of those documents needs to be signed with a private key. However, because our users find it cumbersome to point their ...
H. Sérvio's user avatar
2 votes
1 answer
512 views

OIDC ID Token nonce as "poor mans digital signature"

In absence of better solutions, is the nonce is an OpenID Connect ID Token usable to serve as digital signature. The process would be as follows: A hash is created from the to-be-signed document/...
Cochise Ruhulessin's user avatar
0 votes
1 answer
371 views

Over what fields is the X509 hash computed over? [duplicate]

Is this how X509 certificates are verified to be valid? The receiver receives the certificate Look at the issuer of the cert, and find the public key of that CA (its hardcoded in the application or ...
user289431's user avatar
0 votes
2 answers
143 views

What could be the correct and secure ways to store and manage public keys?

I am developing an open source project(PKDSA) that uses ED25519 and ED448. My purpose of this project was to help others to enable user-secretless based passwordless authentication. There're a lot of ...
Hern's user avatar
  • 3
1 vote
1 answer
217 views

How does the client get the certificate (and public key) of the delegated authority (OCSP responder) to confirm the response in OCSP?

I have one question regarding the OCSP protocol to check if the certificate is revoked or not. The question is about checking whether the intermediate CA certificate immediately below the root CA is ...
dassd's user avatar
  • 113
0 votes
1 answer
279 views

How to get a CA into a Trust Chain

I'm using Google CA Service Provider in the Google Cloud to issue key materials on their FIPS-140-2 Level 3 HSMs (google's service). I intend to send the attestation bundle alongside public keys and ...
Vlad A.'s user avatar
2 votes
1 answer
199 views

Payment Gateway rejecting Digitally Signed Payment Message

I am new to digital signatures. I read many problem statements, solutions, and documents but nothing came to my rescue. Payment Message (Text) needs to be digitally signed with the following specs as ...
Vishal's user avatar
  • 21
0 votes
3 answers
340 views

Need for authentication in an offline system

I need to design a scheme, where access to an offline System is granted based on some kind of information/proof of knowledge, provided by a separete system, Prover system. I'm in position where I can ...
pwes's user avatar
  • 111
1 vote
1 answer
122 views

qualified e-signature long-term security

I'm considering to obtain a QES (Qualified electronic signature). But I'm concerned about long term security. The hypothetical scenario is lets say after 10-15 years the algorithms are cracked or ...
akostadinov's user avatar
1 vote
2 answers
418 views

Does verifying a code signature require making a network connection?

Does Windows 11 need to make a network connection to verify a code signature for a .exe or .dll file?
greyyit's user avatar
  • 13
0 votes
1 answer
165 views

Can an attacker flip bits of a signature to create DoS?

Assume two parties communicating. A sends a message to B signed with its private key. B received the message and verify it using the public key of A. Can an attacker launch a DoS attack by flipping ...
lll's user avatar
  • 3
3 votes
0 answers
517 views

Secure boot + full disk encryption, should I sign the kernel?

I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain. Here's what I did so far : Enroll my own keys in the UEFI firmware Sign my grub bootloader Full disk ...
ShellCode's user avatar
  • 130
0 votes
1 answer
117 views

e-signature + digital signature aws md5

I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents. My question are: Is MD5 (...
user286122's user avatar
1 vote
1 answer
104 views

What is the most secure hardware option for the use of personal eIDAS compliant QES in the EU?

I know that there are two approaches, one with local capsulated storage, such as USB token or smartcard, and the other with cloud-based key vault. Both are secured with a PIN that has to be entered in ...
simeonz's user avatar
  • 113
1 vote
0 answers
135 views

Is there any use case of DAA (Direct Anonymous Attestation) in TPM?

I want to know the use cases of DAA (Direct Anonymous Attestation) in the real world.
user97821's user avatar
0 votes
0 answers
31 views

Is it possible for an app to sign data it generates so that the data can be guaranteed to come from the app? [duplicate]

Is it possible for an app binary to sign content generated by the app such that a verifier can confirm the data was indeed generated by a specific version of the app? For example: A mobile app from a ...
aphoniko's user avatar
1 vote
1 answer
116 views

Confusion Regarding TLS Handshake and Key Exchanges

I know much has been written on this topic, but I am still stuck on some on the details of TLS handshake and I would like to have a better understanding of what happens. I've been using several ...
DoubtingThomas3005's user avatar
1 vote
5 answers
577 views

How does a digital certificate prove authenticity?

Imagine the following scenario: We have Bob that wants to send a message to Alice. Both have a public/private key. Bob uses his private key to sign the digest (hash of the message) with it's private ...
muyat's user avatar
  • 13
1 vote
0 answers
182 views

mTLS on webhooks

I'm not understanding how does Sendgrid verify that's it's me who's sending them the HTTPS request on their webhook endpoint. Specifically, in their docs they show how to obtain their public key (to ...
Jenia Ivanov's user avatar
1 vote
1 answer
167 views

Does signing make any sense when encrypting with secret key is used?

When I use secret key which only one server know for symmetric encryption done with XChaCha20-Poly1305, is any benefit to use signing aswell? As long as only one server knows the secret, doesn't it ...
Szyszka947's user avatar
0 votes
1 answer
372 views

Do git commit signatures reveal key uid if different from git email?

I have a gpg key linked to my identity and real email address. I also use github with their private email functionality "[email protected]", which I set as my git email. ...
ahmedsabriz's user avatar
19 votes
2 answers
5k views

What exactly happens when I "validate" a digital signature?

Context: I'm filling my taxes and my country requires me to upload certain documents from my employer to verify the numbers I give to the government. These documents are "digitally signed", ...
WorldGov's user avatar
  • 333

1
2 3 4 5
18