Questions tagged [digital-signature]
A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).
899
questions
121
votes
6
answers
50k
views
Why should one not use the same asymmetric key for encryption as they do for signing?
In an answer to a question about RSA and PGP, PulpSpy noted this:
It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both). ...
- 27.2k
94
votes
4
answers
87k
views
SSL Certificate framework 101: How does the browser verify the validity of a given server certificate?
(I have a basic understanding of public/private key, hashing, digital signatures... I have been searching online & stack forums last couple days but cannot seem to find a satisfactory answer.)
...
- 1,051
85
votes
3
answers
23k
views
Does OpenPGP key expiration add to security?
I've created a new OpenPGP key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised ...
- 1,327
82
votes
8
answers
29k
views
Is it possible to "fake" being connected to a router?
A friend of mine is taking a UNIX systems class and mentioned to me that when they take exams they do so on their computers. That is all students are using their own computer/laptop. Students are not ...
- 701
71
votes
4
answers
111k
views
How does the digital signature verification process work?
I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses the public key ...
- 901
71
votes
1
answer
24k
views
Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?
Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
- 813
69
votes
10
answers
38k
views
Proving creation time/date of a screenshot
I have to produce a screenshot of a web page, and want to make sure others will know without any doubt that this screenshot has been produced today. That is, I would like to embed today's date in the ...
- 793
67
votes
8
answers
59k
views
Why do people still use/recommend MD5 if it has been proven weak since 1996?
It's still a commonly recommended way of hashing passwords, even if its insecurity had been proven in 1996:
Therefore we suggest that in the future MD5 should no longer be implemented in applications ...
- 2,253
67
votes
3
answers
15k
views
Why shouldn't I bring a computer to a key-signing party?
I'm looking at the event description for the key-signing party at an upcoming BSD conference, and it's mentioned that I shouldn't bring my computer in to the event:
Things to bring
no computer
What ...
- 1,260
59
votes
2
answers
9k
views
Would a digital signature have prevented the CCleaner compromise?
I read today about the CCleaner hack and how code was injected into their binary. People were able to download and install the compromised software before the company had noticed.
Isn't this what ...
user47894
57
votes
12
answers
14k
views
Is it possible to make a video that is provably non-manipulated?
Suppose a student takes an exam at home. Since home-exams are prone to cheating, the student wants to be able to prove that he/she did not cheat. So the student puts cameras in the room, which ...
- 1,095
53
votes
2
answers
11k
views
Digital Certificate deployment: using two certs for each user?
At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs:
One for signing documents, emails, etc. that is ...
- 2,833
51
votes
4
answers
53k
views
How to achieve non-repudiation?
If I have a message that I need to send to another person, how do I achieve non repudiation ?
Is digitally signing the message sufficient ?
- 1,797
51
votes
11
answers
5k
views
Does hashing a file from an unsigned website give a false sense of security?
Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
- 27.2k
50
votes
4
answers
51k
views
Can I use a private key as a public key and vice versa?
I have code to encrypt data using a public key and decrypt it using a private key. This is useful when a client wants to send data to a server and know that only the server can decrypt it.
But say I ...
- 602
49
votes
2
answers
87k
views
What is the actual value of a certificate fingerprint?
In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
- 1,687
45
votes
3
answers
7k
views
How safe are signed git tags? Only as safe as SHA-1 or somehow safer?
How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around.
So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
- 784
43
votes
10
answers
10k
views
Are there any OSes that verify program signatures before executing them?
If so, what are these OSes? Are they specially crafted? How difficult is it to apply this kind of program verification to the everyday OSes we use?
If not, why haven't people invented such OSes?
...
- 1,693
34
votes
6
answers
25k
views
What does "signing" a file really mean?
I'm a bit new to security and trying to get the concepts properly.
I'm wondering what exactly "signing" a file (a certificate, an apk file, or something else) means?
Do we sign the whole file so ...
- 491
31
votes
6
answers
16k
views
Are documents truly "signed" by DocuSign?
I've never been happy with the explanation DocuSign gives for themselves in their own marketing material (e.g. https://www.docusign.com/how-it-works/electronic-signature/digital-signature/digital-...
- 1,738
29
votes
7
answers
9k
views
How can I be sure that I am using the real Facebook?
I type www.facebook.com into my browser's address bar and press enter, then use Facebook.
Could I actually be visiting a fake Facebook even if I see a URL of https://www.facebook.com and a lock icon ...
- 964
29
votes
2
answers
5k
views
Can you sign using a digital certificate itself?
Googling I saw several lectures saying that it is possible to sign using digital certificates. I am confused about that, because according to my knowledge it is possible to sign only using the private ...
- 465
28
votes
7
answers
10k
views
Why do we need HTTPS for static content? If we can have a checksum at the end signed by the private key, won't that prove the validity?
This method which I am talking about can improve caching of images, videos, and CSS by the ISP rather than just depending on the browser cache. And it also proves the validity of the sender. Is there ...
- 447
28
votes
4
answers
28k
views
How do the processes for digital certificates, signatures and ssl work?
I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication.
Server has a digital certificate acquired from a CA. It also has public and ...
- 423
27
votes
2
answers
20k
views
Does my PGP key really need to match the e-mail address for which I'll be using it?
In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
- 27.2k
24
votes
4
answers
24k
views
Verifying android application integrity from server side
I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
- 3,417
24
votes
6
answers
62k
views
What does "key with length of x bits" mean?
I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
- 351
23
votes
9
answers
30k
views
Deprecation of SHA1 code signing certificates on Windows
EDIT (7/7/2016) - see addition at the end of post
I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables (http:...
- 331
22
votes
2
answers
23k
views
JWT: Choosing between HMAC and RSA
It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 ...
- 445
22
votes
4
answers
10k
views
What asymetric scheme provides the shortest signature, while being secure?
I've had a look at several signature schemes (DSA, ECDSA for the most common ones), and am wondering about whether there exist a scheme that would have the following properties :
Be asymmetric (one ...
- 323
21
votes
3
answers
24k
views
what is the difference between a mac and a digital signiture
I understand that a MAC algorithm takes a message and a private key as input and hashes them to a value. I understand that senders and receivers often use MACs to authenticate a message and check the ...
- 1,467
20
votes
3
answers
7k
views
Can attackers change the public key of certificate during the SSL handshake
The communication is not encrypted during the SSL handshake. If an attacker conducts a man in the middle attack between server and client to capture the certificate, and change the public key in the ...
- 363
20
votes
7
answers
5k
views
Is there a protocol that provides data integrity, but not encryption for HTTP?
HTTP
I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a MITM is performed.
HTTPS
On the other hand, HTTPS sends encrypted text over the network that can ...
- 2,351
19
votes
2
answers
5k
views
What exactly happens when I "validate" a digital signature?
Context:
I'm filling my taxes and my country requires me to upload certain documents from my employer to verify the numbers I give to the government. These documents are "digitally signed", ...
- 333
18
votes
3
answers
4k
views
What are you saying when you sign a PGP key?
When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address?
To explain what I mean, take the following two ...
- 6,885
17
votes
1
answer
7k
views
How does this unsigned exe launch without the windows 10 SmartScreen warning?
So, I have been working on my own project for which I have been looking into certificates and such. While browsing reddit I found a game which I can launch the exe file, expecting to get a Windows 10 ...
- 173
16
votes
5
answers
5k
views
Is it possible to sign Git commits on a different computer?
I'm doing some development work on an untrusted computer. I'd like to sign my commits I make from it, but I don't want my personal PGP key to touch this computer. Or maybe I'm using a PGP smart card ...
- 383
16
votes
3
answers
28k
views
License key / Serial number generator and checker
I need a serial number generator and accompanying checker. I would like to be able to set a salt (and maybe a length). The generator should only produce serial numbers that pass the test of the ...
- 261
16
votes
5
answers
29k
views
A standard way to manually add a digital signature to a pdf file?
I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
- 163
16
votes
3
answers
885
views
What is gained by hashing the last block on-device?
Recently I encountered the notion of "hashing the last block on-device".
It means that when computing a digital signature, the hash that serves as input for the actual signature computation is not to ...
- 4,348
16
votes
2
answers
752
views
Which factors should I consider for devices that accept handwritten digital signatures?
These days many locations ask you to give your signature on a digital signature pad/device.
As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
- 173
15
votes
6
answers
4k
views
Why not RSA-encrypt the entire document?
I have recently learned of a way for person B to verify that a document sent from person A is indeed from person A.
Person A gives Person B his public RSA key. This must be done reliably.
Person A ...
- 253
15
votes
3
answers
38k
views
How do I produce a CA signed public key?
I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
- 251
14
votes
2
answers
3k
views
What is meant with naïve sign & encrypt?
In his paper Defective Sign & Encrypt in S/MIME,
PKCS#7, MOSS, PEM, PGP, and XML, Don Davis is often talking about
the term
naïve sign & encrypt
After reading the paper, I'm not 100% ...
- 647
14
votes
3
answers
3k
views
Is it possible to use WebAuthn for digitally signing documents in the browser?
WebAuthn is a relatively new API for authentication, and it uses public key cryptography instead of something like passwords.
I am wondering if it is possible to use the cryptographic part for a ...
- 891
13
votes
2
answers
5k
views
What is the meaning of GnuPG's --list-sigs output?
gpg --list-sigs gives me somethings like the following (I edited the output only to show the interesting/different rows):
pub 2048R/4ACE309C 2016-11-01
uid lala_test2 <lala2@...
- 349
13
votes
3
answers
1k
views
Can signing too much compromise a private key?
Can a collection of many messages signed with the same private key be abused to either forge signatures so some (but not all possible) messages, or even worse to reconstruct that private key with less ...
- 7,958
13
votes
3
answers
3k
views
How are private keys handled in an enterprise?
We would like to start using digital signatures and possibly encryption for e-mails in our company. My knowledge of public-key cryptography is entirely theoretical with no practical experience.
In ...
- 307
13
votes
1
answer
674
views
What are the problems with encrypted but unsigned data?
In another question's answer, D.W. wrote:
Make sure there is authenticity protection for the encrypted data (e.g., encrypt and then sign/MAC): you will need both confidentiality and authenticity ...
13
votes
4
answers
3k
views
What's the point of providing file checksums for verifying downloads? [duplicate]
Many projects offering binaries, also offer hashes (e.g. SHA256) of those binaries, wither as .ASC files, or directly on the web page near the binary. This isn't to protect against network-caused ...
- 2,015