Skip to main content

Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
2 votes
0 answers
928 views

Can't sign commit with yubikey, GPG missing something

I don't know much about how yubikeys work, but I'm trying to sign a commit with one of them and I don't even know how to debug the problem. I got: gpg --list-keys /home/lz/.gnupg/pubring.kbx ----------...
35 votes
6 answers
25k views

What does "signing" a file really mean?

I'm a bit new to security and trying to get the concepts properly. I'm wondering what exactly "signing" a file (a certificate, an apk file, or something else) means? Do we sign the whole file so ...
1 vote
1 answer
284 views

Public Digital Signature Validation with JWE

After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, ...
2 votes
2 answers
2k views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
0 votes
1 answer
856 views

Why REST APIs that do not use RSA encryption to secure API keys?

After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key. The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
0 votes
2 answers
2k views

How does digital signature algorithms work in a private / public key environment?

From the Wikipedia page on the subject, I get, on a theoretical level, how the process of encrypting and decrypting a message works. The article states that: In a public-key encryption system, any ...
6 votes
3 answers
753 views

DHE exchange and client authentication

If a server has a known public key and a Diffie-Hellman exchange is performed and signed by that key, is there any benefit to authenticating the client before establishing a secure channel instead of ...
2 votes
1 answer
134 views

Adobe uses CA signature type as identifier on signatures created with user certificates

I am testing several PKCS12 keystores with ECC type keys, generated by a CA with RSA key, to sign PDF documents. I have also tested with my own certificates from a demo CA certificate. I use Adobe ...
0 votes
0 answers
349 views

Using Openssl for Package signing with timestamp

We started with openssl dgst to sign and verify packages successfully. Then we thought we should do a timestamped signatures. That's when the process is bit unclear. We used the openssl ts commands to ...
0 votes
2 answers
3k views

File carving JPG exif data files

So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving. This ...
1 vote
2 answers
158 views

How to prove the authenticity of the telemetry message?

I'm curious what is the most widespread way nowadays to sign the telemetry message from a software program to prove its authenticity to the receiver? Imagine the software (which can run on-premise, at ...
0 votes
1 answer
899 views

How to license an offline software that automatically expired in the given amount of time? [duplicate]

Suppose I have a software which I sell to customer to use. I want to include a license that will be expired in let's say 1 year, so that customer need to renew their package. I want to prevent the ...
6 votes
1 answer
3k views

How can a .exe be modified and still keep a valid digital signature?

When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true. ...
51 votes
4 answers
53k views

How to achieve non-repudiation?

If I have a message that I need to send to another person, how do I achieve non repudiation ? Is digitally signing the message sufficient ?
7 votes
1 answer
1k views

What guarantees does GPG-signing a git commit provide?

It's pretty clear that GPG signing and GitHub ssh keys serve different purposes But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
1 vote
1 answer
991 views

Should refresh tokens be signed?

I'm not using an identity provider. I have a small system with access and refresh tokens and it works well. Assume the system follows the "typical" approach: when user authenticates or ...
5 votes
2 answers
327 views

How can I guarantee non-modification of data with signatures?

I am required to design a system where auditors can come along some time in the future, examine historic data, and be sure that the data has not changed since it was stored. I have a spec that ...
5 votes
1 answer
1k views

Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?

I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file: How can I tell if it was signed with an extended validation (EV) code-signing certificate? ...
0 votes
0 answers
94 views

Is it possible for a company to buy a signing certificate so that everything it signs (Software,SSL, Documents) states its from that company?

If I work for a company that wants to sign its own certificates for its website, documents and software it writes, is it possible? I have read a couple of post on here from around 10/8 years ago but ...
6 votes
1 answer
5k views

Why does keycloak use HS256 algorithm to sign access token when client settings specify RS256?

I have the following setup with a keycloak authentication server and an application: user logs in on application client side, send un/pw to server application server sends un/pw to keycloak server ...
2 votes
4 answers
2k views

Does a certificate authority use different private keys?

I was wondering whether a CA has different private keys to sign certificates with? Is there a risk of crypto-analysis (or something similar) when a CA signs thousands of certificates with the same ...
3 votes
1 answer
865 views

Asymmetric public-key cryptography: can either key be used to encrypt or decrypt?

Key exchange describes a public key encrypting plaintext and the private key decrypting, while in digital signatures the reverse is true where the private key is used to encrypt a hash that the ...
3 votes
1 answer
2k views

What signature and certificate signing is all about

I know that X.509 certificate signing process includes creating a CSR (certificate signing request) and then the following happens: Some data's from the certificate to be signed hash is computed ...
0 votes
0 answers
80 views

How does "./" affects signature generation for files, in a PHP based web application?

I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
1 vote
0 answers
100 views

Does Google Update perform cryptographic checks against releases?

My company is looking to allow Google Chrome to self-update, a necessity as we are finding it difficult to keep up with their release cycle in order to mitigate vulnerabilities. On the pro side, ...
1 vote
0 answers
40 views

Role of public and private keys of client certificate in mTLS [duplicate]

I'm curious to know how mTLS works in more detail in regard to client authentication. Firstly, I issued 3 certificates: root CA, server and client. The last two are signed with the root CA. Secondly, ...
2 votes
3 answers
679 views

Is it possible to create a certificate for a key pair which I do not possess?

Perhaps the answer is no, and perhaps this is a dumb question. However I am trying to understand the underlying principles better. My understanding of certificate signing process. I generate a key ...
0 votes
0 answers
138 views

double hashing for code signing and verification

I have environmental constraints where the cyber and safety functions are segregated such that safety operations are handled by one unit and cyber operations such as firewall, HIDS, secure storage etc....
0 votes
0 answers
90 views

How do Cloud-based services provide Qualified Electronic Signatures?

From what I know about QES, they come on smart cards and USB tokens and are password protected. When a site asks you for a client certificate, you need to have it plugged in and enter the password ...
2 votes
1 answer
381 views

Parse VBA Macro Digital Signature

When I open up my macro-enabled office files (i.e., .docm, .xlsm, .pptm) that contain signed macros as a Zip file, I see the following three files which I assume contain the digital signatures for the ...
0 votes
1 answer
282 views

mTLS Client Authentication by Signing Arbitrary Message using Browser

this is my first post here in the area of ​​security and encryption. I will try to be succinct, and let you know that I am not an expert in security. Context: My client (visitor) has an X509 ...
1 vote
1 answer
1k views

How can I use 'safe' Elliptic Curve algorithms in .Net Core?

I'm looking to build my own digital signature operations into a program I'm writing, and the nuances of cryptography are a bit beyond me. According to this website the NIST/NSA algorithms (P-224, P-...
0 votes
1 answer
295 views

Authentication to offline device

I have an offline safe at a remote location that I want to give people access to at my discretion. I would like to control who and when they have access, without having to travel to the safe. Example: ...
3 votes
2 answers
297 views

How can I prove the content of a PGP-encrypted message to a third party?

Imagine this scenario A StackExchange user sends you a PGP-encrypted message You decrypt the message and discover that you are being blackmailed You report the message to the admins but they are ...
0 votes
3 answers
201 views

How to "trust" data that is posted from one application to other

We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
1 vote
1 answer
713 views

Why does length of Signatures in two certificates using same Signature Algorithm sha256WithRSAEncryption is different?

I have this recent Wikipedia certificate issued by intermediate CA Let's encrypt: Certificate: Data: Version: 3 (0x2) Serial Number: 03:95:2f:46:69:de:e4:d2:19:35:7f:f0:...
2 votes
2 answers
184 views

Digital Signatures validity when changing Certificate Authority

An enterprise has its internal PKI-1 (Root CA) that issues certificates to sign document using CAdES-C (CAdES-LT); with Complete Validation Data References and revocation references. Now this ...
0 votes
0 answers
96 views

Strange keystore from payment processor

I am working on an older software for a company at the moment and in my work have been upgrading a number of libraries. The app connects to a web service hosted by the third party payment processor, ...
2 votes
1 answer
1k views

USBlyzer - Safe Or Not?

I need to use a USB analyzer. I've been looking at a couple of different options. This one came up. As far as I can tell, it's not open source, but seems to be quite popular. Seeing that the data ...
0 votes
1 answer
1k views

Is DSA-1024 safe to sign package repositories ? What are the reasons?

I recently found that the latest release of a major Linux distribution (MX Linux) uses DSA-1024 in /etc/apt/trusted.gpg and in /etc/apt/trusted.gpg.d/*.gpg It also probably uses SHA-1 as the signature ...
57 votes
12 answers
14k views

Is it possible to make a video that is provably non-manipulated?

Suppose a student takes an exam at home. Since home-exams are prone to cheating, the student wants to be able to prove that he/she did not cheat. So the student puts cameras in the room, which ...
1 vote
1 answer
706 views

Signing Binaries in CI/CD

I've been considering how continuous integration/delivery environments handle code signing. If I maintain some open source project which uses a CD environment to build binaries to ship to users, I may ...
1 vote
1 answer
208 views

Keeping a whitelist of GPG keys on git server

Why don’t git servers (gitlab, github, etc…) allow for a whitelist of public GPG keys allowed to sign commits? For example, Alice owns a GPG key with fingerprint 0A1B2C3D while Bob’s is 4E5F0A0B. They ...
0 votes
1 answer
161 views

Possible to limit an SSL certificate holder to issuing redirects?

Is it possible to issue an SSL certificate that limits the certificate holder to issuing https redirects? Or more generally, limiting the holder to issuing specified data through the secure pipe, ...
0 votes
0 answers
170 views

Docker: How to download & verify a publisher's root key (out-of-band, distinct-domain cryptographic verification, WoT)

For a given publisher of docker images on Docker Hub (let's say debian), how do I download their root release/image signing key and verify its authenticity from multiple sources out-of-band from each-...
0 votes
1 answer
1k views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
0 votes
1 answer
696 views

How hard is to reverse engineer a signature for a given message?

Given the following situation: User makes a request for temporary access to a video Backend responds with a json file containing timeAllowedInSeconds: 5 Backend also responds with the signature of ...
1 vote
0 answers
293 views

How to go about checking if Windows is running any untrusted drivers (programatically)

I want to enforce a rule that my program start only if, at the time it launches, there are no untrusted kernel drivers running. I'm aware and have already tested file signature verification using ...
2 votes
1 answer
248 views

How useful is PDF signing in real world usage?

Background scenario: So we had a problem where our system (Alice's shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%...
3 votes
1 answer
609 views

How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?

Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include: Hosting the website under HTTPS; ...

1 2
3
4 5
18