Questions tagged [digital-signature]

A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

Filter by
Sorted by
Tagged with
4
votes
3answers
355 views

What if somebody sends me genuine certificate that they do not own? [closed]

I just started learning about the digital certificates, its architecture and how it works internally. What will happen if someone sends me a genuine certificate for authentication which does not ...
4
votes
2answers
1k views

Distributed XAdES-X and XAdES-A signatures over multiple documents

As the standard is not completely clear in this matter, I'm trying to found out if the XAdES standard (ETSI TS 101 903 v1.4.2) describes distributed case in which the SigAndRefsTimeStamp element or ...
3
votes
1answer
263 views

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My ...
3
votes
3answers
612 views

Digital signatures and truly validating what was actually agreed to

I am developing an application and part of signing up requires a user to sign a contract agreement of using the service. I have been reading around the subject for a few days, and I am fairly happy ...
3
votes
2answers
2k views

Does asymmetric encryption guarantee data integrity?

I have some unusual size constraints for my data which may be relevant to the prescribed solution. The scenario is as follows. Secure server A generates 240 bytes of data that need to be consumed by ...
3
votes
3answers
2k views

Is there an attack that can modify ciphertext while still allowing it to be decrypted?

Is there any way an encrypted file using AES-256 could be modified without alerting the file owner, ie., so it can still be decrypted with the same key? I know that without an initialization vector ...
3
votes
2answers
3k views

GnuPG does not verify signature while decrypting

I have signed file 1.txt, result file is 1.txt.asc. I changed content in file 1.txt.asc (signed content, not signature). Then I verify signature in 1.txt.asc and I get information that signature is ...
2
votes
1answer
2k views

valid PDF signature without using hardware HSM or usb Token

I have a DMS system(alfresco) that needs to sign approx 50.000 valid signatures a year. The signing certificate needs to be acquired from one of the affiliated sub-CA's. So according to the Adobe CDS ...
2
votes
1answer
147 views

What secure RFID standards are there; for high value item inventory?

I am wanting to use some RFID devices to help with inventory management of some high value items (paintings). The paintings are packed in wooden transport cases, awaiting shipment. Periodically we, ...
2
votes
1answer
631 views

Signature and Timestamp for Long Term Document Archival Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity. As far as I understand, I ...
2
votes
1answer
1k views

The Hash header in GPG ASCII armor

When sending a signed message using GPG, it always includes a line that says Hash: SHA256 right at the top of my email. I was wondering if/why it's required, and if not, how I can remove it (in an ...
2
votes
1answer
731 views

Generating Own SSL certificate using DSC issued by a CA

Ok. So, here is what I know: SSL Certificate are used to verify domain for HTTPS protocol. These are issued by a root CA to ensure that it can be trusted by anyone using the website and trusting the ...
2
votes
2answers
2k views

PGP/GPG verifying authenticity

My boss recently implemented a new security system related to PGP/GPG. The whole idea behind this is to sign files so that people know from who they came. They don't require us to encrypt them, just ...
2
votes
1answer
351 views

Is the `ssh-agent`'s DSA signature deterministic?

In my hopes to use ssh-agent to generate a signature as password I implicitly assumed a deterministic signature. DSA is however supposed to take random value k for signing. However that randomness is ...
2
votes
1answer
218 views

RSA blind signature vs signing a *random* hash

My understanding is that the key feature of a blind RSA signature is that the signer is unaware of the contents of the message being signed. How is this different from simply appending a random salt ...
2
votes
2answers
1k views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...
2
votes
1answer
90 views

How to list all of the known root keys in docker (Docker Content Trust)

How can I list all of the Docker Content Trust root keys on my system? I am setting up a CI process that will use the debian:stable-latest docker image to build my application's releases in ephemeral ...
1
vote
2answers
411 views

Specific clarification on how https server public key is trusted

I know the general concept of how digital certificates works: e.g. server "signs" the message it wants to send to the client using his private key and sends along a message digest and on the receiving ...
1
vote
1answer
208 views

Is it possible to add backdoor to a file with the same size and crc32 checksum (4bytes)?

Is it possible to add backdoor to a file with the same size and crc32 checksum (4bytes)? (The file does not contain byte code, it contains program code as text. The language is PHP.)
1
vote
0answers
1k views

Guidance on Login using Digital Signature DSC (PKCS12 and x509 certificate)

I'm interesting in exploring possibility to authenticate user using their Digital Certificate. The methodology is to first register the DSC from the user and keep their Public key along with Serial ...
1
vote
1answer
221 views

What exactly is digested in an S/MIME signated-only e-mail?

What exactly is digested in an S/MIME signated-only e-mail? It's definitely not only a sha256-digest of the original message, which means that $ openssl dgst -sha256 <<< "Text" would ...
0
votes
1answer
530 views

Testing Digital signature on an incoming request via Apache

I am creating an API endpoint that receives payload from a third party. The third party is signing the request with there X509 Certificate(Private Key). I have been provided with their Public ...
0
votes
0answers
45 views

Is it possible to save a verifiable log of a TLS session? [duplicate]

Here's an example situation: I download a file from some server over https, but I also save a "log" of the TLS communication. Later, that file is removed from the server and nobody believes me when I ...
0
votes
1answer
859 views

Where is RSA Digital signature used in the online banking world?

When i do online banking, i sign my digital transaction with a digipass. Ive been told that it uses a RSA-based digital signature scheme. But an rsa digital signature (1024 bit for the modulus) is a ...

1 2
3