Questions tagged [digital-signature]
A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).
881
questions
5
votes
1
answer
3k
views
Why does keycloak use HS256 algorithm to sign access token when client settings specify RS256?
I have the following setup with a keycloak authentication server and an application:
user logs in on application client side, send un/pw to server
application server sends un/pw to keycloak server ...
- 183
-1
votes
1
answer
83
views
Digital signature from hashing encrypted webpage
I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...
- 101
1
vote
1
answer
153
views
Who am I really trusting?
My trusted root certificates are below.
As an exercise, I want to be sure that a MITM is not changing the list.
So, can I somehow get this list signed?
In my opinion, the list could be signed by my ...
- 240
7
votes
1
answer
3k
views
Validating an Ed25519 public key
Is it possibly to test if an Ed25519 public key is valid without having access to the private key, a signed message or anything except the public key?
"Valid" as in "Not just 32 random bytes".
I'm ...
- 205
0
votes
1
answer
650
views
Signing HTTP requests with JWS
Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say,...
0
votes
3
answers
167
views
How to "trust" data that is posted from one application to other
We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
- 101
1
vote
2
answers
184
views
How to establish a secure channel with authenticated and authorized access to a remote entity
I have the following problem:
There are 3 parties A, B and X.
X is holding 2 entities on behalf of A and B.
A communicates with X to operate it's own entity. B also communicates with X to operate ...
- 133
5
votes
3
answers
2k
views
Why is a hash sent with data secure?
Hash values are also useful for verifying the integrity of data sent through insecure channels. The hash value of received data can be compared to the hash value of data as it was sent to determine ...
- 153
0
votes
2
answers
91
views
Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?
As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
0
votes
2
answers
502
views
What if an attacker gets access to public key through an insecure media in digital signature?
If A encrpyts the message and creates signature using his private key and sends through the network then only B with the public key of A can decrypt that message.
But what if the attacker gets access ...
- 13
2
votes
1
answer
144
views
How misappropriation-resistant are common deployed signature formats?
Given an RSA signature as produced by
openssl dgst -sha256 -sign rsapriv.pem -out afile.sig afile
and without access to the private key used for that, one can¹ come up with a fully functional RSA ...
- 1,169
5
votes
0
answers
2k
views
Openssl cms verify signature with timestamp and crl
I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
- 768
5
votes
1
answer
362
views
Does signing of HTTP requests have any benefit when using TLS?
Signing HTTP requests is all the rage nowadays. The benefits of doing so when communicating over an insecure channel are clear. With signatures you can bring message integrity and authentication to ...
- 603
4
votes
1
answer
5k
views
API request signing best practices
I am reading how different services are handling API signature and authentication.
Particularly I was looking at:
AWS Signing v4
WeChat Signature Algorithm
Alipay Digital Signature
Google Maps API
I ...
- 163
2
votes
0
answers
78
views
Authentication and authorization of a subrequest
A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...
- 153
1
vote
2
answers
862
views
How to store ECDSA public key securely in Android
I am writing an Android application that needs to verify that a request is sent from a trusted party (me).
This is my current solution:
Storing keys:
Generate ECDSA public key / private key from a ...
- 13
4
votes
2
answers
430
views
Generate digital certificates for employees using the organization's certificate
I live in Peru and we have a small problem in the organization where I work. Dozens of documents are physically signed daily but this is a waste of time since there are documents that must be signed ...
- 141
0
votes
0
answers
114
views
How to measure security level of digital signature?
I want to measure the guarantee of integrity of a digital signature.
I use RSA with a 4096 bit key, and SHA 256, and a passphrase. The level of security is going to depend on these three factors, ...
0
votes
1
answer
79
views
Proving a software deployment's origin sourcecode [duplicate]
Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL?
sourcecode
from commit #10020 at ...
- 267
3
votes
1
answer
684
views
"Digital" signatures on real life objects
Although this question may be out of scope, I'm wondering if there's a reliable way to apply a "digital signature" to real life objects in order to prove your ownership of them to a degree.
As an ...
- 283
1
vote
2
answers
515
views
Can I use Let's Encrypt to verify my signing key?
I've made a signing key with GPG and I would like to have it verified since GPG displays a warning whenever a file signed with my key is verified. I've heard of Let's Encrypt but it only talks about ...
- 113
1
vote
1
answer
317
views
QES AdESQC TL based Signature Validation Policy
Reading the ETSI EN 319 102-1 V1.1.1 (2016-05) Electronic Signatures and Infrastructures (ESI); Procedures for Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation.
The ...
- 1,109
1
vote
1
answer
2k
views
APK Signature Scheme v1 vs APK Signature Scheme v2/v3
What are the security implications of using the APK Signature Scheme v1 instead of the APK Signature Scheme v2/v3? Are there any additional attack vectors for v1 except for direct attack vectors in an ...
- 600
0
votes
1
answer
196
views
Cryptographically signing content / download
Let's say that I have an executable running on a client machine, and, it requires to download some updates on a regular basis. The solution uses TLS to communicate with the download server.
I would ...
- 1,102
1
vote
1
answer
265
views
Is it possible to sign a DVD?
I work on a project where DVDs with configuration files and software updates are delivered periodically to end users, and our software loads those discs. For example, we might load a disc with an ...
- 139
1
vote
1
answer
225
views
Public Digital Signature Validation with JWE
After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, ...
1
vote
1
answer
93
views
How can I preserve the uniqueness of a document without a database?
I’m willing to create a system of transferable documents (identified by it’s ID) whose author can transfer his ownership of that document to another person (identified by his/her ID).
For example:
...
- 85
1
vote
3
answers
515
views
Difference between certificate and digital signature [duplicate]
What is the difference between a digital certificate and a digital signature?
Read on the internet that the digital signature is the result of encrypting with a private key, the 'hash' of the message ...
- 575
7
votes
1
answer
776
views
What guarantees does GPG-signing a git commit provide?
It's pretty clear that GPG signing and GitHub ssh keys serve different purposes
But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
- 1,785
0
votes
0
answers
677
views
Do the encrypt_and_digest() and decrypt_and_verify() methods of the pycryptodome module in python 3 also perform the electronic signature process?
Do the encrypt_and_digest() and decrypt_and_verify() methods in pycryptodome also perform the electronic signature process?
I have seen on the internet that the electronic signature consists of ...
- 575
1
vote
0
answers
33
views
How to make data content provable for specific timestamp? [duplicate]
Let me explain it with an example:
Consider that timestamp of today is 1262304000000 (2010-01-01 00:00:00.00) and you have a web page (or file) with content "AAA". Content on this page may change ...
- 867
1
vote
0
answers
705
views
Breakdown of signature verification in CertificateVerify (TLS 1.3) with RSA-PSS
I'm debugging a TLS v1.3 client program, which failed to verify the signature in server's CertificateVerify, so I'm learning the procedures for verifying the signature from server's CertificateVerify ...
- 121
1
vote
0
answers
168
views
Forward secrecy (plausible deniability) and storing messages
How do messengers, like signal or XMPP-omemo messengers, store their messages?
Since the session key is only valid for the current session, how can such extensions like MAM (message archiving on XMPP ...
- 11
2
votes
2
answers
651
views
Hawk vs. API key authentication
For a HTTP(S) API, which is better (/ which is better under which circumstances)?
Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...
0
votes
1
answer
422
views
How can we use digital signatures for mutual authentication between two computers?
I get the fact that we can use digital signatures for authenticating the signer (since they are using their private key to create the signature, and this is known only to the signer ). But how can the ...
6
votes
1
answer
306
views
Alternatives to cryptographic signatures
I have a program I am developing and am currently using ed25519 to cryptographicaly sign messages. However, even those signatures are longer than I would like (64 bytes + the message).
The messages ...
1
vote
1
answer
638
views
What is a TSA policy OID?
What is TSA policy OID? Is it a unique identifier of a timestamp server given by a world wide authority? Does that mean that no two servers can have the same oid? Or is it an identifier of the ...
3
votes
1
answer
673
views
How reliable is Virustotal's file signature check?
I downloaded a setup.msi file from an untrusted website. Virustotal says it's a signed file and valid signature, by the developer company and "GlobalSign Extended Validation CodeSigning CA" 3 times ...
- 861
2
votes
1
answer
213
views
Questions on TLS 1.2 RFC - Clarification or references needed
I have been reading RFC 5246 on TLS 1.2 and have a few questions on algorithms chosen. Before I start, let me clarify that I am reading on 1.2 and not 1.3 because my ultimate interest is in DTLS 1.2.
...
- 261
1
vote
0
answers
83
views
How do I check if my key is updated in a keyserver after I resend it with new signatures?
I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures.
The thing is that when ...
- 111
1
vote
0
answers
100
views
What does jarsigner verify in the first place (integrity or authenticity)?
I was reading sth about android code signing and have run into this statement:
The second jarsigner command at v in Listing 3-7 first verifies the
signature block and signing certificate, ...
- 491
19
votes
2
answers
16k
views
JWT: Choosing between HMAC and RSA
It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 ...
- 415
0
votes
1
answer
106
views
Does same hash value indicate a valid key?
I send a message to someone along with a public key, which they use to hash the message.
If they get the same hash value that I get when I hash the same content with the private key, does that safely ...
- 1,167
1
vote
5
answers
1k
views
Can I use a cryptographic hash function to prove my authorship of an anonymous article?
From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
- 11
1
vote
1
answer
153
views
Does Integrity assures protection from unauthorized read, without any modification?
I'm not quite sure if I understood integrity deep enough.
Let's suppose that Alice and Bob are using a public-key algorithm and using signatures to assure their data integrity. A hacker was able to ...
5
votes
1
answer
786
views
Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?
I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file:
How can I tell if it was signed with an extended validation (EV) code-signing certificate?
...
- 171
0
votes
1
answer
133
views
Theoretical DKIM Question
I have been playing around with sending emails via telnet using text commands.
Theoretically...
Say I send an email from a typical mail agent that adds a dkim signature from a@a.com to b@b.com.
...
0
votes
0
answers
42
views
Just came to know about Digital Certificates. But did't understand the way clients can verify CA [duplicate]
So I just came to know about Digital certificates, and this is what I understand.
Public Key, Message + PK_encrypt(Hash(message))/Message Signing, And other identifiers is what a digital signature is....
- 1
2
votes
1
answer
203
views
Is there a name for this (unconventional?) use of RSA for authentication?
I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
- 21
2
votes
3
answers
224
views
Benefits of signing a random number?
Is there any benefit to signing a random number?
E.g. a link for password reset, sent to email, often includes a base64 encoded random number to prevent someone guessing what the password reset link ...
- 123