New answers tagged

4

Normally, you'd just run a good hashing algorithm on all files, generate a list of file hashes, put that along with your files, and then just cryptographically sign that. So, procedure: GPG your recipients need to have a public key of yours that they can trust, pre-shared¹ cd path/to/files/to/end/up/on/CD; sha256sum --tag **/** > hashes.sha256 gpg --...


0

With JWS you can use one of the signature schemed supported. Broadly there are three options - HS, RS and PS - HMAC , RSA PKCS 1.5 and RSA PSS respectively. The payload and protected headers would be signed and the signature would be transmitted. As far as overall security is concerned, be aware of alg:None issues with JWS libraries and the possibility kg ...


2

The problem is actually not to make sure that Alice cannot copy the document (i.e. preserve uniqueness as you asked) but to make sure that it is clear who owns this document currently. A solution to this problem might be if not only the documents are signed but the transactions (transfer of ownership) are signed too. In this case Alice might claim that she ...


3

A digital signature is a type of cryptographic code that can be attached to a digital document to prove that it comes from a specific party and hasn't been altered or forged. It works by using asymmetric cryptography, which means there is a key pair consisting of a private key that the signer (the party that protects the document) uses to produce the digital ...


2

This is how I would rank preference for auth mechanisms from a security standpoint. Asymmetric - Mutual TLS Asymmetric - Signature based JWS like. Symmetric - HMAC or a similar symmetric signature based Pre shared credential based I will try to articulate the rationale behind my reasoning below. With authentication ideally we should be able to tackle the ...


2

AFAIK, the standard way is to use asymetric keys for signing: the private key is only known by the sender the request is hashed with a standard algorithm, and that hash is encrypted with the private key to form a signature which is transmitted with the request the server uses the public key to decrypt the signature and control that it corresponds to the ...


1

A digital signature is a technique that verifies the authenticity of the digital document in which particular code is attached to the message that acts as a signature. A hash of the message is utilized for the creation of the message and after that message is encrypted with the sender’s private key. The signature ensures the source and integrity of the ...


1

A Digital Certificate is essentially a message digitally signed by your CA, containing your public key plus some metadata describing who you are. The CA essentially attests that they have validated the metadata according to their certification practice statement and that they have verified that the entity specified in the metadata controls the private key ...


4

With git, a cryptographic signature at the tip of the branch provides strong integrity guarantees of the entire history of that branch going backwards, including all metadata and all contents of the repository, all the way back to the initial commit. This is possible because git records the hash of the previous commit in each next commit's metadata, creating ...


2

For the sake of a complete answer considering some major advances on the topic since the question was initially answered, I will provide an alternative one. The answer is still "trusted timestamps", but the mechanism is quite different. Ask yourself, where might you find a source of public, transparent, chronological events that is both immutable and ...


Top 50 recent answers are included