digital-signature | 易学教程

Is there a standardized fixed-length encoding for EC public keys?

阅读更多关于 Is there a standardized fixed-length encoding for EC public keys?

I was wondering if there was (and I hope there is) a standard for public key size for ECDH (Elliptic Curve Diffie-Hellman) and ECDSA (Elliptic Curve Digital Signature Algorithm) for every curve type over prime fields (192, 224, 256, 384 and 521). emboss If you use one of the "named curves" then the public key size is fixed and dependent on the "field size" of your underlying curve. Compressed vs. uncompressed representation Public key sizes further depend on whether the "uncompressed" representation or the "compressed" representation is used. In the uncompressed form, the public key size is

verifying detached signature with BC

阅读更多关于 verifying detached signature with BC

How can I verify a detached signature (CMS/pkcs #7 signature) using the BouncyCastle provider in Java? Currently, my code below throws an exception with the message message-digest attribute value does not match calculated value Security.addProvider(new BouncyCastleProvider()); File f = new File(filename); byte[] buffer = new byte[(int)f.length()]; DataInputStream in = new DataInputStream(new FileInputStream(f)); in.readFully(buffer); in.close(); CMSSignedData signature = new CMSSignedData(buffer); SignerInformation signer = (SignerInformation) signature.getSignerInfos().getSigners().iterator()

What does “Not LTV-enabled” mean?

阅读更多关于 What does “Not LTV-enabled” mean?

I'm using iText 5.5.3 to sign and timestamp PDF documents. It works very well. But I recently switched from Acrobat Pro X to XI and now I see this new line : the signature is not LTV enabled and will expire after <date> I guess this warns me that after this date, the signer's signature will be seen as invalid, right ? However the signature properties tells me : the signature includes an embedded timestamp : <date/time> signature was validated as of the secure timestamp time : <same date/time> Now I'm a little bit confused : since the signature was declared valid at a known and certified date,

Verify Authenticode signature as being from our company for automatic updater

阅读更多关于 Verify Authenticode signature as being from our company for automatic updater

问题 I am implementing an automatic update feature and need some advice on how to do this securely using best practices. I would like to use the downloaded file's Authenticode signature to verify that it is safe to run (i.e. originates from our company and hasn't been tampered with). My question is very similar to question #2008519. The bottom-line question: what's the best, most secure way to check Authenticode signatures for an automatic update feature? What fields in the certificate should be

Digital signature from electronic smartcard in Chrome

阅读更多关于 Digital signature from electronic smartcard in Chrome

问题 For an electronic prescription system, that runs on the browser and that requieres personal signature by the professional, we are using a Java applet to sign the XML request, that then is sended to a WS, using a smartcard. But since version 42, Chrome is disabling by default NPAPI support, and in future versions next to September 2015 it will be completely disabled and then applets won't be usable at all. At Chrome NPAPI deprecation page points to WebCrypto and TLS as alternatives. But it

How can I validate digital signatures for Microsoft's Portable Executable format in portable code? [closed]

阅读更多关于 How can I validate digital signatures for Microsoft's Portable Executable format in portable code? [closed]

问题 I am looking for sample code (or libraries) that can help me validate digital signatures for Windows PE files (.exe, .dll, .cab, .etc) on non-Windows platforms using C++. I am looking for a platform-independent approach. Thanks! 回答1: You could check at WINE's WinVerifyTrust implementation for a full programmatic way. And, actually, here is a good link How to verify executable digital signatures under Linux? that complains about WINE implementation (that was back in 2008), and thus, explains

How to validate if a signed jar contains a timestamp?

阅读更多关于 How to validate if a signed jar contains a timestamp?

问题 After a jar is signed and the -tsa option was used, how can I validate that the time stamp was included? I tried: jarsigner -verify -verbose -certs myApp.jar But the output does not specify anything about the time stamp. I'm asking because even if I have a typo in the -tsa URL path, the jarsigner succeeds. This is the GlobalSign TSA URL: http://timestamp.globalsign.com/scripts/timstamp.dll and the server behind it apparently accepts any path (ie. timestamp.globalsign.com/foobar), so in the

SignedXml Compute Signature with SHA256

阅读更多关于 SignedXml Compute Signature with SHA256

问题 I am trying to digitally sign a XML document using SHA256. I am trying to use Security.Cryptography.dll for this. Here is my code - CryptoConfig.AddAlgorithm(typeof(RSAPKCS1SHA256SignatureDescription),"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"); X509Certificate2 cert = new X509Certificate2(@"location of pks file", "password"); XmlDocument doc = new XmlDocument(); doc.PreserveWhitespace = true; doc.Load(@"input.xml"); SignedXml signedXml = new SignedXml(doc); signedXml.SigningKey =

Accessing signing/encryption in a browser's Keystore using JavaScript - sample code? (WebCryptoAPI)

阅读更多关于 Accessing signing/encryption in a browser's Keystore using JavaScript - sample code? (WebCryptoAPI)

I have a web server that allows access only using X509 authentication. Works like a charm. Now I want to extend the use of the X509 certificates (which are stored in the user's browser keystore) to Sign data before it is sent to the server (using JavaScript and HTTPPost) Decrypt data read from the server (where it gets encrypted using the user's public key stored there) I found this example doing RSA Signature which is pretty close.... only it does take the key from a HTML textarea. I want to read it from the key store. Now crypto is quite in flux: Mozilla w3C Internet Explorer 11++ Chome and

openssl command line to verify the signature

阅读更多关于 openssl command line to verify the signature

问题 Hi I have generated a key pair and used the private key to generate a signature. openssl rsautl -sign -in helloworld.txt -inkey aa.pem -out sig However I am unable to verify the signature with my public key: openssl rsautl -verify -in helloworld.txt -inkey aa.pub -sigfile sig I know there -sigfile is deprecated. and some of the online doc from openssl.org is wrong. Whats the command I should use to verify the sig with my public key? 回答1: I found two solutions to your problem. You can use