digital-signature

I am using bcmail-jdk16-1.46.jar and bcprov-jdk16-1.46.jar (Bouncycastle libraries) to sign a string and then verify the signature . This is my code to sign a string : package my.package; import java.io.FileInputStream; import java.security.Key; import java.security.KeyStore; import java.security.PrivateKey; import java.security.Security; import java.security.Signature; import java.security.cert.X509Certificate; import java.util.ArrayList; import java.util.List; import org.bouncycastle.cert.jcajce.JcaCertStore; import org.bouncycastle.cms.CMSProcessableByteArray; import org.bouncycastle.cms

Would like to know if anybody knows any free(trial) time-stamp server service. I would like to test time stamping features in itext. Like I used Start Com class 1 as free CA for testing purposes. Hope I made it clear. Hoping someone knows a place Thanks jnm2 You can try one of these publicly accessible RFC 3161 compliant time-stamping services: https://freetsa.org Supports HTTP, HTTPS and TCP transports and has other features http://time.certum.pl http://dse200.ncipher.com/TSS/HttpTspServer http://tsa.safecreative.org 5 free requests per day (may not be valid as root CA is 'test') - Safe

I have a raw (r,s) format ECDSA NIST P-256 public key. It seems that there is no simple way to load it into an object that implements java.security.interfaces.ECPublicKey. What is the cleanest way to load a 64 byte public key so that it can be used to check signatures? This answer is going to be tough if we do this using ECPublicKeySpec . So lets cheat a bit: private static byte[] P256_HEAD = Base64.getDecoder().decode("MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE"); public static ECPublicKey convertP256Key(byte[] w) throws InvalidKeySpecException { byte[] encodedKey = new byte[P256_HEAD.length + w

I'm implementing a process elevation helper for Windows. It's a program that will run in elevated mode and launch other programs with administrator privileges without displaying additional UAC prompts. For security reasons, I want to make sure only binaries that are digitally signed with my company's Authenticode key can be executed. The WinVerifyTrust function gets me halfway there, but it only ensures that a binary is signed by some key that is part of Microsoft's chain of trust. Is there a relatively simple way to perform the Authenticode verification AND ensure that it is signed by our

I may need to implement an OAuth2.0 server for an API I'm creating. This API would allow 3rd parties to perform actions on the user's behalf. OAuth2.0 has 3 mains calls. First, there is a call to prompt the user for consent. This returns a code . The second is where the code is exchanged for a access token . Finally, the access token is used to call the API on the user's behalf. For implementation, I was thinking the first call generates a random string which acts as a code . The code is then stored in a database with a pointer to the current User and a random HMAC Key , then the random data

I need to insert a digital signature into already existing pdf files, using a rails application server. (Basically, clients upload pdf files and the server signs them with a local certificate) I've been using JSignpdf to insert digital signatures into pdf files, and started probing for gems for ruby... I've found another portable file to do this job on rubypdf site http://soft.rubypdf.com/software/pdf-digital-signe , but cannot find any gem or even example code to do this in ruby. I've looked also at Digital signature verification with OpenSSL , but couldn't understand how to actually sign an