Collaborate Disseminate
[Daljeet Nandha] from [RoboCoffee] writes to us, sharing his research on cryptographic signature-based firmware authenticity checks recently added to the Xiaomi Mi scooter firmware. Those scooters use an OTA firmware …read more Continue reading Xiaomi Cryptographically Signs Scooter Firmware – What’s Next?
After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key.
The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This technique is used by financial platforms li… Continue reading Why REST APIs that do not use RSA encryption to secure API keys?
Either know the private key and use it scrupulously in your digital signature calculation…. or just send a bunch of zeros instead. Continue reading Critical cryptographic Java security blunder patched – update now!
Many downloads offer an OpenPGP signature, which can be used to verify the file, but if a hacker manages to manipulate the file, then he can also simply change the signature key, or not?
Continue reading Why trust a PGP signature if it is distributed along with the data being verified?
I’m curious what is the most widespread way nowadays to sign the telemetry message from a software program to prove its authenticity to the receiver?
Imagine the software (which can run on-premise, at customers PC) creates a telemetry reco… Continue reading How to prove the authenticity of the telemetry message?
We want to replace traditional signature of papers by digital signature in our organazation. The process is simple:
A signs the data using his/her private key which is saved inside a secure RFID card. for this we need some biometric solut… Continue reading PKI digital signature technologies
How do I generate SSH keys inside my yubikey, on Ubuntu?
There seems to be nowhere to look for this info.
Suppose I have a software which I sell to customer to use. I want to include a license that will be expired in let’s say 1 year, so that customer need to renew their package.
I want to prevent the user (customer) from trying to bypass the … Continue reading How to license an offline software that automatically expired in the given amount of time?
I have a lot of binary files that contain some data that is signed using CMS.
The files have the form:
$ openssl cms -inform DER -in test.cms -cmsout -print
CMS_ContentInfo:
contentType: pkcs7-signedData (1.2.840.113549.1.7.2)
d.signe… Continue reading Strip CMS Signature from file (using openssl?)
I want to use symmetric encryption to create a digital signature.
What can be the possible scenarios where symmetric encryption is used to create digital signatures?