Collaborate Disseminate
When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true.
Indeed, as reported two days ago in Each Fir… Continue reading How can a .exe be modified and still keep a valid digital signature?
When explaining the concept of signing a message, often it is presented as "encrypting with your private key", so that somebody who has the public key can "decrypt" the signature and verify it. However, PGP signatures (… Continue reading PGP "real" encryption with private key
Could it be practical to authenticate API request through digital signature (based on headers and message body)? This would be asymmetric instead of something like HMAC which is not a signature. Are there performance or other constraint… Continue reading Digital signature for API authentication feasible?
Much of the promise associated with future digital identity infrastructures is associated with greater automation of the identity lifecycle and the provision of greater control of personal data to end-users. But automation also has the potential to red… Continue reading Does the future of digital identity offer us greater security and convenient experiences?
I’m not using an identity provider. I have a small system with access and refresh tokens and it works well.
Assume the system follows the "typical" approach:
when user authenticates or refreshes: he gets a new refresh token
refr… Continue reading Should refresh tokens be signed?
I’m not using an identity provider. I have a small system with access and refresh tokens and it works well.
Assume the system follows the "typical" approach:
when user authenticates or refreshes: he gets a new refresh token
refr… Continue reading Should refresh tokens be signed?
Applications that use cryptographically signed information for multiple purposes have the risk that one piece of signed information can be exchanged with another. When you use JWTs as session tokens, and you use JWTs as password reset toke… Continue reading Terminology for exchanging one piece of signed information for another
If I work for a company that wants to sign its own certificates for its website, documents and software it writes, is it possible? I have read a couple of post on here from around 10/8 years ago but has it changed much since then?
Is it an… Continue reading Is it possible for a company to buy a signing certificate so that everything it signs (Software,SSL, Documents) states its from that company?
The digital signature market estimates a market value of $7.1 billion from 2020 to 2025. In addition, the market will progress at a CAGR of 30% as per the latest market forecast report by Technavio. 33% of the market’s growth will originate from … Continue reading Digital signature market to reach $7.1 billion by 2025
I know that X.509 certificate signing process includes creating a CSR (certificate signing request) and then the following happens:
Some data’s from the certificate to be signed hash is computed using a hash-algorithm, i.e. SHA-256.
The h… Continue reading What signature and certificate signing is all about