Collaborate Disseminate
I’m reading rfc5652, there are different references of the two algorithm identifiers.
For example in this ASN.1 structure :
https://tools.ietf.org/html/rfc5652#section-5.3
When using RSA for signing; isn’t the digest algorithm represents t… Continue reading What’s the difference between digest algorithm and signing algorithm? [migrated]
I read about an attack on the TESLA protocol which will be used in Galileo’s navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1)
Basically, an attacker delays all messages to make… Continue reading Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?
I have recently been introduced to GPG signing as a better way of verifying data than hashing. It was described that if you posted the hash of the file, someone could hack your website, alter the hash and publish a different binary and you… Continue reading Main Reasons for GPG over hashing for verification
How can I list all of the Docker Content Trust root keys on my system?
I am setting up a CI process that will use the debian:stable-latest docker image to build my application’s releases in ephemeral cloud instances. I want to make sure th… Continue reading How to list all of the known root keys in docker (Docker Content Trust)
I have a test certificate chain that I generated and it fails the openssl verify command:
openssl verify -CAfile ca_cert.pem -untrusted intermediate_cert.pem server_cert.pem
The output I get from the command is :
C = US, ST = CA, O = serv… Continue reading openssl verify error: unable to get local issuer certificate
I saw some certificate providers offer different certificate types like code signing, document signing, so the question here what would be the difference between a domain certificate and document certificate? And do they have some informat… Continue reading What is the difference between domain certificate and document certificate
Let’s say I want to give some data to Bob. I have his public key. I tell him to generate a digital signature for text "{some_stuff: 1, nonce: 2}". After he does that and after I verify it’s the right signature, I give him the dat… Continue reading Identification through digital signature. How safe is it?
In the context of public key infrastructure, digital signatures and "normal" signing, what does federated signing mean?
I googled the term and found only one author using the term in one article. The article does not describe the… Continue reading What does federated signing mean?
I received an email like this above:
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1
Because anyone can claim to be me. There’s no validation of the user
name or email address when someone posts a comment. While I do try to
remove imposters… Continue reading How to verify PGP signature with signing key using Enigmail in Thunderbird [migrated]
I’m working on a diagram to describe the process of issuing digital certificates, with the help of answers on my question here and some other research:
I just read in the IETF that:
The signatureValue field contains a digital signature c… Continue reading Is certificate signature encoded to ASN.1 format?