Timeline for Digital signature using only x509 certificate
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 15, 2020 at 15:18 | comment | added | daparic | The first half is the keystore which is a file in a hard disk. This file contains the user's private key and the certificate chain that vouch for this person's identity. The other half is the publicly published certificate containing the public key counterpart of the private key that is inside the keystore. I believe, the intention is to sign using the person's certificate with the goal of producing an output that has a proof of origin. But technically, it is the private key in the keystore that is used to achieve this. The outside world will use the person's certificate to prove origin. | |
| Apr 21, 2020 at 15:57 | vote | accept | DraQ | ||
| Aug 23, 2019 at 14:35 | comment | added | DraQ | ISMSDEV thanks for your reply and no offense taken ;). I'm just giving the benefit of the doubt to the customer which told us that this scenario was possible. I told him much of what we're discussing here, yet I wanted to double-check if there was an alternative scenario that I was not considering. | |
| Aug 23, 2019 at 10:53 | comment | added | user163495 | There is a very simple argument as to why "only" having the certificate and nothing else is not enough for a signature: The certificate is presented to everybody to prove the identity of the one holding the certificate. If it were enough, then everybody could forge every signature. | |
| Aug 23, 2019 at 10:50 | answer | added | dave_thompson_085 | timeline score: 6 | |
| Aug 23, 2019 at 5:25 | comment | added | garethTheRed | If you sign with a private key it provides evidence of the source of the signed data. That is, only you have the private key, so the signed data came from you. If, on the other hand, you sign with the public key, you are stating absolutely nothing about the data. As a public key is, by definition, public knowledge, I could get hold of it and sign data in your name. The whole idea is completely pointless. | |
| Aug 22, 2019 at 20:48 | comment | added | ISMSDEV | NEVER distribute the private key. Otherwise you are destroying ANY purpose of using it. You can sign with x509 certificates, that’s common, but it’s the private key that is used to sign. It sounds like you are not totally sure on how it works, no rudeness mentioned at all, so I would seek to only implement something from the advice of an expert in this case. You don’t want to risk getting it wrong. All the best | |
| Aug 22, 2019 at 20:36 | comment | added | DraQ | Our customer wants to sign with only a x509 certificate. What you say is how it is really supossed to work. You sign with your private key that's correct. My question is if it is possible to sign only with the public key in the x509 or if it is necessary to embed your private key in the certificate. In that case, I agree with you that you're implicitly distributing your private key and that you should't do that, right? | |
| Aug 22, 2019 at 20:34 | history | edited | DraQ | CC BY-SA 4.0 | deleted 17 characters in body |
| Aug 22, 2019 at 20:04 | comment | added | ISMSDEV | Not totally sure of your question. I think you may be confused with how public/private keys work. Private keys are NEVER distributed under ANY circumstance. Also, you sign with a private key and the public key is used to validate the authenticity of the message. As only the private key holder can sign the message. | |
| Aug 22, 2019 at 20:00 | review | First posts | |||
| Aug 22, 2019 at 23:13 | |||||
| Aug 22, 2019 at 19:55 | history | asked | DraQ | CC BY-SA 4.0 |