Post B5c2hUFK0hBxZwweFE by JustinDerrick@mstdn.ca
 (DIR) More posts by JustinDerrick@mstdn.ca
 (DIR) Post #B5ZuBKGwMyjTQfw52m by enigmatico@mk.absturztau.be
       0 likes, 0 repeats
       
       Does anyone know a site or document that explains how digital signatures work at a technical level? Because all I can find online is the basic overview and AIslop summaries that dont help me at all.More specifically the process of signing a document and verifying the signature.
       
 (DIR) Post #B5a5YYunC2e700rIZc by nicole4fox@datastream.cortexvoid.net
       0 likes, 0 repeats
       
       @enigmatico assuming the interest is PDF documents specifically? (Everythint PDF rrlated is broken and on fire)
       
 (DIR) Post #B5a5YZKJf93wHAngMC by enigmatico@mk.absturztau.be
       0 likes, 0 repeats
       
       @nicole4fox@datastream.cortexvoid.net And that I have to sign paperwork using it. I don't get to choose what I sign or what I sign with. If they give me a PDF to sign, it's a PDF I have to sign, whether it's broken and on fire or not.
       
 (DIR) Post #B5a5vLiwP5kIkRBHm4 by nicole4fox@datastream.cortexvoid.net
       0 likes, 0 repeats
       
       @enigmatico iirc they also explain how the signature works, my university did some research into pdf attacks, check the papers and sources on whats interesting to you https://pdf-insecurity.org/index.html
       
 (DIR) Post #B5a5vLsVpVOzE7evh2 by enigmatico@mk.absturztau.be
       0 likes, 0 repeats
       
       @nicole4fox@datastream.cortexvoid.net I'm not looking for attack vectors, I'm looking into how the signing and verification process works at a technical level.
       
 (DIR) Post #B5c2hUFK0hBxZwweFE by JustinDerrick@mstdn.ca
       1 likes, 0 repeats
       
       @enigmatico @nicole4fox Depends on how technical you want to get - but essentially, you have asymmetric keys - a private portion and a public portion.  If you generate a strong hash (SHA-256) of a document, then encrypt that hash with your private key, and send that signature along with the file, the recipient can generate their own SHA-256 hash of the document, then decrypt the signature using the private key. If the decrypted hash matches the generated hash, you know the document hasn’t been altered in transit, and that the only person who could have generated that signature is the person who holds the private key. The pubic key would be published somewhere (a directory, or the person’s website) so you could verify its authenticity. More complex systems are built on this, but at their core it’s a system built on private & public keys.
       
 (DIR) Post #B5c2i4mCBwsWsKbPU0 by lerxst@az.social
       1 likes, 0 repeats
       
       @enigmatico it’s an older book but “Applied Cryptography” by Bruce Schneier is a fantastic resource for all things cryptographic.