Home

XP_CRYPT Online Help

Prev Next

How To use XP_CRYPT GUI Introduction What is XP_CRYPT System requirements Free version limitations End user license agreement Installing XP_CRYPT Installation procedure Activation XP_CRYPT API What's new Encryption methods overview Session xp_crypt_set_var xp_crypt_get_var xp_crypt_close_session xp_crypt_init_session xp_crypt_set_option Asymmetric keys DSA xp_dsa_free_key xp_dsa_load_key xp_dsa_save_key xp_dsa_generate_couple RSA xp_rsa_generate_couple xp_rsa_generate_pub_key xp_rsa_load_key xp_rsa_priv_dec xp_rsa_pub_enc xp_rsa_save_key xp_rsa_free_key Digital signatures DSA xp_dsa_verify xp_dsa_sign RSA xp_rsa_sign xp_rsa_verify Hashing xp_crypt xp_md5 xp_sha1 Symmetric encryption AES128 xp_aes128_decrypt xp_aes128_encrypt AES xp_aes_decrypt xp_aes_encrypt DESX xp_desx_decrypt xp_desx_encrypt RC4 xp_rc4_decrypt xp_rc4_encrypt Triple DES xp_des3_encrypt xp_des3_decrypt Error codes Tutorial How to use GUI Advanced technique (Old) Table encryption (Old) Troubleshooting Troubleshooting overview

Digital signatures overview Authentication is any process through which one proves and verifies certain information. Sometimes one may want to verify the origin of a document, the identity of the sender, the time and date a document was sent and/or signed, the identity of a computer or user, and so on. A digital signature is a cryptographic means through which many of these may be verified. The digital signature of a document is a piece of information based on both the document and the signer's private key. It is typically created through the use of a hash function and a private signing function (encrypting with the signer's private key), but there are other methods. Every day, people sign their names to letters, credit card receipts, and other documents, demonstrating they are in agreement with the contents. That is, they authenticate that they are in fact the sender or originator of the item. This allows others to verify that a particular message did indeed originate from the signer. However, this is not foolproof, since people can 'lift' signatures off one document and place them on another, thereby creating fraudulent documents. Written signatures are also vulnerable to forgery because it is possible to reproduce a signature on other documents as well as to alter documents after they have been signed. Digital signatures and hand-written signatures both rely on the fact that it is very hard to find two people with the same signature. People use public-key cryptography to compute digital signatures by associating something unique with each person. When public-key cryptography is used to encrypt a message, the sender encrypts the message with the public key of the intended recipient. When public-key cryptography is used to calculate a digital signature, the sender encrypts the "digital fingerprint" of the document with his or her own private key. Anyone with access to the public key of the signer may verify the signature. Suppose Alice wants to send a signed document or message to Bob. The first step is generally to apply a hash function to the message, creating what is called a message digest. The message digest is usually considerably shorter than the original message. In fact, the job of the hash function is to take a message of arbitrary length and shrink it down to a fixed length. To create a digital signature, one usually signs (encrypts) the message digest as opposed to the message itself. This saves a considerable amount of time, though it does create a slight insecurity (addressed below). Alice sends Bob the encrypted message digest and the message, which she may or may not encrypt. In order for Bob to authenticate the signature he must apply the same hash function as Alice to the message she sent him, decrypt the encrypted message digest using Alice's public key and compare the two. If the two are the same he has successfully authenticated the signature. If the two do not match there are a few possible explanations. Either someone is trying to impersonate Alice, the message itself has been altered since Alice signed it or an error occurred during transmission. There is a potential problem with this type of digital signature. Alice not only signed the message she intended to but also signed all other messages that happen to hash to the same message digest. When two messages hash to the same message digest it is called a collision; the collision-free properties of hash functions are a necessary security requirement for most digital signature schemes. A hash function is secure if it is very time consuming, if at all possible, to figure out the original message given its digest. However, there is an attack called the birthday attack that relies on the fact that it is easier to find two messages that hash to the same value than to find a message that hashes to a particular value. Its name arises from the fact that for a group of 23 or more people the probability that two or more people share the same birthday is better than 50%.  In addition, someone could pretend to be Alice and sign documents with a key pair he claims is Alice's. To avoid scenarios such as this, there are digital documents called certificates that associate a person with a specific public key.  Digital timestamps may be used in connection with digital signatures to bind a document to a particular time of origin. It is not sufficient to just note the date in the message, since dates on computers can be easily manipulated. It is better that timestamping is done by someone everyone trusts, such as a certifying authority. There have been proposals suggesting the inclusion of some unpredictable information in the message such as the exact closing share price of a number of stocks; this information should prove that the message was created after a certain point in time.