What is Digital SignatureWhat is Digital Signature

A digital signature is a bit of stream through which many things like verification of origin of document,the identity of the sender, the date and time the document was send may be verified. This is a piece of information based on both the document and the signer's private key.It is created through a hash function and signer private key.

Unlike a pen-and-ink signature, a digital signature also proves that the document has not been altered after it was signed. This property is called “integrity”.

Basis of Digital SignaturesBasis of Digital SignaturesThe basic idea in the use of digital signatures is as follows.

1. You "sign" the document or code using one of your private keys, which you can generate by using keytool or security API methods.

2. You send the document or code and the signature to the other person, called "receiver," .

3. You also supply the receiver with the public key corresponding to the private key used to generate the signature, if the receiver doesn't already have it.

4. The receiver uses the public key to verify the authenticity of the signature and the integrity of the document/code.

CertificatesCertificates

A certificate contains

• A public key.

• The "distinguished-name" information of the entity (person,company, or so on) whose certificate it is. This entity is referred to as the certificate subject, or owner. The distinguished-name information includes the following attributes (or a subset): the entity's name, organizational unit, organization, city or locality, state or province, and country code.

• A digital signature. A certificate is signed by one entity, the issuer, to vouch for the fact that the enclosed public key is the actual public key of another entity, the owner.

• The distinguished-name information for the signer (issuer).

A’s Private key

A’s Public key

‘B’ ‘C’ ‘D’

A’s Coworkers

Anyone can get A’s Public Key, but A keeps his Private Key to himself

‘A’

With his private key and the right software,’A’ can put digital Signature on documents and data.This is a “stamp” ‘A’ places on the data which is unique to ‘A’ and it is very difficult to forge.The signature assures that any changes made to that data that has been signed can not go undetected.

A, B,C & D are coworkers in a organization.

To sign a document, A's software will crunch down the data into just a few lines by a process called "hashing". These few lines are called a message digest. (It is not possible to change a message digest back into the original data from which it was created.)

Encrypt with private key

A’s software then encrypts the message digest with his private key.The result is the digital signature

`A`

Finally, Bob's software appends the digital signature to document. All of the data that was hashed has been signed and passes is to ‘B’

First, B's software decrypts the signature (using A's public key) changing it back into a message digest. If this worked, then it proves that ‘A’ signed the document, because only ‘A’ has his private key. B's software then hashes the document data into a message digest. If the message digest is the same as the message digest created when the signature was decrypted, then knows that the signed data has not been changed.

Decrypt with public key

`B`

‘C’ (our disgruntled employee) wishes to deceive ‘B’. ‘C’ makes sure that ‘B’ receives a signed message and a public key that appears to belong to ‘A’. Unbeknownst to ‘B’, ‘C’ deceitfully sent a key pair he created using A's name. Short of receiving A's public key from him in person, how can B be sure that A's public key is authentic?

It just so happens that ‘D’ works at the company's certificate authority center. ‘D’ can create a digital certificate for ‘A’ simply by signing A's public key as well as some information about A.

A Information:   Name   Department   Cubical Number

Certificate Info:   Expiration Date   Serial Number A's Public Key:

                      

‘D’

`C`

Now A 's co-workers can check A's trusted certificate to make sure that his public key truly belongs to him. In fact, no one at A's company accepts a signature for which there does not exist a certificate generated by D. This gives D the power to revoke signatures if private keys are compromised, or no longer needed. There are even more widely accepted certificate authorities that certify D.

Let's say that A sends a signed document to B. To verify the signature on the document, B's software first uses D's (the certificate authority's) public key to check the signature on A's certificate. Successful de-encryption of the certificate proves that D created it. After the certificate is de-encrypted, B's software can check if A is in good standing with the certificate authority and that all of the certificate information concerning A's identity has not been altered.

B's software then takes A's public key from the certificate and uses it to check A's signature.

To verify a signature, B need only click on it.

Use of the JDK Security API to Sign & verifying Use of the JDK Security API to Sign & verifying DocumentsDocuments

In my further Discussion I demonstrate the use of the JDK Security API with respect to signing documents. The lesson shows what one program, executed by the person who has the original document, would do to

• generate keys,

• generate a digital signature for the data using the private key, and

• export the public key and the signature on data files with data file.

Then I will show an example of another program, executed by the receiver of the data, signature, and public key. It shows how the program could

• import the public key and

• verify the authenticity of the signature.

Generating SignaturesGenerating Signatures

The GenSig program which I will show you use the JDK Security API to generate keys and a digital signature for data using the private key and to export the public key and the signature to files. The application gets the data file name from the command line.

The following steps create the GenSig sample program.

1. Prepare Initial program Structure

2. Generate public and Private Keys

3. Sign the Data: Get a Signature object and initialize it for signing. Supply it with the data to be signed, and generate the signature.

4. Save the Signature and the public Key in Files: Save the signature bytes in one file and the public key bytes in another.

5. Compile and Run the Program

Prepare Initial Program StructurePrepare Initial Program Structureimport java.io.*;import java.security.*; class GenSig { public static void main(String[] args) { /* Generate a DSA signature */ if (args.length != 1) { System.out.println("Usage: GenSig nameOfFileToSign"); } else try { // the rest of the code goes here } catch (Exception e) { System.err.println("Caught exception " + e.toString()); } } }

• The methods for signing data are in the java.security package, so the program imports everything from that package.

• A single argument is expected, specifying the data file to be signed. • The code written in subsequent steps will go between the try and the catch

blocks.

Generate Public and Private KeysGenerate Public and Private Keys A key pair is generated by using the KeyPairGenerator class.Generating the key pair

require several steps……

1. Create A key Pair Generator:The first step is to get a key-pair generator object for generating keys for the DSA signature algorithm.

The way to get a KeyPairGenerator object for a particular type of algorithm is to call the getInstance static factory method on the KeyPairGenerator class.

A caller may thus optionally specify the name of a provider, which will guarantee that the implementation of the algorithm requested is from the named provider. The sample code of this lesson always specifies the default SUN provider built into the JDK.

2. Initialize the Key-Pair Generator:All key–pair generators share the concepts of a keysize and randomness.The class has an initialize method that takes two types of arguments.keysize is the key length which is 1024 bit

The source of randomness must be an instance of the SecureRandom class. This example requests one that uses the SHA1PRNG pseudo-random-number generation algorithm, as provided by the built-in SUN provider. The example then passes this SecureRandom instance to the key-pair generator initialization method.

3. Generate the Pair of Keys: This step store keys in privatekey and publickey objects

Sign the DataSign the Data

Signing data, generating a digital signature for that data, is done with the following steps.

1. Get A Signature Object: The following gets a Signature object for generating or verifying signatures

using the DSA algorithm Signature dsa = Signature.getInstance("SHA1withDSA", "SUN"); 2. Initialize the Signature object The initialization method for signing requires a private key. dsa.initSign(priv);

3. Supply the Signature Object the Data to be Signed The program will read in the data a buffer at a time and will supply it to the

Signature object by calling the update method.

4. Generate the Signature Once all of the data has been supplied to the Signature object, you can

generate the digital signature of that data. byte[] realSig = dsa.sign();

Save the Signature and the Public Key in FilesSave the Signature and the Public Key in Files

We have to send three thing for verifying the signature.• The data for which the signature was generated,• The signature,and • The public key we have placed signature in a byte array named realSig. You can save the signature

bytes in a file named sig via the following. /* save the signature in a file */ FileOutputStream sigfos = new FileOutputStream("sig"); sigfos.write(realSig); sigfos.close(); You can get the encoded key bytes by calling the getEncoded method and then

store the encoded bytes in a file. /* save the public key in a file */ byte[] key = pub.getEncoded(); FileOutputStream keyfos = new FileOutputStream("suepk"); keyfos.write(key); keyfos.close();

Compile and Run the ProgramCompile and Run the Program

Compile the program and during running time we provide the name of the data file which is to be signed in command line argument, as in

java GenSig data.txt

After executing the program, you should see the saved suepk (public key) and sig (signature) files.

Verifying a Digital SignatureVerifying a Digital Signature In this I have written a “VerSig.java” program to verify the signature

generated by the “GenSig.java”program. This demonstrates the steps required to verify the authenticity of a signature.

VerSig imports a public key and a signature that is alleged to be the signature of a specified data file and then verifies the authenticity of the signature. The public key, signature, and data file names are specified on the command line.

The steps to create the VerSig sample program to import the files and to verify the signature are the following.

1. Prepare Initial program structure: 2. Input and Convert the Encoded Public key Byte: Import the encoded

public key bytes from the file specified as the first command line argument and convert them to a PublicKey.

3. Input the Signature Bytes: Input the signature bytes from the file specified as the second command line argument.

4. Verify the Signature: Get a Signature object and initialize it with the public key for verifying the signature. Supply it with the data whose signature is to be verified (from the file specified as the third command line argument), and verify the signature.

5. Compile and run the Program

Prepare Initial Program StructurePrepare Initial Program Structureimport java.io.*; import java.security.*; import java.security.spec.*; class VerSig { public static void main(String[] args) { /* Verify a DSA signature */ if (args.length != 3) { System.out.println("Usage: VerSig publickeyfile signaturefile datafile"); } else try{ // the rest of the code goes here } catch (Exception e) { System.err.println("Caught exception " + e.toString()); } }} - java.security.spec package, contains the X509EncodedKeySpec class.rest r same as in

generating digital signature program GenSig - three argument are expected ,specifying the public key,the signature,and the data files. - Code for rest operation is written in between try and catch blocks.

Input and Convert the Encoded Public Key Bytes Input and Convert the Encoded Public Key Bytes

VerSig needs to import the encoded public key bytes from the file specified as the first command line argument and to convert them to a PublicKey.

read in the encoded public key bytes. FileInputStream keyfis = new FileInputStream(args[0]); byte[] encKey = new byte[keyfis.available()]; keyfis.read(encKey); keyfis.close(); First we need a key specification. This we can obtain one via the following,

assuming that the key was encoded according to the X.509 standard, which is the case, for example, if the key was generated with the built-in DSA key-pair generator supplied by the SUN provider:

X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(encKey); Now you need a KeyFactory object to do the conversion. That object must be

one that works with DSA keys. KeyFactory keyFactory = KeyFactory.getInstance("DSA", "SUN"); Finally, you can use the KeyFactory object to generate a PublicKey from the key

specification. PublicKey pubKey = keyFactory.generatePublic(pubKeySpec);

Input the Signature Bytes Input the Signature Bytes

Next, input the signature bytes from the file specified as the second command line argument.

FileInputStream sigfis = new FileInputStream(args[1]);

byte[] sigToVerify = new byte[sigfis.available()]; sigfis.read(sigToVerify);

sigfis.close();

Now the byte array sigToVerify contains the signature bytes.

Verify the Signature

In My VerSig program I have done two things….

1. Input the encoded key bytes and converted them to a Publickey named pubkey

2. Input the signature bytes into a byte array named sigToverify

Initialize the Signature Object for Verification

Supply the Signature Object with the Data to be Verified

Verify the Signature

Compile and Run the ProgramCompile and Run the Program

Compile and run the program. Remember, you need to specify three arguments on the command line:

• The name of the file containing the encoded public key bytes

• The name of the file containing the signature bytes

• The name of the data file (the one for which the signature was generated)

Since you will be testing the output of the GenSig program, the file names you should use are

suepk (public key file)

sig (signature file)

data (data file)

Here's a sample run;

%java VerSig suepk sig data.txt

signature verifies: true (if valid)

Weakness & alternativesWeakness & alternatives

We send public key separately from data and digital signature file.Now possibility of attack is reduced unless until a user temper all three files.We should take steps to ensure that atleast public key is received intact.So we use certificate to facilates authentication of public key.

JDK has no public certificate API that would allow you to create a certificate from public key so we have to modify our program. We use “keystore” which have type “JDS”, the proprietary type created by Sun Microsystems.

Ensuring data Confidentiality

Some time we want our data is also hidden to other user which can see it in transit. So we encrypt whole data but encryption of data take some time.Here we have to make compromise.

Secure and Mobile Digital Signatures

for Internet Banking

In internet Banking weakness is storage and handling of the signature key.The straight forward solution is to free the user from this responsibility.In Internet banking keys are generated and stored centrally on a secure server, and the signature key never leaves this protected environment.

This System has some advantages…..

• Optimum physical security – The key is better protected on a secure server than on the user`s hard disk or on a smart card.

• Protection against theft – It is practically infeasible to steal a key from a secure server even for the system admin…

• Mobility - The owner can use the key from any terminal with Internet access.

• Logging - Access and use of key is logged which makes it easy to detect misuse