Digital signatures and electronic documents: a cautionary tale
نویسندگان
چکیده
Often, the main motivation for using PKI in business environments is to streamline workflow, by enabling humans to digitally sign electronic documents, instead of manually signing paper ones. However, this application fails if adversaries can construct electronic documents whose viewed contents can change in useful ways, without invalidating the digital signature. In this paper, we examine the space of such attacks, and describe how many popular electronic document formats and PKI packages permit them.
منابع مشابه
Analyzing registry, log files, and prefetch files in finding digital evidence in graphic design applications
The products of graphic design applications leave behind traces of digital information which can be used during a digital forensic investigation in cases where counterfeit documents have been created. This paper analyzes the digital forensics involved in the creation of counterfeit documents. This is achieved by first recognizing the digital forensic artifacts left behind from the use of graphi...
متن کاملDocument-centric XML workflows with fragment digital signatures
The use of digital document management and processing is increasing. Traditional workflows of paper forms are being replaced by electronic workflows of digital documents. These workflows often require multiple signatures to be added to the documents for authorization and/or integrity. We describe examples of digital workflows that illustrate problems with digital signatures: i.e. the use of dig...
متن کاملDigital Signatures for Patient Documents Delivered via the WWW
Background. The World Wide Web (WWW) is increasingly being used as a delivery platform for biomedical documents. Methods to implement data integrity policies are needed to ensure the correctness of information contained in these documents. Such policies are intended to ensure that data remain consistent with its source and to allow the identification of errors, duplications, omissions, and inte...
متن کاملTowards concrete application of electronic signature
Even though the theory behind digital signatures is fully understood and the related cryptographic methods have proved the efficiency in deploying security services, concrete application of digital signature to real electronic documents is still hindered by the lack of standards. In particular, we lack standards for the format of the data to be signed, the format of the signature itself and the...
متن کامل