Cart
[Home] [By Thread] [By Date] [Recent Entries]
> With a signature, both you and the receiver can perform a > subsequent test that the signature and file still match up. Of course, > if the signature is also with the original data, and that's your only > copy, then someone could replace the signature too. There are actually two parts to checking a signature -- verifying that the signature is correct, and validating the identity of the signer. An adversary replacing the signature can pass the first test, but won't pass the second. > Even if not, you or > the receiver could conceivably maliciously replace both the file and > the signature, thus creating an uncertainty about whose copy is authentic. If the signature is using something like RSA, then not really. While the sender can create a new signed document, it will be harder for them to repudiate that they signed the first one. -- SOA Appliances Application Integration Middleware
|
