digital signature implementation in java - owasp.pdf
TRANSCRIPT
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD)URP2:$63
6WDWXV:$51,1*2YHUYLHZ
:KDWLVD'LJLWDO6LJQDWXUH"1HHGIRU'LJLWDO6LJQDWXUH
'LJLWDO6LJQDWXUHVLQ-DYDXVLQJ-&$6HFXULW\&RQVLGHUDWLRQVZKLOH,PSOHPHQWLQJ'LJLWDO6LJQDWXUH3HUIRUPDQFH&RQVLGHUDWLRQVZKLOH,PSOHPHQWLQJ'LJLWDO6LJQDWXUH
$OJRULWKPIRU,PSOHPHQWLQJ'LJLWDOVLJQDWXUHXVLQJ56$$OJRULWKP$OJRULWKP&RPPDQGVIRUJHQHUDWLQJNH\V&RGH6DPSOH
3XEOLF.H\&U\SWRJUDSK\MDYD6\PPHWULF(QFU\SWMDYD
5HIHUHQFHV7UDGXFFLyQ(VSDxRO
6WDWXV
5HOHDVHG
5RPDQLDQ7UDQVODWLRQKWWSZHEKRVWLQJJHHNVFRPVFLHQFHGLJLWDOVLJQDWXUHUR
:$51,1*
7KLVZLNLSDJHZDVUHFHQWO\EURXJKWWRP\DWWHQWLRQE\-LP0DQLFRZKRDVNHGPHWRUHYLHZLWIRUDFFXUDF\,QGRLQJVR,QRWLFHGVHYHUDOHUURUVDQGDUHDVRIZHDNQHVV8OWLPDWHO\,SODQWRUHYLVHWKLVSDJHKRSHIXOO\ZLWKWKHDVVLVWDQFHRIRQHRIWKHRULJLQDORZQHUVEXW,GRQRWKDYHWLPHWRPDNHDFRPSOHWHUHYLVLRQDWWKHSUHVHQWWLPH7KHUHIRUH,ZLOOVXPPDUL]HZKDW,VHHLVSUREOHPDWLFZLWKWKHUHVWRIWKLVSDJHDQG\RXFDQGHFLGHWRXVHRUQRWZLWKWKHVHFDYHDWV
)LUVWDQGIRUHPRVWWKLVSDJHGRHVQRWGHVFULEHGLJLWDOVLJQDWXUHV5DWKHULWGHFULEHVDFRQFHSWNQRZQDVGLJLWDOHQYHORSHVZKLFKLVDVFKHPHXVHGZLWKWKLQJVOLNH60,0('LJLWDOVLJQDWXUHVDORQHQHYHUHQFU\SWWKHDFWXDOPHVVDJHWH[WEXWRQO\HQFU\SWDKDVKRIWKHPHVVDJHWH[W
87)HQFRGLQJVKRXOGEHXVHGWKURXJKRXWWRFRQYHUWEHWZHHQ-DYD6WULQJVDQGE\WHDUUD\VWRHQVXUHSURSHUSRUWDELOLW\DFURVVGLIIHUHQWRSHUDWLQJV\VWHPV
7KHFHUWLILFDWHFKDLQVKRXOGDOZD\VEHYDOLGDWHG,QWKHH[DPSOHKHUHWKHFHUWLILFDWHLVVHOIVLJQHGVRWKLVLVQRWUHOHYDQWEXWWKDWZLOOQRWEHWUXHLQWKHQRUPDOFDVH)XUWKHUPRUHLWVKRXOGEHQRWHGWKDWVHOIVLJQHGFHUWLILFDWHVZKLOHDFFHSWDEOHIRUGHPRQVWUDWLRQSXUSRVHVLVFRQVLGHUHGDGXELRXVSUDFWLFHIRUSURGXFWLRQDVLWRSHQVWKHGRRUIRULPSHUVRQDWLRQDWWDFNV
1,67QRZUHFRPPHQGVWKHXVHRIELWNH\VL]HIRU56$RU'6$NH\V
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
7KHUHLVDFRQVLVWHQWXVHRIZHDNDOJRULWKPV+HUHDUHVRPHVXJJHVWHGUHSODFHPHQWV
8VH56$(&%2$(3:LWK6+$$QG0*)3DGGLQJLQVWHDGRI56$(&%3.&63DGGLQJ8VH6+$RUEHWWHU6+$EXWDWOHDVW6+$LQVWHDGRI0'IRUWKHPHVVDJHGLJHVW8VH6+$ZLWK56$IRUWKHVLJQDWXUHDOJRULWKPUDWKHUWKDQ0'ZLWK56$:KHQFUHDWLQJDV\PPHWULFFLSKHUWRHQFU\SWWKHSODLQWH[WPHVVDJHXVH$(6&%&3.&63DGGLQJDQGFKRRVHDUDQGRP,9IRUHDFKSODLQWH[WPHVVDJHUDWKHUWKDQXVLQJVLPSO\$(6ZKLFKHQGVXSXVLQJ$(6(&%3.&63DGGLQJ(&%PRGHLVH[WUHPHO\ZHDNIRUUHJXODUSODLQWH[W,WLV2.IRUHQFU\SWLQJUDQGRPELWVWKRXJKZKLFKLVZK\LWLV2.WRXVHZLWK56$+RZHYHUXVLQJ&%&DQG3.&63DGGLQJFRXOGPDNH\RXYXOQHUDEOHWRSDGGLQJRUDFOHDWWDFNVVREHFDUHIXO
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
6HFXULW\&RQVLGHUDWLRQVZKLOH,PSOHPHQWLQJ'LJLWDO6LJQDWXUH
7ZRPDLQ6HFXULW\FRQVLGHUDWLRQVVKRXOGEHWDNHQLQWRDFFRXQWZKHQLPSOHPHQWLQJ'LJLWDO6LJQDWXUHV
6LJQWKHPHVVDJHDQGWKHQHQFU\SWWKHVLJQHGPHVVDJH 6LJQWKH+DVKRIWKHPHVVDJHLQVWHDGRIWKHHQWLUHPHVVDJH
3HUIRUPDQFH&RQVLGHUDWLRQVZKLOH,PSOHPHQWLQJ'LJLWDO6LJQDWXUH
6LQFH$V\PPHWULFHQFU\SWLRQDOJRULWKPVOLNH56$'6$DUHFRPSXWDWLRQDOO\VORZHUWKDQV\PPHWULFHQFU\SWLRQDOJRULWKPVOLNH$(6LWLVJRRGSUDFWLFHWRHQFU\SWWKHDFWXDOPHVVDJHWREHWUDQVPLWWHGXVLQJD6\PPHWULFNH\$OJRULWKPDQGWKHQHQFU\SWWKHNH\XVHGLQWKH6\PPHWULF.H\$OJRULWKPXVLQJDQ$V\PPHWULF.H\$OJRULWKP(JLIRQHZDQWVWRWUDQVPLWWKHPHVVDJH+HOOR:RUOGRI'LJLWDO6LJQDWXUHVWKHQILUVWHQFU\SWWKLVPHVVDJHXVLQJDV\PPHWULFNH\VD\DQELW$(6NH\OLNH[R)D+63Q:[(0L=(T
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
'HFU\SWWKHPHVVDJHXVLQJ5HFHLYHUSULYDWHNH\WRJHWWKHV\PPHWULFNH\ 9DOLGDWHWKHLQWHJULW\RIWKHNH\XVLQJWKH+DVKRIWKHNH\ 'HFU\SWWKHDFWXDOPHVVDJHXVLQJWKHV\PPHWULFNH\ZKLFKKDVEHHQGHFU\SWHGDQGSDUVHGDQG
FKHFNHGIRULQWHJULW\ &RPSXWH0HVVDJH'LJHVWRIGDWD 9DOLGDWHLIWKH0HVVDJH'LJHVWRIWKHGHFU\SWHGWH[WPDWFKHVWKH0HVVDJH'LJHVWRIWKH2ULJLQDO
0HVVDJH
&RPPDQGVIRUJHQHUDWLQJNH\V
SURPSWNH\WRROJHQNH\DOLDVWHVWVHQGHUNH\VWRUHWHVWNH\VWRUHNVNH\DOJ56$(QWHUNH\VWRUHSDVVZRUGWHVWSZG:KDWLV\RXUILUVWDQGODVWQDPH"
:KDWLVWKHQDPHRI\RXURUJDQL]DWLRQDOXQLW"
:KDWLVWKHQDPHRI\RXURUJDQL]DWLRQ"
:KDWLVWKHQDPHRI\RXU&LW\RU/RFDOLW\"
:KDWLVWKHQDPHRI\RXU6WDWHRU3URYLQFH"
:KDWLVWKHWZROHWWHUFRXQWU\FRGHIRUWKLVXQLW"
,V&1 $OLFH6HQGHU28 ,72 $%&,QF/ /$67 &$& 86FRUUHFW"
(QWHUNH\SDVVZRUGIRUWHVWVHQGHU!
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
SURPSWNH\WRROJHQNH\DOLDVWHVWUHFYNH\VWRUHWHVWNH\VWRUHNVNH\DOJ56$(QWHUNH\VWRUHSDVVZRUGWHVWSZG:KDWLV\RXUILUVWDQGODVWQDPH"
:KDWLVWKHQDPHRI\RXURUJDQL]DWLRQDOXQLW"
:KDWLVWKHQDPHRI\RXURUJDQL]DWLRQ"
:KDWLVWKHQDPHRI\RXU&LW\RU/RFDOLW\"
:KDWLVWKHQDPHRI\RXU6WDWHRU3URYLQFH"
:KDWLVWKHWZROHWWHUFRXQWU\FRGHIRUWKLVXQLW"
,V&1 %RE5HFHLYHU28 +52 $%&,QF/ 6)267 &$& 86FRUUHFW"
(QWHUNH\SDVVZRUGIRUWHVWUHFY!
&RGH6DPSOH
3XEOLF.H\&U\SWRJUDSK\MDYD
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
6\PPHWULF(QFU\SWMDYD
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
5HIHUHQFHV &RPSXWHU6HFXULW\$UWVDQG6FLHQFH0DWW%LVKRS &RUH6HFXULW\3DWWHUQV&KULVWRSKHU6WHHOH5D\/DLDQG5DPHVK1DJDSSDQ
7UDGXFFLyQ(VSDxRO
3DUDPD\RUGHWDOOHYHD7UDGXFFLyQ(VSDxRO
5HWULHYHGIURPKWWSVZZZRZDVSRUJLQGH[SKS"WLWOH 'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYDROGLG &DWHJRU\ 2:$63-DYD3URMHFW
7KLVSDJHZDVODVWPRGLILHGRQ1RYHPEHUDW7KLVSDJHKDVEHHQDFFHVVHGWLPHV
-
'LJLWDO6LJQDWXUH,PSOHPHQWDWLRQLQ-DYD2:$63
KWWSVZZZRZDVSRUJLQGH[SKS'LJLWDOB6LJQDWXUHB,PSOHPHQWDWLRQBLQB-DYD
&RQWHQWLVDYDLODEOHXQGHUD&UHDWLYH&RPPRQV/LFHQVHXQOHVVRWKHUZLVHQRWHG