{"id":5846,"date":"2022-02-23T08:07:02","date_gmt":"2022-02-23T12:07:02","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=5846"},"modified":"2022-06-13T13:52:29","modified_gmt":"2022-06-13T17:52:29","slug":"protecting-digital-signatures-its-about-time","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/","title":{"rendered":"Protecting Digital Signatures: It\u2019s About Time"},"content":{"rendered":"

\"Digital<\/p>\n

As part of Solutions Review’s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014Mrugesh Chandarana, the Director of Product Management at HID Global<\/a>, shares some insights into the value and importance of protected and verifiable digital signatures.<\/span><\/span><\/em><\/strong><\/p>\n

The use of “digital signatures” has exploded during the pandemic. Around the globe, people have changed how they travel, transact, and work. In the manufacturing sector, organizations have gravitated to hybrid work environments. In all of these cases, digital signatures are being used to protect digital interactions and digital assets, from documents to software code. Unfortunately, all of these digital assets remain at risk since the signature’s certificate may have expired or been revoked. Fraudsters can make these certificates appear as though they were still valid. But their changes and forgeries can be combatted using time stamping services that bring trust to digital signatures.<\/span>\u00a0<\/span><\/p>\n

The Risk Timeline<\/span><\/b>\u00a0<\/span><\/h3>\n

A time-based workflow associated with digital signatures is best understood by reviewing a traditional ink signature workflow. Whenever a legal document is signed, a notary is typically present. The notary’s job is three-fold. First, there must be verification of the person’s identity who is signing. Second, the notary must validate the date and time of the signature. After these two processes are completed, the third step is recording the signature in a logbook with the date and time of the transaction and a thumbprint.<\/span><\/p>\n

A version of this flow is used in the digital world. After a document is signed with a public key infrastructure (PKI)-based digital signature, there is a non-repudiation step. Non-repudiation provides proof of the data’s origin and integrity, making it difficult for the party to a contract or communication to deny the signature’s authenticity or that the message was sent at all. But this repudiation step cannot necessarily be trusted. <\/span><\/p>\n

When a PDF document is digitally signed with a PKI-based certificate, the information about the person signing is added, along with the date and time of the signature. However, this date and time are based on the computer’s local time, which can be changed. This makes it easy for someone to manipulate or forge the signature’s date and time fraudulently. The only way to trust the digital signature is to ensure that its timestamp can be authorized.<\/span>\u00a0<\/span><\/p>\n


Widget not in any sidebars

\n<\/span>How Trusted Time Stamping Works<\/span><\/b>\u00a0<\/span><\/p>\n

Trusted digital identities are needed for various applications ranging from authentication and data encryption to document and code signing. PKI digital certificates are used to create them. To establish proof of these signatures’ existence at an instant of time, the Internet Engineering Task Force (IETF) created the PKI Time-Stamp Protocol (TSP). When this protocol is used, it is possible to combat digital certificate forgery and prevent unauthorized use of revoked certificates and simplify time-based compliance record-keeping. The use of trusted timestamps also strengthens legal cases and proves the long-term validity. <\/span><\/p>\n

For instance, antivirus updates can be secured using signatures with a trusted timestamp. Without a timestamp, signatures will expire or invalidate when the certificate expires or is revoked. End-users will be warned that they should not trust the code. But with a timestamp and long-term validation, the signature will still be trusted since the signing certificate was valid when the signature was applied.<\/span>\u00a0<\/span><\/p>\n

Accurate and trusted timestamps are applied to a digital signature by a Time Stamping Authority, which must meet <\/span>RFC 3161<\/span><\/a> requirements established by the IETF. The RFC 3161 Time Stamp Protocol proves no tampering with the data. Using a Time Stamping Authority while signing a document or code prevents tampering with the Timestamp.<\/span>\u00a0<\/span><\/p>\n

The process is as follows:\u00a0 First, the client application (Microsoft Authenticode or Signtool, as examples) creates a hash of the document or code file. It has a unique identifier of the data or file that must be timestamped. This hash is sent to the Time Stamping Authority, which combines the hash of the file with a trusted timestamp and signs it with a private key. A timestamped token is then created and returned to the client. The timestamp token contains the client application’s information to verify the timestamp later. The process concludes with recording the timestamp token within the file.<\/span>\u00a0<\/span><\/p>\n

\"HID<\/p>\n

When the resulting timestamped data or file is later opened, the client application will use the Time Stamping Authority’s public key to validate that the timestamp came from a trusted Time Stamping Authority and re-calculate a hash of the original data. This new hash is compared to the created hash. The hash check will fail if any changes have been made to the data since the timestamp was applied, this hash check. Warning messages will also be shown saying that the data has been altered and the timestamp should not be trusted.<\/span>\u00a0<\/span><\/p>\n

This process must be executed at very high throughput rates in many use cases. An example is antivirus signature file signing or firmware signing \u2013 millions of timestamps might need to be applied each week. Trusted time stamping service providers make this easier, as they provide enterprises with a high-availability cloud-based platform for embedding timestamps. These timestamps can be embedded in any software application, documents, or digital file. Any manipulation of the timestamp file is after the signature and timestamp are applied causes a hash value mismatch that breaks the file’s seal and alerts the user that the file can no longer be trusted. It is no longer in its original state, and the data is altered.<\/span>\u00a0<\/span><\/p>\n

Trusted timestamps are vital to the integrity of digital signatures because they are applied using independently verified and Coordinated Universal Time (UTC) sources. Because they are not subject to tampering like a local system clock, they foster certainty about applying a digital signature. Trusted time stamping will continue to see growing demand among users to verify the date and time of their electronically or digitally signed documents, code, and other files. Doing so can prevent forgery while also creating longevity for these digital signatures, even after expiration, through long-term validation and non-repudiation of their time and date.\u00a0 <\/span><\/p>\n

\n
Widget not in any sidebars
\n","protected":false},"excerpt":{"rendered":"

As part of Solutions Review’s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014Mrugesh Chandarana, the Director of Product Management at HID Global, shares some insights into the value and importance of protected and verifiable digital signatures. The use of “digital signatures” has exploded during the pandemic. Around the […]<\/p>\n","protected":false},"author":109,"featured_media":5848,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[1863,1091,1864,1824,1865,1866],"acf":[],"yoast_head":"\nProtecting Digital Signatures: It\u2019s About Time<\/title>\n<meta name=\"description\" content=\"As part of Solutions Review\u2019s Premium Content Series, Mrugesh Chandarana of HID Global shares insights on the value of digital signatures.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mrugesh Chandarana\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/\",\"name\":\"Protecting Digital Signatures: It\u2019s About Time\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/02\/Protecting-Digital-Signatures.jpg\",\"datePublished\":\"2022-02-23T12:07:02+00:00\",\"dateModified\":\"2022-06-13T17:52:29+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/2322d26a85c4d48c08743e38d7cb93dc\"},\"description\":\"As part of Solutions Review\u2019s Premium Content Series, Mrugesh Chandarana of HID Global shares insights on the value of digital signatures.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/02\/Protecting-Digital-Signatures.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/02\/Protecting-Digital-Signatures.jpg\",\"width\":800,\"height\":400},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/identity-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Protecting Digital Signatures: It\u2019s About Time\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/\",\"name\":\"Identity and Access Management Solutions | Solutions Review\",\"description\":\"Evaluating Enterprise IAM Software, Identity Governance & Access Control Tools.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/2322d26a85c4d48c08743e38d7cb93dc\",\"name\":\"Mrugesh Chandarana\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/eee5be73994a47d8a2f3d13194f9b0e5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/eee5be73994a47d8a2f3d13194f9b0e5?s=96&d=mm&r=g\",\"caption\":\"Mrugesh Chandarana\"},\"description\":\"Mrugesh Chandarana is the Director of Product Management for IAM Solutions at HID Global. Before this, he was the Director Product Management of RiskSense, Inc. Mrugesh has also worked as Senior Product Manager at WhiteHat Security, Senior Product Manager, Product Support Manager, and as Technical Support Engineer at Agiliance. Mrugesh completed his Master's in electrical and electronics engineering from San Jose State Engineering and his Bachelor's in electronics and communication from C.U.Shah College of Engineering and Technology.\",\"sameAs\":[\"https:\/\/www.hidglobal.com\/\",\"https:\/\/www.linkedin.com\/in\/mchandarana\/\"],\"url\":\"https:\/\/solutionsreview.com\/identity-management\/author\/mchandarana\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Protecting Digital Signatures: It\u2019s About Time","description":"As part of Solutions Review\u2019s Premium Content Series, Mrugesh Chandarana of HID Global shares insights on the value of digital signatures.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/","twitter_misc":{"Written by":"Mrugesh Chandarana","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/","url":"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/","name":"Protecting Digital Signatures: It\u2019s About Time","isPartOf":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/02\/Protecting-Digital-Signatures.jpg","datePublished":"2022-02-23T12:07:02+00:00","dateModified":"2022-06-13T17:52:29+00:00","author":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/2322d26a85c4d48c08743e38d7cb93dc"},"description":"As part of Solutions Review\u2019s Premium Content Series, Mrugesh Chandarana of HID Global shares insights on the value of digital signatures.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/#primaryimage","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/02\/Protecting-Digital-Signatures.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2022\/02\/Protecting-Digital-Signatures.jpg","width":800,"height":400},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/identity-management\/protecting-digital-signatures-its-about-time\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/identity-management\/"},{"@type":"ListItem","position":2,"name":"Protecting Digital Signatures: It\u2019s About Time"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/identity-management\/#website","url":"https:\/\/solutionsreview.com\/identity-management\/","name":"Identity and Access Management Solutions | Solutions Review","description":"Evaluating Enterprise IAM Software, Identity Governance & Access Control Tools.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/2322d26a85c4d48c08743e38d7cb93dc","name":"Mrugesh Chandarana","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/eee5be73994a47d8a2f3d13194f9b0e5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/eee5be73994a47d8a2f3d13194f9b0e5?s=96&d=mm&r=g","caption":"Mrugesh Chandarana"},"description":"Mrugesh Chandarana is the Director of Product Management for IAM Solutions at HID Global. Before this, he was the Director Product Management of RiskSense, Inc. Mrugesh has also worked as Senior Product Manager at WhiteHat Security, Senior Product Manager, Product Support Manager, and as Technical Support Engineer at Agiliance. Mrugesh completed his Master's in electrical and electronics engineering from San Jose State Engineering and his Bachelor's in electronics and communication from C.U.Shah College of Engineering and Technology.","sameAs":["https:\/\/www.hidglobal.com\/","https:\/\/www.linkedin.com\/in\/mchandarana\/"],"url":"https:\/\/solutionsreview.com\/identity-management\/author\/mchandarana\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/5846"}],"collection":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/users\/109"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/comments?post=5846"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/5846\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media\/5848"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media?parent=5846"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/categories?post=5846"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/tags?post=5846"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}