P8riot

I am looking into a way to use some form of PKI to secure e-mailed documents for authenticity. It is not necessary for us to encrypt documents at this time, only some method that will allow us or our clients to verify the contents of an e-mail attachment by use of something like a public key.

I've been out of the loop for a little while on this subject. Any recommendations on where I should start for a lightweight method that our documents can be authenticated? Something like validating a 'digital signature'?

Thanks.

__________________





Age of Conan: Tharashk (Taxiarchos), Thaumiel (alt), guild Ars Tactika - Cimmeria
XBox360 GamerTag: P8riotOne (but it might also be my son playing - he can game with TG tho!)

ScratchMonkey

A good starting point:

http://en.wikipedia.org/wiki/Digital_signature

You'll need a cert to prove who you are, and then use that (possibly indirectly through a second cert signed with the first) to sign the documents.

I've only used certs for my web and mail servers, to encrypt the connections, so I only have a theoretical understanding of the signing process, no practical experience.

__________________

ScratchMonkey

American Bar Association guidelines for digital signatures:

http://www.abanet.org/scitech/ec/isc/dsg-tutorial.html

__________________

P8riot

Thanks, yeah I've done the Wiki already.

Looks like Acrobat has it built-in pretty well and we just need to get a cert.

Looks like I started checking into this at the right time. We were checking into software to help organize our PDF/drawing files and it doesn't appear to support certificates - good catch.

__________________





Age of Conan: Tharashk (Taxiarchos), Thaumiel (alt), guild Ars Tactika - Cimmeria
XBox360 GamerTag: P8riotOne (but it might also be my son playing - he can game with TG tho!)

ScratchMonkey

Slashdot discussion about self-signed certs:

http://it.slashdot.org/article.pl?si...45223&from=rss

From the discussion, an informative comment about the kinds of certs available from certificate authorities to prove who you are:

http://it.slashdot.org/comments.pl?s...1&cid=23944585

About the new EV cert recognized by IE7 and FF3, including list of authorities that provide them:

http://en.wikipedia.org/wiki/Extende...on_Certificate

Here's a community cert authority for non-commercial use (eg. hosting open source projects):

http://www.cacert.org/

__________________