[Serious] Digital Signatures And Adding Them To Web Pages

I went through the forums, searching for "digital search" but didn't find anything good. Well, I did find a particular user trying to be snobbish and asking for some Pizza instead of information on digital signatures, but I guess you can't really expect an online discussion forum to deliver Pizza, so his attempt failed very royally.

OK here goes my problem. I don't have to mention that I know nothing about digital signatures.

Alright, I do know they are different from electronic signatures and that electronic signatures aren't much different from physical signatures.

The task defined for me is this:

The user should be able to attach his/her digital signature when he/she approves a set of transactions. This is similar to how it happens when large NEFT transactions are approved in the corporate world. I actually saw a sample of it as our Finance guy walked me through the approval process. He logs into the bank website, goes to the authorization page where he sees a list of transactions pending. He selects one for approval, inserts his USB dongle into the laptop and then clicks a button to authorize. The webage reads off the USB dongle the digital signature and performs the necessary action. Each user has a separate USB dongle.

So far so good. I have to build something similar. Now there are two questions - one a petty one and the other a pretty one.

The petty question: How do I read the digital signature off a USB dongle when I am in a webpage - I mean when I am designing the webpage? Are there any components or tools available which will let me do this? Will I have to use ActiveX or something similar to be installed on the client machine one time?

The pretty question: How does digital signature work? I came across a resource which broke it down into simple pieces: Take a text file, hash it to a value and then encrypt this value using a private key. Send the text file and the encrypted hash to the recipient. Recipient will hash the file again, decrypt the encrypted value I had sent using a public key and compare his hash with the decrypted value of my hash. If both match, the file has been verified.

However, mere algorithm won't help me. Which encryption standard should I use? How exactly do you attach the digital signature to a text file? What is a digital signature? If the above explanation is correct, it's a series of bytes. Could I just write it to the text file after the text file contents? In this case when my code reads the digital signature off the USB dongle, is it only reading the private key?

How do I sign other documents digitially?

It would be immensely helpful if someone could point me to links which explain how digital signatures work (technically i.e. in code) and one or two sample codes or some readymade components which would provide this functionality.

I am working with VS 2010 / C#.

Judging at the response this topic has received in the programming forums, I thought it best to post it here so it would get some more attention. Sorry to spoil the fun.

Quote:

---

searching for "digital search"

---

Huh? I'd recommend a Google (other search engines are available!) for digital signature asp.net for a starter.

Found this link which addresses a bit better some of my concerns:

http://collageprogramming.blogspot.i...in-aspnet.html

Now, this code will be running inside an ASP.Net page, i.e. on the webserver. When it accesses the certificate store, will it be from the client machine or will it be from the server?
What will the user have to do in order to use his/her digital signature on this page? Will he/she have to register his/her certificate on his/her client? Or on the server?

I am going out on a limb here:
http://msdn.microsoft.com/en-us/magazine/cc163454.aspx

The above link states that MS provides an abstraction layer for applications to access the certificates installed on the Windows machine (client machine I am assuming) - which means ASP.Net applications can access certificates stored on the client machines through this abstraction layer. If that's correct, the client machine must be running DotNet framework? Will there be any version compatibility issues?

Can you get the user to select their certificate file e.g. with

Code:

---

<input id="myCertificate" type="file" runat="server">

---

?

Hi, having same questions as honeybee, so just curious has he managed to find some answers. If you had, would you be so kind to share them here?

Hi all, after a lot of research I have come to the conclusion that it is not possible in pure ASP.Net
The reason is obviously security considerations.

Right now the only feasible way of doing this in a web page seems to be a Java applet, which itself should be signed so it could access the lpcal certificate store. However, it is beyond my meagre Java knowledge to make one work.

I would think that having any kind of web based applet access the security settings on computer defeats the whole purpose of the 'sandbox'. There's enough trouble just keeping the browser secure without browsers giving the keys to random plugins.

Yep, but there seems to be no other way of doing this.

Quote:

---

The above link states that MS provides an abstraction layer for applications to access the certificates installed on the Windows machine

---

Are you sure they are the same thing?

Digital Certificates in the certificate store are there to authenticate web sites and make sure you can trust they are who they say they are.

That doesn't sound really the same as a Digital certificate on a dongle to authenticate a user!!

Of course I am not sure!

Ahhh,

Digital Certificates in the certificate store are for website authentication, so you can see that the Amazon website you just went to really is Amazon and not some Amazon rip-off.

You apply for a Digital Certificate from someone like VeriSign, and pay them a fee and they in return supply you with a certificate for your site.

I would suggest that you need to find out what digital signature technology they are using with the dongle. Without knowing what they are using your task is very difficult.

Is there anyone you can ask?

I just did a google search, and this appears to be similar to what you are doing -

http://stackoverflow.com/questions/1...from-usb-token

I managed to do it in a Windows app, so I am fairly sure it's done in Windows, and not done in web - at least not directly.