Featured post
asp.net - Sign data in ASPX on client side -
in application, client must sign (using certificate) , send data server. doubt how should it?
to sign on client side, should use activex right? problem firefox doesn't support it. signing on server side have 2 options:
- save private key on server , use when necessary (if data modified during transaction sign false data)
- send private key when necessary (may comprise key)
despite using ssl, i'm not confortable of 2 options signing on server side... using activex may cause application more vulnerable, right?
hope can me :)
there's no single solution client-side signing in browsers, unfortunately. working on distributed signature components our secureblackbox product, , we've created java applet, activex control , flex script perform signing. however, variants have shortcomings. example, activex control can access windows certificate store. other module types user need load certificate pfx (pkcs#12) file.
uploading , signing on server won't work because private key not exportable on client (it can reside on cryptotoken or smartcard, or non-exportable), , approach makes whole process useless lowers security.
update: secureblackbox 9 in public beta now, support client-side signing (we provide activex, java , flash modules this).
- Get link
- X
- Other Apps
Comments
Post a Comment