# digital signatures Published articles for digital signatures. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## HTTP Message Signatures with curl DevFeed: [HTTP Message Signatures with curl]() Original publisher: [Read original article]() Author: Daniel Stenberg Published: 2026-07-27T06:55:03Z Content type: release Language: en Sources: [Daniel Stenberg]() Topics: [cURL](), [HTTP](), [Authentication]() Tags: [curl](), [curl-and-libcurl](), [digital-signatures](), [ed25519](), [experimental](), [git](), [hmac](), [http](), [production](), [release]() ### AI overview curl experimentally supports HTTP Message Signatures based on RFC 9421, allowing users to sign selected HTTP request components with ed25519 or hmac-sha256 through new command-line and libcurl options. The feature must be explicitly enabled, is discouraged for production use, and is planned for curl 8.22.0. ### Source excerpt The recently published RFC 9421 describes how to do HTTP Message Signatures, and starting just now, curl experimentally supports them. Message Signatures The specification describes this as a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message. It is a way to verify that selected parts ... Continue reading HTTP Message Signatures with curl -> ## New Chainguard Academy course: Securing the AI/ML Supply Chain DevFeed: [New Chainguard Academy course: Securing the AI/ML Supply Chain]() Original publisher: [Read original article]() Published: 2024-07-29T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [AI Development](), [Security](), [Development](), [Tooling](), [Open Source]() Tags: [developers](), [digital-signatures](), [ml-security](), [ml-supply-chain](), [provenance](), [pytorch](), [sboms](), [security](), [software-supply-chain-security](), [training]() ### AI overview Chainguard is launching a hands-on, self-paced Chainguard Academy course on securing the AI/ML supply chain. The course covers supply-chain components, cyberattacks, regulations, standards, risk-mitigation tools, vulnerability scanning, SBOMs, digital signatures, provenance, and Chainguard AI Images such as PyTorch. ### Source excerpt Learn to secure your AI/ML supply chain with Chainguard's new course, designed to help you mitigate risks and build safer AI/ML systems. ## Top 5 takeaways from KubeCon NA 2023: SSCS, Wolfi and more DevFeed: [Top 5 takeaways from KubeCon NA 2023: SSCS, Wolfi and more]() Original publisher: [Read original article]() Published: 2023-11-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [open-source-security](), [Kubernetes](), [cloud-infrastructure]() Tags: [cloud-native](), [digital-signatures](), [kubecon](), [kubecon-na](), [kubernetes](), [open-source-software](), [sigstore](), [software-bill-of-materials](), [software-supply-chain-security](), [sscs](), [wofli](), [wolfi]() ### AI overview Chainguard reviews five takeaways from KubeCon North America 2023, focusing on the event's growth, the rising awareness of software supply chain security, and the shift toward implementing security tools and processes within software development. The article also highlights SBOMs, digital signatures, attestations, Wolfi, and related cloud-native topics. ### Source excerpt Chainguard's breakdown of KubeCon NA 2023: Top five highlights in software supply chain security, Wolfi, and more. ## From U2F to passkeys DevFeed: [From U2F to passkeys]() Original publisher: [Read original article]() Author: Adam Langley Published: 2023-07-23T00:00:00Z Content type: article Language: en Sources: [ImperialViolet]() Topics: [Passkeys](), [Authentication](), [passwords](), [Protocol (disambiguation)](), [Security](), [JavaScript]() Tags: [authentication](), [digital-signatures](), [javascript](), [passwords](), [private-key](), [protocol]() ### AI overview This article gives a chronological account of how standards developed from U2F into passkeys. It explains U2F's security-key and JavaScript API standards, the risks of bearer tokens such as passwords and cookies, and how digital signatures can authenticate users without disclosing a private key. ### Source excerpt (This post is nearing 8 000 words. If you want to throw it onto an ereader there's an EPUB version too.) Introduction Over more than a decade, a handful of standards have developed into passkeys--a plausible replacement for passwords. They picked up a lot of complexity on the way, and this post tries to give a chronological account of the development of the core of these technologies. Nothing here is secret; it's all described in various published standards. However, it can be challenging to read these standards and understand how it's meant to fit together. The beginning: U2F U2F stands for "Universal Second Factor". It was a pair of standards, one for computers to talk to small removable devices called security keys, and the second a JavaScript API for websites to use them. The first standard of the pair is also called the Client to Authenticator Protocol (CTAP1), and when the term "U2F" is used in isolation, it usually refers to that. The JavaScript API, now obsolete, was generally referred to as the "U2F API". The goal of U2F was to eliminate "bearer tokens" in user authentication. A "bearer token" is a term of art in authentication that refers to any secret that is passed around to prove identity. A password is the most common example of such a secret. It's a bearer token because you prove who you are by disclosing it, on the assumption that nobody else knows the secret. Passwords are not the only bearer tokens involved in computer security by a long way--the infamous cookies that all web users are constantly bothered about are another example. But U2F was focused on user authentication, while cookies identify computers, so U2F was primarily trying to augment passwords. The problem with bearer tokens is that to use them, you have to disclose them. And knowledge of the token is how you prove your identity. So every time you prove your identity, you are handing another entity the power to impersonate you. Hopefully, the other entity is the intended counterparty and ## Introducing "Speranza": Enhancing software signing with privacy and usability DevFeed: [Introducing "Speranza": Enhancing software signing with privacy and usability]() Original publisher: [Read original article]() Published: 2023-05-30T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cryptography](), [open-source-security](), [sigstore](), [OpenID connect (OIDC)](), [npm]() Tags: [chainguard](), [chainguard-labs](), [cryptography](), [digital-signatures](), [oidc](), [open-source-security](), [pii](), [privacy](), [security](), [sigstore](), [software-artifact-signing](), [software-supply-chain](), [software-supply-chain-security](), [software-supply-chain-security-research](), [supply-chain]() ### AI overview Chainguard Labs introduces Speranza, a research project for usable, privacy-friendly software signing. The article explains how it aims to improve software supply chain security while addressing the usability problems of long-lived cryptographic keys and the privacy risks of exposing maintainers' identities or metadata. It also discusses potential applications in open source package repositories and enterprise deployments of Sigstore. ### Source excerpt Chainguard Labs announces, "Speranza: Usable, privacy-friendly software signing," to help balance usability and privacy for software signing techniques. ## It all started with a commit: Celebrating 6 years of Distroless DevFeed: [It all started with a commit: Celebrating 6 years of Distroless]() Original publisher: [Read original article]() Published: 2023-04-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [distroless](), [Containers](), [supply-chain-security](), [container images](), [sigstore](), [chainguard images](), [Kubernetes](), [vulnerability](), [bazel](), [Debian](), [vulnerability management](), [Go]() Tags: [bazel](), [c-plus-plus](), [chainguard](), [chainguard-images](), [containers](), [debian](), [digital-signatures](), [distroless](), [distroless-containers](), [go](), [java](), [kubernetes](), [python](), [release-engineering](), [sigstore](), [software-supply-chain-security](), [verify](), [vulnerability](), [vulnerability-management]() ### AI overview The article commemorates six years of Distroless, describing its goal of creating more secure and efficient container images by removing non-essential components. It covers the Bazel-based build tooling, language runtimes, Kubernetes adoption, vulnerability-management benefits, and later integration with Sigstore for container signing and authenticity verification. It also introduces the subsequent development of Chainguard Images. ### Source excerpt The goal of Distroless is to provide a more secure and efficient way to package and run software in containers by using only essential components. ## The role of attestations in a secure software supply chain DevFeed: [The role of attestations in a secure software supply chain]() Original publisher: [Read original article]() Published: 2023-04-04T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard enforce](), [Docker Verified Publisher]() Tags: [attestation](), [chainguard](), [chainguard-enforce](), [digital-signatures](), [integrity](), [policy](), [secure-software](), [secure-software-supply-chain](), [security-policies](), [slsa](), [software-attestations](), [supply-chain]() ### AI overview This article explains how attestations support software supply-chain policy enforcement. It describes attestations as signed claims from identified speakers about code or build results, allowing deployment systems to verify policy requirements without repeating expensive or impractical checks. ### Source excerpt Chainguard Enforce enables policy enforcement using attestations. Learn how to use these principles to create and enforce secure supply chain policies. ## New SLSA++ Survey reveals real-world developer approaches to software supply chain security DevFeed: [New SLSA++ Survey reveals real-world developer approaches to software supply chain security]() Original publisher: [Read original article]() Published: 2023-03-15T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [open-source-security](), [Security](), [openssf]() Tags: [best-practices](), [developer](), [devops](), [digital-signatures](), [integrity](), [maintainers](), [open-source-security](), [openssf](), [report](), [rust](), [secure-software-development-frameworks](), [security](), [security-best-practices](), [slsa](), [software-development](), [software-security-practices](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain-integrity](), [supply-chain-security](), [survey]() ### AI overview A joint survey by Chainguard, the Eclipse Foundation, the Rust Foundation, and OpenSSF examined how developers, open source maintainers, and security practitioners adopt software supply chain security practices. Among nearly 170 respondents, centralized build services showed relatively strong adoption, while consistently signing built artifacts was less common, with 25% reporting that their team always did so. Respondents generally considered the surveyed practices helpful. ### Source excerpt Findings on software supply chain security practice adoption from our joint survey with OpenSSF, Rust, and Eclipse with questions derived from SLSA requirements. ## Ultimate Go: Advanced Engineering Episode 13 DevFeed: [Ultimate Go: Advanced Engineering Episode 13]() Original publisher: [Read original article]() Published: 2023-01-11T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Blockchain](), [Go Language](), [Algorithm](), [Security](), [Ethereum](), [API](), [Transactions]() Tags: [algorithm](), [bitcoin](), [blockchain](), [data-stamping](), [digital-signature](), [digital-signatures](), [ethereum](), [go](), [go-blockchain](), [hash](), [hexademical](), [how-to](), [keccak256](), [salt](), [security](), [video]() ### AI overview This video tutorial explains how to add a salt value to transaction hashes, implement the keccak256 algorithm in Go, and use transaction stamping in a blockchain. It also discusses digital signatures and related security issues. ### Source excerpt Introduction In episode 12, Bill laid out his strategy to handle data hashing on his blockchain. The first step he took was to create a package to handle the cryptographical aspects of his blockchain. After that, he wrote a hash function that met the requirements outlined in his strategy. This function took transaction data as a parameter and returned a hexadecimal representation of the hash. To implement this function, Bill imported packages from the Go standard library and Ethereum API. ## Comparing Four Passwordless SSH Authentication Methods DevFeed: [Comparing Four Passwordless SSH Authentication Methods]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-02-11T00:00:00Z Content type: comparison Language: en Sources: [Teleport]() Topics: [ssh](), [OpenSSH](), [Authentication](), [passwords](), [certificates](), [Cryptography]() Tags: [authentication](), [blog](), [certificates](), [digital-signatures](), [openssh](), [passwords](), [private-key](), [public-key](), [ssh]() ### AI overview This article compares four passwordless SSH authentication methods: key-based, certificate-based, host-based, and out-of-band authentication through a custom PAM module. It explains how SSH key authentication works and discusses its setup, scalability, rotation, and stolen-key considerations. ### Source excerpt This blog post compares four different passwordless authentication methods for SSH: SSH keys, certificates, host-based, and PAM modules. ## The Asset Trap DevFeed: [The Asset Trap]() Original publisher: [Read original article]() Author: Adam Published: 2020-12-16T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [solarwinds](), [digital signatures](), [email](), [systems]() Tags: [digital-signatures](), [email](), [solarwinds](), [systems]() ### AI overview This commentary uses the SolarWinds attack to explain an asset-focused threat-modeling trap. It argues that defenders should consider assets attackers want, such as DKIM keys, which can be used to forge emails that pass validity checks, and recommends rotating those keys regularly. ### Source excerpt As we look at what's happened with the Russian attack on the US government and others via Solarwinds, I want to shine a spotlight on a lesson we can apply to threat modeling. ## Introducing Elliptic Curves DevFeed: [Introducing Elliptic Curves]() Original publisher: [Read original article]() Published: 2014-02-08T10:00:14Z Content type: tutorial Language: en Sources: [Jeremy Kun]() Topics: [Cryptography](), [Programming](), [Algorithms, Complexity](), [Encryption]() Tags: [cryptography](), [diffie-hellman](), [digital-signatures](), [elliptic-curves](), [encryption](), [implementing](), [nsa](), [python](), [rsa]() ### AI overview An introductory tutorial series on elliptic curves and elliptic curve cryptography. It explains the motivation for ECC, its relationship to RSA and cryptographic security, and plans implementations covering finite fields, key exchange, encryption, and digital signatures. ### Source excerpt With all the recent revelations of government spying and backdoors into cryptographic standards, I am starting to disagree with the argument that you should never roll your own cryptography. Of course there are massive pitfalls and very few people actually need home-brewed cryptography, but history has made it clear that blindly accepting the word of the experts is not an acceptable course of action. What we really need is more understanding of cryptography, and implementing the algorithms yourself is the best way to do that.