A system for numeric pattern normalization for cryptographic signatures is provided. The system includes a resolving client, and an at least one signature server. The at least one signature server includes at least one processor and non-transitory computer readable media having encoded thereon computer software comprising a set of instructions executable by the at least one processor. The set of instructions may be executed by the signature server to generate a message to be transmitted to a resolving client, normalize the message via numeric pattern normalization, generate a hash value for the normalized message, and generate a cryptographic signature based on the hash value. The signature server may then generate a signed message having the message signed with the cryptographic signature, and transmit the signed message to the resolving client.

A trusted branded email method and apparatus in one aspect detects branded electronic messages and performs validation before it is sent to a recipient. In another aspect, an electronic messages is branded by embedding branding assets and validation signatures. Algorithms that generate validation signatures are dynamically selected to further strengthen the security aspects. Branding assets are presented to a user using a distinct indicia that represents to the user that the branding assets are secure.

In one or more embodiments, a first information handling system may: receive a chained cryptographic hash value determined by a trusted platform module (TPM) of a second information handling system; receive multiple patch identities associated with multiple updated firmware installed on multiple components of the second information handling system; receive an event log associated with output of the TPM as the TPM determined the chained cryptographic hash value; retrieve multiple layered endorsements respectively associated with the multiple patch identities; determine multiple hash values from multiple signatures stored in the multiple layered endorsements; compare the chained cryptographic hash value with the event log; compare multiple event information with the multiple hash values; and determine that the second information handling system has booted into a trusted state based at least on comparing the chained cryptographic hash value with the event log and comparing the multiple event information with the multiple hash values.

Various techniques for processing sensitive data in an isolated incubator system within a service-provider network are described. The incubator system, for instance, is isolated from a client system in the service-provider network. In an example method, the incubator system receives an indication of an operation, and first encrypted data, from the client system. The incubator system converts the first encrypted data to plaintext and performs the operation. The incubator system converts the processed data into second encrypted data and provides the second encrypted data to the client system. Thus, the incubator system performs the operation on the data without exposing the data to the client system in the plaintext format.

Methods are provided for generating an electronic signature, for authenticating said electronic signature, for authenticating integrity of a content signed with said electronic signature, and for authenticating an identity of a signatory who signed said electronic signature, along with systems, computer systems and computer programs suitable for performing said methods. Said methods for generating an electronic signature comprise: receiving a first physical characteristic representative of a person, the first physical characteristic containing a first biometric feature of the person; identifying the first biometric feature in the received first physical characteristic; generating a first biometric mathematical representation representing the first biometric feature of the person; receiving a content to be signed; generating a first content mathematical representation representing the content to be signed; storing the first biometric mathematical representation and the first content mathematical representation in a signature dataset; and computing a first signature mathematical representation of the signature dataset.

Signature-based authentication is a core cryptographic primitive essential for most secure networking protocols. A new signature scheme, MSS, allows a client to efficiently authenticate herself to a server. The new scheme is modeled in an offline/online model where client online time is premium. The offline component derives basis signatures that are then composed based on the data being signed to provide signatures efficiently and securely during run-time. MSS requires the server to maintain state and is suitable for applications where a device has long-term associations with the server. MSS allows direct comparison to hash chains-based authentication schemes used in similar settings, and is relevant to resource-constrained devices, e.g., IoT. MSS instantiations are derived for two cryptographic families, assuming the hardness of RSA and decisional Diffie-Hellman (DDH) respectively. Then used is the new scheme to design an efficient time-based one-time password (TOTP) protocol.

A method includes receiving an event, the event associated with a digital signature in a first time-based message comprising a first trusted time stamp token generated using a first hash of digitally signed content from a trusted timing authority; generating a first block on a distributed ledger; generating a second hash of the first trusted time stamp token; receiving a second trusted time stamp token from the trusted timing authority in response to transmitting the second hash to the trusted timing authority; and generating a second block on the distributed ledger; wherein verification of data integrity of the digitally signed content is provided via the first hash of the digitally signed content and second hash of the first trusted time stamp token and via the hash of the first block and a hash of the second block.

A system and method for signing data is presented. In one embodiment, the method comprises: generating a data signing key; transforming the data signing key into a first subkey and a second subkey; encrypting the first subkey according to a secret key of an ODSS; generating a signature verification public key; providing the signature verification public key, the encrypted first subkey, and the second subkey for storage in a client device; accepting a request to sign the data, the request having a representation of the data and the encrypted first subkey; generating a partially computed signature of the data according to the representation of the data and the encrypted first subkey; and providing the partially computed signature of the data to the client device.

A trusted branded email method and apparatus in one aspect detects branded electronic messages and performs validation before it is sent to a recipient. In another aspect, an electronic messages is branded by embedding branding assets and validation signatures. Algorithms that generate validation signatures are dynamically selected to further strengthen the security aspects. Branding assets are presented to a user using a distinct indicia that represents to the user that the branding assets are secure.

In various implementations, a network device receives a packet from a content producer. The packet includes data and further includes a signature generated by the content producer, based on the data, using a private key of the content producer. The network device modifies the packet without affecting the signature and forwards the modified packet toward a user device. The network device also sends the user device a manifest specifying how the packet was modified. The user device receives the packet and manifest, restores the packet's original data based on the manifest, and verifies the original data using the signature and a public key corresponding to the private key of the content producer. In response to verification of the original data, an application on the user device is allowed to use the data.