Digital Signature

Question

We have tried the following

Application A -> Create a thing and signed with the valid certificate

Application B -> retrieve the thing by using a filter(assume application b developer forgot to specify the signature filter)

Application B -> update the thing

No exception is thrown, and the signature is gone.

If application B can easily override the signature, I don't see what is the point of digital sign the thing since there is no strict enforcement.  

Answer 1

Hi,

Signatures guarantee Thing integrity.  If the signature is valid, the Thing has not been tampered with or altered.  Updating a Thing alters it thereby invalidating the signature.  The signature cannot be preserved in this case.

--Rob

Answer 2

Thank's !