signing a message submitted through a contact us form?

Question

SO people can sign a message using Thunderbird, how about allowing a person to sign a message through a contact us form? how would one go about making that a realization.

Answer 1

This is very complicated task which would involve client-side module (ActiveX or Java applet). The reason is that no JavaScript solution is reliable for the reasons described here.

In brief - the module would take JavaScript data to be signed, show this data to the customer and ask him to choose the certificate to be used for signing. Then the data would be signed and signed content would be submitted to the server by the module (not by the browser).

We implemented such scheme in our SecureBlackbox library which you can check if you need to implement such distributed signing. See description of distributed cryptography module here.