Digital Certificates, Signatures, and Management

Digital Certificates, Signatures, and Management

Digital Signatures

The purpose of a digital signature is to provide the same level of accountability for electronic transactions where a handwritten signature is not possible or feasible.

A digital signature can provide several assurances. They are that the message does indeed come from the person who claims to have sent it, it has not been altered, both parties have a copy of the exact same document, the person sending the document cannot claim they did not send it, and the person receiving it cannot claim they have received a different message.

Basically, a digital signature is a block of data produced by hashing the message with a hashing algorithm that produces a message digest that is generated based on the contents of the message. That message digest is then encrypted with the sender's private key. The act of encrypting the message digest with the sender's private key produces the digital signature. That digital signature is then appended to the message and sent to the receiver. The receiver must then verify the digital signature by decrypting it with the sender's public key and comparing the result with the message digest of the received message.

The use of digital signatures to address non-repudiation involves two processes, one performed by the signer and the other by the receiver of the digital signature:

• Digital signature creation uses a hash result, called a message digest, derived from and unique to both the signed message and a given private key of the sender.
• Digital signature verification is the process of checking the digital signature by reference to the original message and a given public key of the sender, thereby determining whether the digital signature was created for that same message using the private key that corresponds to the referenced public key of the sender.

To sign a document or any other item of information, the signer first hashes the message to produce a message digest. The signer's software then allows the transformation of the message digest into a digital signature using the signer's private key. The resulting digital signature is thus unique to both the message and the private key used to create it.

Typically, the digital signature is attached to its message and stored or transmitted along with the message.

Verification of the digital signature is accomplished by computing a new hash signature may also be sent or result (message digest) of the original stored as a separate element as

message by means of the same hashing

long as it maintains a reliable function used to create the digital signature association with its message. in the first place. Then, using the public key of the signer and the new hash result,the

Because a digital signature is verifier (receiver) can check the following:

unique to its message, it would be useless if somehow it is

• Whether the digital signature was disassociated from its message.

created using the corresponding private key of the sender

• Whether the newly computed hash result matches the original hash result that was transformed into the digital signature during the signing process

This should help you better understand the real-world application of digital signatures. Now, we suggest you explore further by looking at actual digital signatures in active sites by clicking on the padlock icon to the left of the address bar of your browser.