Other Uses of Digital Signatures

Distributed ledger (DL) technology is a decentralized register of transactions that is protected by and graph-linked together with cryptographic controls; these rely heavily on asymmetric encryption techniques.

The most widely recognized implementation of DL is through blockchain, which underpins many cryptocurrencies15. One of the advantages of a DL is that the record of transactions is maintained on multiple, separate systems.

There is no single point of failure; instead, the multiple systems involved in tracking the transactions can be geographically and logically isolated. The DL may be decentralized, with all participants in the DL having equal rights, or centralized, where administrative privileges over the ledger may be available to some users. Transactional integrity can be assured since all systems must be informed of a change before it is accepted: no change to a record can occur without it being recognized in the ledger of multiple independent systems.

In blockchain, each "block" within the "chain"' contains a list of chronological transactions, which is then cryptographically attached to the transaction record.

Consequently, all participants interested in a particular transaction can verify the integrity of each transaction. Support for authenticity and non-repudiation can also be part of the implementation as well. Applications of this technology in finance (cryptocurrency), healthcare (pharmacology), and criminal justice (chain of custody) are only a few of the use cases that could take advantage of an immutable transaction record. The figure shows how blockchain works.

Message authentication can be achieved using message digest security features. There are two types of digests: keyed and non-keyed.

Non-keyed message digests are made without a secret key and are called Message Integrity Codes (MICs). Most asymmetric key digital signature schemes use non-keyed message digests. Keyed message digests, known as Message Authentication Codes (MACs), combine a message digest and a secret key. MACs require the sender and the receiver to share a secret key ahead of time to be able to address integrity properly.

It is important to realize that the word "keyed" does not mean that the message digest is signed (private key encrypted); instead, it means that the digest is encrypted with a secret symmetric key.

A message digest is a small representation of a larger message produced by a hashing algorithm. A message digest is used to ensure the integrity of information and does not address confidentiality of the message.

A MAC (also known as a cryptographic checksum is a small block of data that is generated using a secret key and then appended to the message. When the message is received, the recipient can generate their own MAC using the secret key, and thereby know that the message has not changed either accidentally or intentionally in transit.

It is important to remember that this assurance is only as strong as the trust the two parties have that no one else has access to the secret symmetric key. A MAC is a small representation of a message and needs to have the following characteristics:

• A MAC is much smaller than the message generating it.
• Given a MAC, it is impractical to compute the message that generated it.
• Given a MAC and the message that generated it, it is impractical to find another message generating the same MAC.

Hashed MACing implements a freely available hash algorithm (such as SHA-1 or MD5 in legacy systems, SHA-3 in more up-to-date systems) as a component within the HMAC implementation. This allows ease of the replacement of the hashing module if a new hash function ever becomes necessary. The use of proven cryptographic hash algorithms also provides assurance of the security of HMAC implementations. HMACs work by adding a secret key value to the hash input function along with the source message.

Please note that going from SHA-1 or SHA2 to SHA-3 is not a simple upgrade path (not just loading a patch kit). This requires a more detailed installation process, which we won't go into here. The HMAC operation provides cryptographic strength similar to a hashing algorithm, except that it now has the additional protection of a secret key and still operates nearly as rapidly as a standard hash operation.