In this tutorial, you’ll learn about Digital Signature, Key Generation Algorithm, Signing Algorithm, and Signature verification Algorithms.
A digital signature is a mathematical technique used to validate the authenticity and integrity of a message, software, or digital document.
How does a Digital Signature Works
The basic idea behind the Digital Signature is to sign a document. When we send a document electronically, we can also sign it. We can sign a document in two ways: to sign a whole document and to sign a digest.
Key Generation Algorithms: Digital signature is electronic signatures, which assure that the message was sent by a particular sender. While performing digital transactions authenticity and integrity should be assured, otherwise, the data can be altered or someone can also act as if he was the sender and expect a reply.
Signing Algorithms: To create a digital signature, signing algorithms like email programs create a one-way hash of the electronic data which is to be signed. The signing algorithm then encrypts the hash value using the private key (signature key). This encrypted hash along with other information like the hashing algorithm is the digital signature. This digital signature is appended with the data and sent to the verifier. The reason for encrypting the hash instead of the entire message or document is that a hash function converts any arbitrary input into a much shorter fixed-length value. This saves time as now instead of signing a long message a shorter hash value has to be signed and moreover hashing is much faster than signing.
Signature Verification Algorithms: Verifier receives Digital Signature along with the data. It then uses the Verification algorithm to process the digital signature and the public key (verification key) and generates some value. It also applies the same hash function to the received data and generates a hash value. Then the hash value and the output of the verification algorithm are compared. If they both are equal, then the digital signature is valid else it is invalid.
Signing the Whole Document
In Digital Signature, a public key encryption technique is used to sign a document. However, the roles of a public key and private key are different here. The sender uses a private key to encrypt the message while the receiver uses the public key of the sender to decrypt the message.
In Digital Signature, the private key is used for encryption while the public key is used for decryption.
Digital Signature cannot be achieved by using secret-key encryption.
Digital Signature is used to achieve the following three aspects:
Integrity: The Digital Signature preserves the integrity of a message because, if any malicious attack intercepts a message and partially or totally changes it, then the decrypted message would be impossible.
Authentication: We can use the following reasoning to show how the message is authenticated. If an intruder (user X) sends a message pretending that it is coming from someone else (user A), user X uses her own private key to encrypt the message. The message is decrypted by using the public key of user A. Therefore this makes the message unreadable. Encryption with X’s private key and decryption with A’s public key results in garbage value.
Non-Repudiation:Digital Signature also provides non-repudiation. If the sender denies sending the message, then her private key corresponding to her public key is tested on the plaintext. If the decrypted message is the same as the original message, then we know that the sender has sent the message.
Note: Digital Signature does not provide privacy. If there is a need for privacy, then another layer of encryption/decryption is applied.
Signing the Digest
Public key encryption is efficient if the message is short. If the message is long, a public key encryption is inefficient to use. The solution to this problem is to let the sender sign a digest of the document instead of the whole document.
The sender creates a miniature version (digest) of the document and then signs it, the receiver checks the signature of the miniature version.
The hash function is used to create a digest of the message. The hash function creates a fixed-size digest from the variable-length message.
The two most common hash functions used: MD5 (Message Digest 5) and SHA-1 (Secure Hash Algorithm 1). The first one produces 120-bit digest while the second one produces a 160-bit digest.
A hash function must have two properties to ensure the success:
First, the digest must be one way, i.e., the digest can only be created from the message but not vice versa.
Second, hashing is a one-to-one function, i.e., two messages should not create the same digest.
Following are the steps taken to ensure security:
The miniature version (digest) of the message is created by using a hash function.
The digest is encrypted by using the sender’s private key.
After the digest is encrypted, then the encrypted digest is attached to the original message and sent to the receiver.
The receiver receives the original message and encrypted digest and separates the two. The receiver implements the hash function on the original message to create the second digest, and it also decrypts the received digest by using the public key of the sender. If both the digests are the same, then all the aspects of security are preserved.
"Hi there, My name is Anup Maurya. I have a passion for programming and previously worked at TCS, one of the best global IT services and consulting companies, as a System Administrator. I also enjoy graphic design. It's a pleasure to have you here."
