English
Menu

What is Digital signature?

A technique for confirming who created an electronic document and that it has not been altered since. The signer processes the document's hash value with their own private key to create the signature, and the recipient verifies it with the signer's public key. It is also used for non-repudiation.

Japanese name: デジタル署名

Digital signature appears in 4 practice questions across 2 topics, including Information Security Basics, Automotive Semiconductors and Functional Safety.

Field: Information Security Basics

Signing and verification steps

The signer first computes the hash value of the document, processes it with their own private key to create a signature and attaches it to the document. The verifier computes the hash value of the received document themselves and uses the signer's public key to check that the signature corresponds to that hash value. If even one bit of the document has been changed, the hash value changes and verification fails. Anyone without the private key cannot create a valid signature.

What it can and cannot confirm

Successful verification shows that the document was signed by the holder of the private key (authenticity) and has not been changed since it was signed (integrity), and it makes it hard for the signer to deny it later (non-repudiation). On the other hand, a digital signature does not encrypt the document, so it does not keep the contents secret. Whether the public key really belongs to that person must also be confirmed with a certificate issued by a certificate authority (CA).

Where it is used

Digital signatures are used in website server certificates (TLS), code signing for software distribution and updates, secure boot so that devices start only legitimate software, electronic contracts and online applications, and email signatures (S/MIME). Typical schemes include RSA signatures, ECDSA and EdDSA.

Try it: questions about Digital signature

A attaches a digital signature to a document sent to B. Which combination correctly gives the keys used to create and verify the signature and what the digital signature can confirm?

  1. AThe signature is created with A's private key and B verifies it with A's public key. It confirms that the document was made by A and was not altered on the way
  2. BThe signature is created with B's public key and B verifies it with B's own private key. It confirms that the contents cannot be read by third parties
  3. CThe signature is created with A's public key and B verifies it with A's private key. It confirms that the contents of the document are factually true
Show answer and explanation

Answer: A. The signature is created with A's private key and B verifies it with A's public key. It confirms that the document was made by A and was not altered on the way

In a digital signature, the signer (A) processes the hash value of the document with A's own private key to create a signature, attaches it to the document and sends it. On receipt, B verifies the signature with A's public key and checks that it corresponds to the hash value computed from the document. Only A holds the private key, so successful verification shows that the document was signed by A (authenticity) and that not a single bit has been changed since it was signed (integrity). It also makes it hard for A to deny having signed it later (non-repudiation). That the public key really belongs to A must be confirmed separately, however, and certificates are used for this. On the other hand, a digital signature does not encrypt the document, so it cannot keep the contents secret; if secrecy is needed, encryption is combined separately. Also, a signature shows who signed, not whether what is written is factually true.

Which statement correctly compares a message authentication code (MAC) with a digital signature?

  1. AA MAC can be verified by anyone with a public key, so its non-repudiation effect is stronger than that of a digital signature
  2. BA MAC is created with a symmetric key shared by the sender and receiver, so it can detect tampering, but because the receiver can also create the same MAC, it cannot provide non-repudiation, that is, prove to a third party that the sender created the message
  3. CA MAC just computes a hash value without a key, so even if an attacker alters the message and recomputes the MAC, the receiver can notice
Show answer and explanation

Answer: B. A MAC is created with a symmetric key shared by the sender and receiver, so it can detect tampering, but because the receiver can also create the same MAC, it cannot provide non-repudiation, that is, prove to a third party that the sender created the message

A message authentication code (MAC) is a short value computed from a message and a symmetric key; HMAC, which uses a hash function, is common. The receiver recomputes it with the same key and compares; if they match, the message came from someone who knows the key and was not altered on the way. An attacker who does not know the key cannot produce a correct MAC for an altered message. However, the receiver holds the same key and can also create MACs. The receiver therefore cannot prove to a third party that the sender created the message, so a MAC does not provide non-repudiation. A digital signature can be created only with the sender's private key and verified by anyone with the public key, so it can provide non-repudiation. MACs, on the other hand, are light to compute and widely used for checks between the two parties, such as detecting tampering in each packet of a connection. A plain hash value without a key can be recomputed by an attacker along with the altered message, so it cannot detect deliberate tampering.

FAQ

Which key is used to sign with a digital signature?

The signature is created with the signer's private key, and the verifier checks it with the signer's public key. This is the reverse of how the keys are used when encrypting to keep something secret.

Is a digital signature the same as an electronic signature?

An electronic signature is the general term for a signature attached to an electronic document and is used broadly, for example in law. A digital signature refers to the kind implemented with public-key cryptography.

Digital signature in the explanations

Questions that mention Digital signature (4)

  1. A attaches a digital signature to a document sent to B. Which combination correctly gives the keys used to create and verify the signature and what the digital signature can confirm?
  2. Which statement correctly compares a message authentication code (MAC) with a digital signature?
  3. Which is the appropriate approach when performing an OTA (Over-the-Air) update, which rewrites vehicle software wirelessly?
  4. Using public-key cryptography, A wants to encrypt a message so that only B can read it. Which key is used for the encryption?

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Message authentication code Hash function Public-key cryptography Cross-site scripting (XSS) Multi-factor authentication Phishing Principle of least privilege Ransomware Salt Social engineering

Back to the glossary