Digital Signatures in Cryptography

Introduction

A digital signature is a cryptographic technique used to prove that data was created or approved by the holder of a private key. It works like a signature in the digital world, but instead of using handwriting, it uses public key cryptography and hash functions.

Digital signatures are not mainly used to hide data. Their main purpose is to prove that the data is genuine, unchanged, and linked to a specific signer.

What Digital Signatures Provide

Digital signatures provide three important security properties: authenticity, integrity, and non-repudiation.

• Authenticity: Confirms that the data was signed by the expected private key holder.

• Integrity: Confirms that the data was not modified after signing.

• Non-repudiation: Makes it difficult for the signer to deny signing the data later.

This makes digital signatures useful for messages, documents, software packages, certificates, transactions, APIs, and security protocols.

How Digital Signatures Work

Digital signatures use asymmetric cryptography. The signer owns a key pair: one private key and one public key.

The private key is kept secret and used to create the signature. The public key can be shared and used by others to verify the signature.

A simple signing flow looks like:

• The message is provided as input.

• A hash function generates a hash digest.

• The hash digest is signed using the sender's private key.

• The digital signature is created.

The sender sends the original message along with the digital signature. The receiver then verifies the signature using the sender’s public key.

A simple verification flow looks like:

• The receiver obtains the message and digital signature.

• The received message is hashed again.

• The signature is verified using the sender's public key.

• The two hash values are compared.

If verification succeeds, the receiver gets confidence that the message was signed by the private key holder and was not changed after signing.

Why Digital Signatures Sign the Hash

In real systems, digital signatures usually do not sign the entire file or message directly. Instead, the data is first passed through a hash function, and the resulting hash digest is signed.

This is done because the original data can be very large. A file may be several megabytes or gigabytes, but a hash digest has a fixed size.

Hashing before signing gives two benefits:

• Efficiency: Signing a fixed-size hash is faster than signing large data directly.

• Tamper detection: Even a tiny change in the original data produces a different hash, causing signature verification to fail.

So, the signature protects the fingerprint of the data. If the data changes, the fingerprint changes, and the signature no longer matches.

What Happens if Data Is Modified?

If an attacker changes a signed message, the receiver will calculate a new hash from the modified message. This new hash will not match the hash protected inside the digital signature.

As a result, signature verification fails.

The attacker cannot simply create a new valid signature because that would require the sender’s private key. This is why protecting the private key is critical. If the private key is stolen, attackers may be able to create fake signatures.

Digital Signature vs Encryption

Encryption and digital signatures both use cryptography, but they solve different problems.

A simple way to remember the difference is: encryption protects secrecy, while digital signatures prove trust.

Digital Signature vs HMAC

Both HMAC and digital signatures can verify integrity and authenticity, but they use different key models.

HMAC is useful when both sides share a secret key. Digital signatures are useful when many people need to verify a signature without having the signer’s private key.

Where Digital Signatures Are Used

Digital signatures are used in many modern security systems.

• TLS certificates: Certificate Authorities sign website certificates so browsers can verify website identity.

• Software updates: Developers sign updates so devices can reject modified or fake packages.

• Document signing: PDFs and legal documents can be digitally signed to prove approval.

• Blockchain transactions: Transactions are signed to prove ownership and authorization.

In each case, the digital signature helps answer two questions: who signed this, and has it changed since signing?

Summary

A digital signature is a cryptographic value created using a private key and verified using the matching public key. It proves authenticity, integrity, and non-repudiation, but it does not hide the data by itself.

Digital signatures usually sign the hash of the data instead of the full data for better efficiency. If the message changes, the hash changes, and signature verification fails. The key idea is simple: private key signs, public key verifies.