Fundamentals Digital Signatures
Online life needs proof of two things: who sent a message and whether anyone changed it on the way. Digital signatures and digital certificates provide that proof. Every secure website, signed document, and software download depends on them.
The Wax Seal Example
Centuries ago, a king pressed a ring into hot wax to close a letter. The seal showed who wrote it. A broken seal warned the reader that someone had opened the letter. A digital signature serves the same purpose for electronic files. A certificate works like an official identity card that proves the ring really belongs to the king.
How a Digital Signature Works
A signature uses a pair of keys. The owner guards the private key. Everyone else receives the public key. Anything signed with the private key can be checked with the public key.
SENDER
Message --> Hash (short fingerprint) --> Encrypt with PRIVATE key
|
v
Digital Signature
|
Message + Signature ---------- sent ---------+
|
RECEIVER v
Message --> Hash ------------+
| compare
Signature --> Decrypt with PUBLIC key --> Hash
|
Same? Message is genuine and unchanged
A hash is a short fixed-size fingerprint of data. Changing one letter in the message produces a completely different fingerprint. The receiver spots any change at once.
What Signatures Prove
- Authenticity: the message came from the claimed sender.
- Integrity: nobody altered the message.
- Non-repudiation: the sender cannot deny sending it later.
What a Digital Certificate Contains
A signature only helps if the receiver trusts the public key. Certificates link a public key to a real identity. Trusted organizations called Certificate Authorities, or CAs, issue and sign them.
| Field | Purpose |
|---|---|
| Subject | The website or person that owns the certificate |
| Public key | The key others use to verify or encrypt |
| Issuer | The CA that vouches for the owner |
| Validity dates | Start and end of the certificate's life |
| Signature of the CA | Proof that the CA created the certificate |
The Chain of Trust
Browsers and operating systems ship with a list of trusted root authorities. A root authority signs intermediate authorities. Intermediate authorities sign website certificates. The browser follows the chain upward until it reaches a root it already trusts.
+--------------------+
| Root CA | Built into the browser
+--------------------+
| signs
v
+--------------------+
| Intermediate CA |
+--------------------+
| signs
v
+--------------------+
| Website Certificate| Shown by the padlock in the address bar
+--------------------+
Where You Meet These Tools
- HTTPS websites show a padlock after the browser checks the certificate.
- Software installers carry signatures that prove the publisher.
- Email programs sign messages to confirm the sender.
- Contracts and forms use e-signatures that follow national laws.
Certificate Problems
Expired Certificates
Browsers warn visitors when a certificate passes its end date. Site owners renew certificates before that day.
Name Mismatch
A certificate issued for one domain cannot protect a different domain. Browsers show an error in that case.
Revoked Certificates
A CA cancels a certificate when its private key leaks. Browsers check revocation lists and refuse revoked certificates.
Never ignore a certificate warning on a banking or shopping site. The warning may signal that someone is intercepting the connection.
Types of Website Certificates
- Domain Validated certificates confirm control of a domain name and suit blogs and small sites.
- Organization Validated certificates confirm that a real company runs the site.
- Extended Validation certificates involve the deepest identity checks and suit banks and large stores.
A padlock shows that the connection is encrypted. It does not guarantee that the site owner is honest. Criminals also obtain basic certificates for fake sites, so always read the address in the browser bar.
Key Points
- A digital signature proves origin and checks that data stayed unchanged.
- The private key signs, and the public key verifies.
- Certificates tie public keys to real identities.
- Certificate Authorities form a chain of trust that browsers follow.