A
digital signature is a cryptographic mechanism used to verify the authenticity
and integrity of digital data. We may consider it as a digital version of the
ordinary handwritten signatures, but with higher levels of complexity and
security.
In simple terms, we may describe a digital signature as a
code that is attached to a message or document. After generated, the code acts
as proof that the message hasn’t been tampered with along its way from sender
to receiver.
Although the concept of securing communications using
cryptography dates back to ancient times,
digital signature schemes became a possible reality in the 1970s - thanks to
the development of Public-Key Cryptography (PKC). So,
to learn how digital signatures work, we need to first understand the basics of
hash functions and public-key cryptography.
Hash functions
Hashing is one of the core
elements of a digital signature system. The process of hashing involves
transforming data of any size into a fixed-size output. This is done by a
special kind of algorithms known as hash functions. The output generated by a
hash function is known as a hash value or message digest.
When combined with cryptography, the so-called cryptographic hash
functions can be used to generate a hash value (digest) that acts as a unique
digital fingerprint. This means that any change in the input data (message)
would result in a completely different output (hash value). And that’s the
reason cryptographic hash functions are widely used for verifying the
authenticity of digital data.
Public-key
cryptography (PKC)
Public-key cryptography, or PKC, refers to a cryptographic
system that makes use of a pair of keys: one public key and one private key.
The two keys are mathematically related and can be used for both data
encryption and digital signatures.
As an encryption tool, PKC is more secure than the more
rudimentary methods of symmetric encryption. While older
systems rely on the same key to encrypt and decrypt information, PKC allows for
data encryption with the public key
and data decryption with its corresponding private key.
Other than that, the PKC scheme may also be applied in the
generation of digital signatures. In essence, the process consists of hashing a
message (or digital data) along with the signer’s private key. Next, the
recipient of the message can check if the signature is valid by using the
public key provided by the signer.
In some situations, digital signatures may involve
encryption, but that isn’t always the case. For instance, the Bitcoin blockchain makes use of PKC and digital
signatures, but unlike many tend to believe, there is no encryption in the
process. Technically, Bitcoin deploys the so-called Elliptic Curve Digital
Signature Algorithm (ECDSA) to authenticate transactions.
How digital
signatures work
In the context of cryptocurrencies, a digital signature
system often consists of three basic steps: hashing, signing, and verifying.
Hashing
the data
The first step is to hash the message or digital data. This
is done by submitting the data through a hashing algorithm so that a hash value is
generated (i.e., the message digest). As mentioned, the messages can vary
significantly in size, but when they are hashed, all their hash values have the
same length. This is the most basic property of a hash function.
However, hashing the data is not a must for producing a
digital signature because one can use a private key to sign a message that
wasn’t hashed at all. But for cryptocurrencies, the data is always hashed
because dealing with fixed-length digests facilitates the whole process.
Signing
After the information is hashed, the sender of the message
needs to sign it. This is the moment where public-key cryptography comes into
play. There are several types of digital signature algorithms, each with its
own particular mechanism. But essentially, the hashed message will be signed
with a private key, and the receiver of the message can then check its validity
by using the corresponding public key (provided by the signer).
Put in another way, if the private key is not included when
the signature is generated, the receiver of the message won’t be able to use
the corresponding public key to verify its validity. Both public and private
keys are generated by the sender of the message, but only the public key is
shared with the receiver.
It’s worth noting that digital signatures are directly
related to the content of each message. So unlike handwritten signatures, that
tend to be the same regardless of the message, each digitally signed message
will have a different digital signature.
Verifying
Let’s take an example to illustrate the whole process until
the final step of verification. Imagine that Alice writes a message to Bob,
hashes it, and then combines the hash value with her private key to generate a
digital signature. The signature will work as a unique digital fingerprint of
that particular message.
When Bob receives the message, he can check the validity of
the digital signature by using the public key provided by Alice. This way, Bob
can be sure that the signature was created by Alice because only she has the
private key that corresponds to that public key (at least that’s what we
expect).
So, it’s crucial for Alice to keep her private key in secret.
If another person gets their hands on Alice’s private key, they can create
digital signatures and pretend to be Alice. In the context of Bitcoin, this means
someone could use Alice’s private key to move or spend her Bitcoins without her
permission.
Why are digital
signatures important?
Digital signatures are often used to achieve three results:
data integrity, authentication, and non-repudiation.
·
Data integrity. Bob can verify that Alice’s
message wasn’t changed along its way. Any modification in the message would
produce a completely different signature.
·
Authenticity. As long as Alice’s private key
is kept in secret, Bob can use her public key to confirm that the digital
signatures were created by Alice and no one else.
·
Non-repudiation. Once the signature has been
generated, Alice won’t be able to deny having signed it in the future, unless
her private key gets somehow compromised.
Use cases
Digital signatures can be applied to various kinds of digital
documents and certificates. As such, they have several applications. Some of
the most common use cases include:
·
Information Technology. To enhance the security
of Internet communication systems.
·
Finance. Digital signatures can be
implemented to audits, expense reports, loan agreements, and much more.
·
Legal. Digital signing of all sorts of
business contracts and legal agreements, including governmental papers.
·
Healthcare. Digital signatures can prevent fraud
of prescriptions and medical records.
·
Blockchain. Digital signature schemes ensure that
only the rightful owners of the cryptocurrencies are able to sign a transaction
to move the funds (as long as their private keys aren’t compromised).
Limitations
The major challenges faced by digital signature schemes rely
on at least three requirements:
·
Algorithm. The quality of the algorithms used in
a digital signature scheme is important. This includes the choice of reliable hash functions and cryptographic systems.
·
Implementation. If the algorithms are good,
but the implementation is not, the digital signature system will likely present
flaws.
·
Private Key. If the private keys get leaked or
somehow compromised, the properties of authenticity and non-repudiation will be
invalidated. For cryptocurrency users, losing a private key may result in
significant financial losses.
Electronic
signatures vs. digital signatures
Simply put, digital signatures relate to one particular kind
of electronic signatures - which refer to any electronic method of signing
documents and messages. Thus, all digital signatures are electronic signatures,
but the opposite isn’t always true.
The main difference between them is the authentication
method. Digital signatures deploy cryptographic systems, such as hash
functions, public-key cryptography, and
encryption techniques.
Closing thoughts
Hash functions and public-key cryptography are at the core of
digital signature systems, which are now applied to a wide range of use cases.
If properly implemented, digital signatures can increase security, ensure
integrity, and facilitate the authentication of all kinds of digital data.
In the blockchain realm, digital signatures are used to sign
and authorize cryptocurrency transactions. They are particularly important for
Bitcoin because the signatures ensure that coins can only be spent by the
individuals that possess the corresponding private keys.
Although we’ve been using both electronic and digital
signatures for years, there is still a lot of room for growth. A great portion
of today’s bureaucracy is still based on paperwork, but we will likely see more
adoption of digital signature schemes as we migrate to a more digitalized
system.
