A digital signature is an encryption mechanism used to verify the authenticity and integrity of digital data. We can consider it as a digital version of common handwritten signatures, but with greater levels of complexity and security.

Briefly, we can describe a digital signature as a code that is attached to a message or document. Once generated, the code acts as proof that the message has not been tampered with along the way from sender to recipient.

While the concept of securing communications using cryptography dates back to ancient times, digital signature systems became a possible reality in the 1970s – thanks to the development of public key cryptography (PKC). Therefore, to learn how digital signatures work, we first need to understand the basics of hash functions and Public Key Cryptography.


Hash Functions

Hash functions are one of the main elements of digital signature systems. The process of hashing involves transforming data of any size into data of a fixed size. This is done by a special type of algorithms known as hash functions. The output data generated by a hash function are known as hash values.

When combined with cryptography, so-called cryptographic hash functions can be used to generate a hash value that serves as a unique fingerprint. This means that any change to the input data (message) would result in a completely different hash. This is the reason why cryptographic hash functions are widely used to verify the authenticity of digital data.


Public Key Cryptography (PKC)

Public key cryptography, or PKC, refers to a cryptographic system that uses a pair of keys: a public key and a private key. The two keys are mathematically related and can be used for both data encryption and digital signatures.

As an encryption tool, the PKC system is more secure than more rudimentary methods of symmetric encryption. While older systems rely on the same key to encrypt and decrypt information, PKC allows data to be encrypted with the public key and decrypted with the corresponding private key.

Furthermore, the PKC scheme can also be applied to generate digital signatures. The process consists of submitting a message (or digital data), together with the sender's private key, through a hash function. Then, the recipient of the message can verify that the signature is valid using the public key provided by the sender.

In some situations, digital signatures may involve encryption, but this is not always the case. For example, the Bitcoin blockchain makes use of digital signatures and PKC, but contrary to what many people think, there is no encryption in the process. Technically, Bitcoin implements the so-called Elliptic Curve Digital Signature Algorithm (ECDSA) to authenticate transactions.


How digital signatures work

In the context of cryptocurrencies, a digital signature system generally consists of three basic steps: hashing, signing, and verification.

Hashing

The first step is to hash the message or digital data. This is done by a hashing algorithm, which transforms the data into a hash value. As mentioned, messages can vary significantly in size, but when they are subjected to the hashing process, all hash values ​​are the same size. This is the primary property of a hash function.

However, hashing data is not mandatory to produce a digital signature, as it is possible to use a private key to sign a message that has not been subjected to a hash function. However, in the case of cryptocurrencies, messages are always transformed into hashes, as the fixed size of hash values ​​facilitates the entire process.

Signature

Once the information is transformed into hash values, the sender of the message needs to sign it. This is the moment when Public Key Cryptography comes into the picture. There are several types of digital signature algorithms, each with its own mechanism. But generally, the message will be signed with a private key, and the recipient of the message will be able to verify its validity using the corresponding public key (provided by the sender).

In other words, if the private key is not included when the signature is generated, the message recipient cannot use the corresponding public key to verify the validity of the signature and message. The public and private keys are generated by the sender of the message, but only the public key is shared with the receiver.

It's worth noting that digital signatures are directly related to the content of each message. Therefore, unlike handwritten signatures, which tend to be the same regardless of the message, each digitally signed message will have a different digital signature.

Verification

Let's use an example to illustrate the entire process until the final verification step. Imagine that Alice wrote a message to Bob, generated a hash value of the message, and combined it with her private key to generate a digital signature. The signature will act as a unique fingerprint, exclusive to that message.

When Bob receives the message, he can verify the validity of the digital signature using the public key provided by Alice. This way, Bob can be sure that the signature was created by Alice because only she has the private key that corresponds to this public key (at least that's what we hope).

So, it is crucial that Alice keeps her private key secret. If someone else gets hold of Alice's private key, they can create fake digital signatures in Alice's name. In the context of Bitcoin, this means that someone can use Alice's private key to move or spend her Bitcoins without her permission.


Why are digital signatures important?

Digital signatures are often used to achieve three outcomes: data integrity, authentication, and non-repudiation.

  • Data integrity. Bob can verify that Alice's message hasn't changed along the way. Any modification to the message would produce a completely different signature.

  • Authenticity. As long as Alice's private key is kept secret, Bob can use his public key to confirm that the digital signatures were created by Alice and no one else.

  • Non-repudiation. Once the signature is generated, Alice will not be able to deny that she signed it in the future unless her private key is compromised in some way.


Use cases

Digital signatures can be applied to various types of documents and digital certificates. Therefore, they have several possible applications. Some of the most common use cases include:

  • Information Technology. To improve the security of Internet communication systems.

  • Finance. Digital signatures can be implemented in audits, expense reports, loan agreements and more.

  • Use it cool. Digital signatures for all types of business contracts and legal agreements, including government documents.

  • Health systems. Digital signatures can prevent prescription and medical record fraud.

  • Blockchain. Digital signature schemes ensure that only legitimate owners of cryptocurrencies can sign a transaction to move money (as long as their private keys are not compromised).


Limitations

The main challenges faced by digital signature schemes are related to at least three factors:

  • Algorithm. The quality of the algorithms used in a digital signature scheme is important. This includes choosing reliable hash functions and strong encryption systems.

  • Implementation. Even if the algorithms are good, poor implementation will likely cause failures in the digital signature system.

  • Private key. If the private keys are compromised in any way, the authenticity and non-repudiation properties will be invalidated. For cryptocurrency users, the loss of a private key can result in significant financial losses.


Electronic vs. electronic signatures digital signatures

In short, digital signatures relate to a specific type of electronic signatures - which refer to any electronic method of signing documents and messages. Therefore, all digital signatures are electronic signatures, but the opposite is not always true.

The main difference between the two systems is the authentication method. Digital signatures make use of cryptographic systems such as hash functions, public key cryptography, and encryption techniques.


Final considerations

Hash functions and the PKC system are crucial elements in digital signature schemes, which are now applied in a wide variety of situations. If implemented properly, digital signatures can increase security, ensure integrity, and facilitate authentication of all types of digital data.

In the world of blockchain, digital signatures are used to sign and authorize cryptocurrency transactions. They are particularly important for Bitcoin because signatures ensure that coins can only be used by individuals who hold the corresponding private keys.

Although we have been using electronic and digital signatures for years, there is still a lot of room for growth. A large part of today's bureaucracy is still paper-based, but we will likely see more adoption of digital signature schemes as we move to a more digitized system.