A digital signature is a cryptographic mechanism used to check the authenticity and integrity of digital data. We can view it as a digital version of conventional handwritten signatures, but with a higher level of complexity and security.
In simple terms, we can describe a digital signature as a code attached to a message or document. Once generated, the code serves as proof that the message was not tampered with during its transit from sender to recipient.
Although the concept of securing communications using cryptography has been around since ancient times, digital signature systems became a reality in the 1970s - thanks to the development of Public Key Cryptography (PKC). So, to learn how digital signatures work, we first need to understand the basics of hash functions and public key cryptography.
Hash function
Hashing is one of the core elements of a digital signature system. Hashing involves converting data of any size into a fixed-sized output. This is done by a special type of algorithm called a hash function. The output generated by the hash function is called the hash value or encrypted message.
When combined with cryptography, cryptographic hash functions can be used to create hash values (cryptography) that act as a unique digital fingerprint. This means that any change in the input data (message) will result in a completely different output (hash value). And that is why cryptographic hash functions are widely used to verify the authenticity of digital data.
Public Key Cryptography (PKC)
Public key cryptography, or PKC, refers to a cryptographic system that uses a pair of keys: a public key and a private key. The two keys are mathematically related and both can be used for data encryption and digital signatures.
As an encryption tool, PKC is more secure than more rudimentary methods of symmetric encryption. While older systems also relied on this same key to encrypt and decrypt information, PKC allows encrypting data with a public key and decrypting data with a corresponding private key.
In addition, the PKC system can also be applied in creating digital signatures. In essence, the process involves hashing the message (or digital data) using the signer's private key. Next, the recipient of the message can check whether the signature is valid using the public key provided by the signer.
In some cases, digital signatures may involve encryption, but not always. For example, the Bitcoin blockchain uses PKC and digital signatures, but contrary to popular belief, there is no encryption in the process. Technically, Bitcoin implements the so-called Elliptic Curve Digital Signature Algorithm (ECDSA) to authenticate transactions.
How digital signatures work
In the context of cryptocurrency, a digital signature system typically consists of three basic steps: hashing, signing, and verification.
Hashing data
The first step is hashing the digital message or data. This is done by sending the data through a hashing algorithm to produce a hash value (i.e. an encrypted message). As mentioned, messages can have different sizes, but when they are hashed, all their hashes have the same length. This is the most basic property of a hash function.
However, hashing the data is not required to create a digital signature because one can use the private key to sign an unhashed message. But in cryptocurrencies, data is always hashed because dealing with fixed-length hashes is what facilitates the whole process.
Signature
Once the message is hashed, the person sending the message needs to sign it. This is where public key cryptography comes into play. There are several types of digital signature algorithms, each with its own mechanism. But essentially, the hashed message is signed with a private key, and the recipient of the message can then check its validity using the corresponding public key (provided by the signer).
In other words, if the private key is not included when the signature is generated, the recipient of the message will not be able to use the corresponding public key to verify its validity. Both the public and private keys are generated by the sender of the message, but only the public key is shared with the recipient.
It is worth noting that the electronic signature is directly related to the content of each message. So, if a handwritten signature remains the same regardless of the message message content, each digitally signed message will have a different digital signature.
Accuracy
Let's take an example to illustrate the entire process until the final verification step. Suppose Alice writes a message to Bob, hashes the message to create a hash code, and then combines this hash value with her private key to create a digital signature. The signature will act as a unique digital fingerprint of that message.
When Bob receives the message, he can check the validity of the digital signature using the public key provided by Alice. This way, Bob can be sure that the signature was created by Alice because only she has the private key corresponding to that public key (at least that's what we expect).
Therefore, it is important for Alice to keep her private key secret. If someone else obtains Alice's private key, they can create a digital signature and pretend to be Alice. In the context of Bitcoin, this means that someone could use Alice's private key to move or spend her Bitcoins without her permission.
Why is digital signature important?
Digital signatures are commonly used to achieve data integrity, authentication, and anti-commitment.
Data integrity. Bob can verify that Alice's message was not altered on the way to being sent. Any modification in the message will produce a completely different signature.
Authenticity. As long as Alice's private key is kept secret, Bob can use his public key to confirm that the digital signature was created by Alice and not someone else.
Anti-repudiation. Once the signature has been created, Alice will not be able to deny that she signed it, unless her private key is compromised.
Use cases
Digital signatures can be applied to many different types of documents and digital certificates. Therefore, they have a number of applications. Some of the most common use cases include:
Information technology. To enhance the security of Internet communication systems.
Finance. Digital signatures can be deployed for audits, expense reports, loan agreements and more.
Juridical. The use of digital signatures on all types of business contracts and legal agreements, including government documents.
Health care. Digital signatures can prevent fraud in prescriptions and medical records.
Blockchain. Digital signature systems ensure that only the rightful owners of cryptocurrency can sign a transaction to transfer funds (as long as their private keys are not compromised).
Limit
The major challenges facing digital signature systems are based on at least three requirements:
Algorithm. The quality of the algorithms used in a digital signature system is very important. This includes the choice of reliable hash functions and cryptographic systems.
Deployment. If the algorithms are good, but the implementation is not good, the digital signature system will likely have errors.
Private key. If private keys are leaked or somehow compromised, the authentication and non-repudiation properties will be invalidated. For cryptocurrency users, losing private keys can lead to significant financial loss.
Electronic signature and digital signature
Simply put, an electronic signature refers to a specific type of electronic signature - referring to any electronic method of signing documents and messages. Therefore, all digital signatures are electronic signatures, but the reverse is not always true.
The main difference between them is the authentication method. Digital signatures implement cryptographic systems, such as hash functions, public key cryptography, and encryption techniques.
Conclude
Hash functions and public key cryptography are at the core of digital signature systems, which are now applied to a wide range of use cases. If done properly, digital signatures can increase security, ensure integrity, and facilitate the authentication of all types of digital data.
In the blockchain field, digital signatures are used to sign and authorize cryptocurrency transactions. They are especially important for Bitcoin because signatures ensure that only individuals in possession of the corresponding private key can spend the coins.
Although we have been using both electronic and digital signatures for many years, there is still a lot of room for growth. A large part of today's bureaucracy is still paper-based, but we will likely see greater adoption of digital signature systems as we move to a more digitized system.