Title: Digital Signature using PKI certificates
Course: Introduction to SSL/PKI > Section: PKI

Digital Signature using PKI certificates

Introduction

The purpose of digitally signing a message (file, etc.) is to assure the recipient of the authenticity and integrity of the message. The digital signature proves that the message was signed by a specific person and that the message was not altered in transit.

To insure that only the recipient can read the message, the message should also be encrypted.

Note:

A user is issued a key pair from a Public Key Infrastructure (PKI) Certificate Authority (CA). This key pair is unique to the user and is used to sign documents and verify the user’s signatures. Key pairs are sometimes called by the shorthand “certificates” or “PKI certificates”. This shorthand form is technically incorrect but is widely used.

Note: The following steps are simplified and are a "cartoon" of how PKI is use to create a digital signature. A complete description of the actual porocess can be found on the web.

Digital Signature 1

Alice wants to send Bob a message and sign it so he knows she is the only one who could sent it.

Digital Signature 2

Alice creates a "digital signature" key pair. The public decryption key is stored in a PKI certificate.

Digital Signature 3

Alice creates a "hash" of the message she wants to send. She then encrypts the "hash" with her private encryption key and sends bob:

- The message
- The encrypted "hash"
- The digital signature certificate containing her public decryption key

When bob receives the message, "hash", and certificate he:

1. Validates the certificate containing the decryption key to insure it was issued (signed) by a trusted CA and is still valid
2. Creates his own "hash" of the message
3. He decrypts the "hash" sent by Alice using her public decryptioin key in the certificate

If the two "hashes" match:

- Only Alice could have sent the message
- The message was not modified in transit

A hash value (or simply hash), also called a message digest, is a number generated from a string of text. The hash is substantially smaller than the text itself, and is generated by a formula in such a way that it is extremely unlikely that some other text will produce the same value.