Using Digital Signatures

With public key infrastructure we can detect the authenticity and integrity of a website, but we can also do that with somebody's message, and we can do that through something called digital signatures.

Integrity and authenticity of a message

When Susan sends a message to David, David may want to know that the message has integrity and authenticity. Obviously we don't do that with every single message that we send, but for the more critical ones it's going to be important that there is some sort of validation behind that, especially if it's a legal document. There are times when there is a legal document that we want signed and want to make official, and we can do that through digital signatures.

Digital certificates and public key infrastructure

As part of this process we have a digital certificate. That certificate includes the public key on it, so that public key and certificate is going to be sent over to David so David can do part of this confirmation. That way the private key can encrypt something, and if the public key decrypts that, it can be a form of verification.

Of course there is an issue if our private key, our public key and our certificate are all coming from the same source: how do we verify that that source is who they say it is, that authenticity part of this? Well, we can go to a certificate of authority, so we can use public key infrastructure to verify this certificate to make sure it is in fact coming from Susan, the person that we expect it to be coming from.

How a digital signature works

So how do digital signatures work to create integrity and authenticity? Susan here has signed a document. This document right here is going to be digitally signed; it's going to be a legal document. What she's going to do is she's going to create a hash out of that, that fingerprint. So she's going to create a hash, which is a fingerprint of that document, and then what she'll do is she'll take her private key and encrypt that hash to create an encrypted hash. Then what she'll do is she'll put that encrypted hash into a message along with the document and send it to David.

Now what David has is that document, and he also has that encrypted hash. What he can do is he can do the same hashing algorithm to figure out what that fingerprint should look like. He can also take the public key that's part of this certificate that's been already validated through public key infrastructure, and he can decrypt this hash to get the fingerprint, the fingerprint that Susan figured out over here. So if these two fingerprints match, then he knows that this public key, that's already been validated, comes from the proper private key, and that everything lines up.

So integrity has happened: the document hasn't changed, and he knows it hasn't changed because his fingerprint lines up with the original fingerprint. It also has created authenticity: he knows that he has the validated public key that matches with the private key that Susan has. So that is a digital signature, proving both integrity and authenticity.