Integrity - Digital Signatures

With public key infrastructure we can detect the authenticity and integrity of a website, but we can also do that with somebody's message, and we can do that through something called digital signatures.

We'll briefly talk about integrity and authenticity when it comes to messages. We'll talk about digital certificates and how we can use digital certificates when it comes to digital signatures. We'll talk about public key infrastructure and how that plays into digital signatures. And then we'll wrap things up by talking about the technical aspects of a digital signature.

Integrity and authenticity

When Susan sends a message to David, David may want to know that the message has integrity and authenticity. Obviously we don't do that with every single message that we send, but for the more critical ones it's going to be important that there is some sort of validation behind that, especially if it's a legal document. There are times when there is a legal document that we want signed and we want to make official, and we can do that through digital signatures.

Digital certificates and public key infrastructure

As part of this process we have a digital certificate. That certificate includes the public key on it, so that public key and certificate is going to be sent over to David, so David can do part of this confirmation. That way the private key can encrypt something, and if the public key decrypts that, it can be a form of verification.

Of course, there is an issue: if our private key, our public key and our certificate are all coming from the same source, how do we verify that that source is who they say it is — that authenticity part of this? Well, we can go to a certificate of authority. So we can use public key infrastructure to verify the certificate, to make sure it is in fact coming from Susan, the person that we expect it to be coming from.

How a digital signature works

So how do digital signatures work to create integrity and authenticity? Susan here has signed a document. This document right here is going to be digitally signed; it's going to be a legal document. What she's going to do is create a hash out of that — that fingerprint. So she's going to create a hash, which is the fingerprint of that document. Then what she'll do is take her private key and encrypt that hash to create an encrypted hash. Then she'll put that encrypted hash into a message along with the document and send it to David.

Now what David has is that document, and he also has that encrypted hash. What he can do is the same hashing algorithm, to figure out what that fingerprint should look like. He can also take the public key that's part of this certificate that's been already validated through public key infrastructure, and he can decrypt this hash to get the fingerprint — and the fingerprint that Susan figured out over here. If these two fingerprints match, then he knows that this public key that's already been validated comes from the proper private key, and that everything lines up.

So integrity has happened: the document hasn't changed, and you know it hasn't changed because his fingerprint lines up with the original fingerprint. And it also has created authenticity: he knows that he has the public key, the validated public key, that matches with the private key that Susan has. So that is a digital signature, proving both integrity and authenticity.

We started out by talking about integrity and authenticity. We talked about how digital certificates can be used to transfer the public key over, and how public key infrastructure can be used to validate the certificate. Once we have an accurate certificate, then we talked about digital signatures and how we can do a hash to make sure that there's integrity, and then also encrypt that hash to validate the sender, or that authenticity piece. So that is digital signatures and how digital signatures work.