Cryptography › Module 2 › Lesson 4
Digital Signatures
Prove who signed a message and that it was not altered in transit
Opening
Not secrecy—proof
Encryption hides content. Digital signatures prove “this came from the private-key holder” and “it was not changed.” Software updates, git commits (when signed), documents, and TLS certificates all lean on signatures.
1. How Signatures Work (Simplified)
1. Hash the message → digest 2. Sign the digest with the private key → signature 3. Verifier hashes the message again and checks the signature with the public key If verification succeeds, the message matches what was signed and the signer possessed the private key (assuming the public key is the right one—hence PKI).
2. What Signatures Do Not Do Alone
Not encryption
Signed data can still be readable unless also encrypted.
Not identity magic
A signature only binds to a key. Trusting the key still needs PKI or another out-of-band check.
Conceptual OpenSSL sign/verify (lab keys)echo "release notes" > notes.txt openssl dgst -sha256 -sign private.pem -out notes.sig notes.txt openssl dgst -sha256 -verify public.pem -signature notes.sig notes.txt
echo "release notes" > notes.txt openssl dgst -sha256 -sign private.pem -out notes.sig notes.txt openssl dgst -sha256 -verify public.pem -signature notes.sig notes.txt
Code signing saves outages—and lives
OS and browser update systems verify signatures before installing. Fake updates without valid signatures should fail closed.
Knowledge Check
Digital signatures primarily provide:
Multiple choice
Knowledge Check
True or False: Signing a message encrypts it so nobody can read it.
True or False
Knowledge Check
Verification of a signature uses the:
Multiple choice