Digital Signature

Digital Signature

A digital signature is basically a way to ensure that an electronic document (e-mail, spreadsheet, text file, etc.) is authentic. Authentic means that you know who created the document and you know that it has not been altered in any way since that person created it.

How does digital signature works?

Ans. Rohan wants to digitally sign emails and electronic contracts. 

1. So he would use computer software (asymmetric crypto system) to generate two keys, a public key and a private key. 
2. Rohan will give his public key to the whole world but will keep his private key to himself. Once he has done that, he can use his private key to sign contracts etc.. 
3. Anyone can use Rohan’s public key to verify his signature. 

That’s where the problem begins. How can anyone be sure which is Rohan’s public key? What if Rohan denies that a particular public key is actually his? 

To solve this problem digital signature certificates are used. 

1. Rohan would apply to a licensed CA (Certifying Authority) for a digital signature certificate.
2. As part of the application process he would submit identification documents as discussed earlier. 
3. He would also send his public key to the CA. 
4. The CA would then “certify” the public key as belonging to Rohan and issue a digital signature certificate that contains Rohan’s public key along with information identifying him.

Now…

1. Rohan uses computer software to generate two keys, a public key and private key. 
2. These keys are nothing but extremely large numbers. Although the keys are mathematically related, it is almost impossible to obtain the private key by using the public key.
3. Rohan will give his public key to the whole world but will keep his private key to himself.

Now Rohan wants to enter into a transaction with Sunil. He composes an electronic document containing the words

“I, Rohan owe Sunil the sum of Rs. 5000 lakhs only.”

1. Using his computer, Rohan runs this document through a hash function. 
2. The hash function software produces a fixed length of alphabets, numbers and symbols for any document. This is known as the hash result (Message digest). However, the contents of the message digest shall be unique for every single document.
3. If even one letter in the document is altered, an entirely different hash result will be generated.
4. When using a particular hash function, the length of the output is always the same, whether the input document is one word or 1 lakh words.
5. Moreover, the hash function software will always produce the same hash result for a particular message. 
6. It is practically impossible to reconstruct the original message from the hash result. That is why it is known as a one-way hash function.
7. Rohan now uses his computer to “sign” the hash result of his document. His computer software uses his private key to perform some calculations upon the hash result. This produces a signature, which consists of some digits. This set of digits is attached to the hash result.
8. Rohan now sends the original message and the signed message digest (hash result) to Sunil.
9. Sunil has the same hash function software on his computer.
10. Sunil also has Rohan’s public key. 
11. When Sunil receives Rohan’s email, he runs the original document through the hash function software and generates a hash result. He compares this hash result with the one that was sent to him by Rohan. If the two hash results are the same, it means that the message is unaltered.
12. Sunil also verifies whether Rohan’s private key was actually used to sign the hash result. For this, Sunil’s computer uses Rohan’s public key. Only a message signed by Rohan’s private key can be verified using Rohan’s public key.

The public key and private key are basically two very large numbers that are mathematically related to each other. If a particular private key was used to “sign” a message, then only the corresponding public key will be able to verify the “signature”.