Updated March 23, 2023
Introduction to Digital Signature
It is the concept of public-key encryption used for message authentication. It is a technique that is used to bind the person to digital data. The binding is digitally verified by the receiver as well as a third party. To understand, let’s take a real-life example – When we go to a bank for a deposit or withdraw money by or any action, we fill the slip and sign the paper. After that, the bank office verifies the signature with their data. If the signature match, they processed with the action; otherwise, the action will be rejected. The process happens with the digital signature. The difference is it verifies the signature digitally. A digital signature is a cryptographic value that is calculated based on the data and the secret key of the signer.
Why do we need Digital Signature?
We need a digital signature because of its following features:
1. Message Authentication
It ensures that the message is coming from the intended sender, not other parties. It allows a receiver to verify the digital signature by using the sender’s public key; it ensures that the signature is created only by the sender who uses the secret private key to encrypt the message.
2. Non-Repudiation
As the only sender knows the secret key, i.e. signature key, he is the only one who can create a unique signature on the data. If any problem arises, the receiver can show the evidence of the data and digital signature key to the third party.
3. Data Integrity
It provides data integrity to test the modification in the message. If somehow, the attacker gets access to the message and modifies the data. Verification at the receiver side will fail. This is because the hash value of the modified message and the algorithm’s value will not match. In this case, the receiver can reject the message.
How does it Work?
The process involved in the digital signature is as follows:
- The user who adopts has a pair of keys – a public key and a private key. These keys are used for the Encryption and decryption process. The private key is used for the encryption, i.e., signing the signature, or we can say that it is the signature key, and the public key is used for the decryption, i.e. verification key.
- The user, i.e. the signer, apply the hash function on the data and creates the hash of data.
- After that, apply a signature algorithm on both the hash value and the signature key to create the given hash’s digital signature.
- Then the signature is appended with data, and both signature and data are sent to the verifier over the network.
- Verifier, i.e. receiver, apply verification algorithm and verification key. This process gives value as an output.
- Verifier also used the same hash function on the data, which the signer uses to get the hash value.
- Then he verifies the hash value and the output, which is generated by an algorithm. Based on the result, the verifier validates it. If both are the same, the digital signature is valid; otherwise, it is invalid.
Suppose user A is a sender and user B is a receiver. A wants to send a message to B. User A takes the plain text and encrypt it using A’s private key and create a ciphertext. Then A transfer the Ciphertext to B over the network. To decrypt the ciphertext, B uses A’s public key and create plain text.
Types of Attacks on Digital Signature
Following are the three types of attacks that are attempted against the digital signature:
- Chosen Message Attack: The attacker tricks the genuine user into digitally signing a Message that the user does not normally intend to sign. As a result, the attacker gets a pair of the original message that was signed and the digital signature. using this, the attacker tries to create a new message that she wants a genuine user to sign and uses the previous signature
- Known Message Attack: In this type of attack, the attacker obtains some messages that the user sends and a key to create a new fault message and forge of the user.
- Key only Attack: In this type of attack, it is assumed that the user name some information public and the attacker try to misuse this public information. Attackers try to create the user. RSA and digital signature.
- RSA algorithm is used for performing. Here we will discuss the working of RSA.
- The sender uses the SHA1 message-digest algorithm to create an original message digest.
- The sender encrypts the message digest using the sender’s private key.
- The sender send s the message to the receiver along with the digital signature.
- After receiving the message, the receiver uses the same algorithm used by the senders to create the message digest.
- The receiver now uses the senders public key to decrypt. The output of this process is the message digest that was created at the sender site.
- The receiver compares both message digest, the one which he calculates and the one which the sender calculates. If both are the same, then the receiver accepts the message otherwise rejects the message.
Recommended Articles
This is a guide to What is a Digital Signature. Here we discuss why do we need a digital signature? And how does it work? Along with types of attacks. You can also go through our other suggested articles to learn more –
