Digital signature
A digital signature is cryptographic data generated with a private key and verified with corresponding public information to authenticate data or its signer and detect alteration.
Software Security for Developers
A digital signature is a cryptographic value that authenticates a message and binds it to the signer so that the signature can be independently verified.
- How it is used
- Uses asymmetric keys to protect messages, service requests, authentication challenges, and legally auditable interactions.
- How deep it goes
- Explains key roles, verification flow, tradeoffs, and Java implementations, but defers cryptographic mathematics and protocol proofs.
- Examples
- Demonstrates warehouse-to-payment data signing, Java RSA methods, service request headers, TLS messages, and hardware-key challenge responses.
- What you can do after
- Build it from scratch with Java cryptographic APIs, sign selected data, verify signatures, and reject forged or modified requests.
Read how Software Security for Developers explains digital signature →
Real-World Cryptography
A digital signature is a cryptographic value computed with a private signing key and verified with the corresponding public key to authenticate data or its signer.
- How it is used
- Uses asymmetric cryptography to authenticate message origin and integrity across protocols, email, certificates, and user authentication.
- How deep it goes
- Builds from key generation through signing and verification into RSA mechanics, standards, zero-knowledge connections, and protocol pitfalls.
- Examples
- Demonstrates signed trust statements, Python Ed25519 verification, OpenPGP email, TLS client certificates, and FIDO2 authentication.
- What you can do after
- Apply digital signatures with a named library, select a standard cautiously, and recognize substitution and malleability hazards.
Read how Real-World Cryptography explains digital signature →
Secure APIs
A token signature is cryptographic data that allows a recipient to verify that a token was issued by a trusted party and has not been altered.
- How it is used
- Protects API authentication by verifying that access tokens are legitimate and unchanged.
- How deep it goes
- Defines the JWT signature and stresses validation, but defers signing implementation details.
- Examples
- Uses forged, tampered, unsigned, and expired access tokens to illustrate authentication failures.
- What you can do after
- Diagnose token-validation failures that enable impersonation or privilege escalation.
API Design Patterns
A digital signature is a cryptographic value generated with a private key and verifiable with the corresponding public key to authenticate the signer and detect changes to signed data.
- How it is used
- Authenticates incoming API requests while providing integrity, origin authenticity, and support for nonrepudiation.
- How deep it goes
- Explains key registration, raw signing, request fingerprinting, signature metadata, and verification, while largely deferring cryptographic mathematics.
- Examples
- Uses Node.js signing and verification functions, public-key registration, and a signed PATCH request for `/chatRooms/1`.
- What you can do after
- Builds an API flow that registers public keys, signs outbound requests, and authenticates inbound requests.
Hacking Cryptography
A cryptographic value associated with data that enables verification of its integrity and origin by parties possessing the required verification information.
- How it is used
- Establishes message authenticity, software trust, ownership transfer, and transaction authorization without sharing signing keys.
- How deep it goes
- Derives schoolbook RSA signing and verification, demonstrates existential forgery, and flags padding and nonce-reuse failures.
- Examples
- Uses schoolbook RSA, signed software, Bitcoin ownership transfers, and chip-based payment transactions as concrete examples.
- What you can do after
- Evaluate/understand asymmetric signing, recognize basic forgery risks, and identify catastrophic ECDSA nonce reuse.
Elliptic Curve Cryptography for Developers
A digital signature is a cryptographic value produced with a private key that authenticates data and can be checked with the corresponding public key.
- How it is used
- Authenticates document authorship and detects modification through private-key signing and public-key verification.
- How deep it goes
- Derives Schnorr signing and verification equations, but summarizes ECDSA without developing its calculations in comparable detail.
- Examples
- Uses Alice’s document, Schnorr equations, signature-process figures, and multiple-signature blockchain aggregation as concrete illustrations.
- What you can do after
- Apply it via elliptic-curve mathematics to create and verify Schnorr signatures and understand ECDSA’s verification structure.
Read how Elliptic Curve Cryptography for Developers explains digital signature →
Grokking Web Application Security
A cryptographic signature is data generated with a private key that enables verification of a message's authenticity and integrity using the corresponding public key.
- How it is used
- Protects client-side sessions, JWTs, serialized data, and outgoing email from undetected tampering.
- How deep it goes
- Explains verification through cookie unsigning and DKIM key placement, without cryptographic algorithm internals.
- Examples
- Uses an altered username cookie, a Node.js cookie-parser unsign routine, JWT validation, and DKIM-signed email.
- What you can do after
- Apply it via cookie-parser or DKIM services to reject altered session data, tokens, and email.
Read how Grokking Web Application Security explains digital signature →
Learn PowerShell Scripting in a Month of Lunches, Second Edition: Write and organize scripts and tools
A digital signature is cryptographic metadata attached to a file that authenticates its signer and detects changes to the signed content.
- How it is used
- Adds a safety check before running PowerShell scripts and supports trusted-publisher workflows.
- How deep it goes
- Explains key pairs, hashes, verification, testing, execution policy, and tamper errors, while deferring detailed PKI theory.
- Examples
- Uses a signed psvm.ps1 script, Get-AuthenticodeSignature output, trusted-publisher prompts, and an altered-file failure.
- What you can do after
- Diagnose/debug with Get-AuthenticodeSignature and recognize when a changed script must be investigated or re-signed.
Related concepts
- private keyproduced by · A private key is the secret component of an asymmetric cryptographic key pair used by its holder for operations such as authentication, decryption, or digital signing.
- ECDSAimplemented by · ECDSA is a public-key digital signature algorithm that uses elliptic-curve arithmetic to generate and verify signatures.
- Schnorr signatureincludes · A Schnorr signature is a public-key digital signature scheme based on a proof of knowledge of a discrete logarithm.
- CRYSTALS-Dilithiumincludes · CRYSTALS-Dilithium is a lattice-based digital signature scheme based on the learning with errors problem.
- hash-based signature schemeincludes · A hash-based signature scheme is a digital signature scheme whose security is based on cryptographic hash-function properties rather than algebraic number-theoretic assumptions.
- public keyuses · A public key is the openly distributable component of an asymmetric cryptographic key pair, used for encryption, authentication, or signature verification.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.