A digital signature turns a private key into a cryptographic commitment to a message. Anyone with the corresponding public key can check it, but a person without the private signing key should not be able to forge a valid signature. Unlike a pen-and-paper signature, it can authenticate who produced data and whether the data changed. section 1.4.3 section 7.1
A signature scheme follows three named steps:
- Generate a private key and its associated public key; share the public key while keeping the private key secret. section 7.1
- Sign a message with the private signing key, producing a signature that may look like random data. section 7.1 section 1.4.3
- Verify the signature with the public verifying key, the message, and the signature; the result is success or failure. section 7.1 section 1.4.3
Signing a message in Python
With pyca/cryptography, generate an Ed25519 key pair, sign the bytes `example.com has the public key 0xab70...`, and call `public_key.verify(signature, message)`. Successful verification prints `valid signature`; altered data raises an invalid-signature result. section 7.1.1
Signatures authenticate origin and integrity, not secrecy: a verifier does not need the private key, and changing the signed message invalidates the signature. This makes signatures useful in key exchanges, certificates, email, client authentication, and passwordless authentication. A signed statement can also support transitive trust when a verifier already trusts the signer. section 7.1 section 10.3.1 section 11.2.4
Choose and compose signature schemes conservatively:
- RSA PKCS#1 v1.5 remains widespread but is not recommended; RSA-PSS provides a better construction. section 7.5
- ECDSA and EdDSA are popular elliptic-curve choices; Ed25519 combines EdDSA with the Edwards25519 curve. section 7.3 section 7.5
- Do not assume a signature uniquely identifies its key or message: substitution attacks can introduce another validating key, and malleability can create another valid signature. section 7.4.1 section 7.4.2
- Bind the intended signer and message unambiguously, and never rely on uniqueness unless the chosen construction explicitly provides it. section 7.5
Figure 7.1 The interface of a digital signature. Like other public key cryptographic algorithms, you first need to generate a key pair via a key generation algorithm that takes a security parameter and some randomness. You can then use a signing algorithm with the private key to sign a message and a verifying algorithm with the public key to validate a signature over a message. You can’t forge a signature that verifies a public key if you don’t have access to its associated private key.
Use the signature interface diagram to trace key generation, signing, and public-key verification as one complete workflow. section 7.1
