A digital signature authenticates data and detects tampering. The signer uses a private key; anyone with the matching public key can verify the signature. Because only the private-key holder should be able to sign, signatures can provide nonrepudiation: evidence that a specific party signed a message. section 6.3.3 section 4.1
A typical signing and verification flow is:
- The sender selects the exact data to protect and signs it with a private key. section 6.3.3
- The sender transmits the data and signature, often placing the signature in a request header. section 16.2.3
- The receiver reconstructs the signed content and verifies the signature with the public key. section 6.4 section 16.2.3
- The receiver rejects the message when verification fails because the data may have been forged or changed. section 6.4
Digital signatures differ from HMACs. HMACs use one shared secret, so only holders of that secret can verify and either party could have created the value. RSA signatures use an asymmetric key pair, allow public verification, and provide nonrepudiation, but they are slower. Use HMACs for efficient checks between trusted parties; use signatures when many parties must verify or proof of authorship matters. section 6.5 section 6.3.3
Signing an internal service request
An inventory service can sign a request path and timestamp with SHA256withRSA, then send the Base64-encoded signature in an HTTP header. The product service reconstructs the same path-and-timestamp string, verifies it with the registered public key, and accepts the request only when verification succeeds. Include every security-relevant field in the signed data, and store private keys securely rather than hardcoding them. section 16.2.3
Figure 6.6 Using RSA for digital signatures. The warehouse service signs data with its private key, and the payment service (or any other service) can verify the signature using the corresponding public key. This approach ensures integrity and authenticity because only the service that holds the private key can create the signature.
The diagram shows a warehouse service signing data with its private key and a payment service verifying it with the corresponding public key. section 6.3.3
Keep encryption and signing responsibilities separate: use distinct key pairs for encryption/decryption and signing/verification. RSA examples use SHA256withRSA, while ECC provides the same signature guarantees with smaller keys and better performance. Digital certificates help establish that a public key belongs to the claimed party. section 6.4 section 7.5 section 6.6
