Digital Signatures and PKI

Digital Signatures and Public Key Infrastructure

digital signature process 1

sender computes a cryptographic hash of the message

digital signature process 2

sender encrypts the cryptographic hash with their private key to produce a digital signature

digital signature process 3

the receiver can use the sender’s public key to decrypt the hash, recompute it and check that it matches

how does this provide authenticity?

assuming the sender’s private key is secret, the signature can only have been computed by them

cryptographic hash examples

SHA256, MD5

PKI process 1

a certificate authority (CA) verifies the identity of the receiver

PKI process 2

CA digitally signs the receiver’s public key

PKI process 3

the receiver’s public key and CA’s digital signature are sent to the sender

how does this provide identity?

the digital signature is verified and if the sender trusts the CA then they by default trust that the receiver’s public key belongs to the receiver