Cyber Security-3
Cryptography is the art and science of securing communication by transforming information into a secret code. It involves using mathematical algorithms to encrypt data, making it unintelligible to anyone without the correct decryption key.
Purpose: Cryptography focuses on creating secure communication systems to protect sensitive data from unauthorized access. The main goal is to prevent outsiders from accessing or understanding the information.
Realistic Goal: While it’s theoretically possible for hackers to break most cryptographic systems given enough time and resources, the practical aim is to make it so difficult, time-consuming, or resource-intensive that it's not worth their effort. This approach makes cryptography a practical barrier to data breaches.
Security Solutions Provided:
Encryption (Enc): Transforms data into an unreadable format, making it accessible only to authorized users with the decryption key.
Integrity: Ensures data hasn’t been altered during storage or transmission.
Authentication: Verifies that the parties in communication are who they claim to be.
Non-repudiation: Prevents parties from denying their actions, ensuring accountability for data interactions and transactions.
Cryptography, therefore, is fundamental to secure communication and protects against unauthorized access, tampering, and false claims, while verifying user identity.
Cryptanalysis: This is the process and study of techniques used to try to break or weaken cryptographic systems. Cryptanalysts work to discover weaknesses in encryption methods, often by exploiting flaws or patterns, to decode encrypted messages without having the key. It can be used either by attackers trying to compromise security or by security experts looking to improve encryption strength by identifying and fixing weaknesses.
Cryptology: This term encompasses both cryptography (the creation of secure communication methods) and cryptanalysis (the study of breaking these methods). Essentially, cryptology is the broader field that covers everything related to securing, storing, and understanding the methods for protecting information as well as the techniques for analyzing and potentially breaking those protections.
So, cryptology = cryptography + cryptanalysis — it includes both the defense (encryption) and the offense (breaking encryption) sides of data security.
Cryptosystem: This refers to a system or product specifically designed for secure communication, which performs both encryption (securing the data) and decryption (unlocking the data). A cryptosystem includes:
An encryption algorithm (mathematical method for securing the data)
Keys (secret values used in the encryption and decryption process)
Software components and protocols (rules for data transmission and handling) to manage secure communication.
Plaintext: This is the original, readable data (also called cleartext) that anyone can understand, either by reading or with computer processing. For example, messages or files in their original form are plaintext before encryption.
Ciphertext: When plaintext is encrypted, it becomes ciphertext—data that looks random and unreadable to anyone who doesn’t have the decryption key. Ciphertext hides the information’s meaning and is only understandable after decryption.
Encryption: This is the process of converting plaintext into ciphertext. It uses a special, secret value called a key (or cryptovariable) to scramble the data using a complex mathematical formula. The key is a long string of bits, and without it, deciphering the ciphertext is almost impossible.
Decryption: The reverse process of encryption, where ciphertext is transformed back into plaintext. This requires the correct key to unlock and return the data to its readable form.
Cipher: This is the algorithm or mathematical formula used in the encryption and decryption processes. A cipher consists of rules that tell the system how to rearrange and obscure data, essentially forming the “recipe” for scrambling and unscrambling the information.
In summary:
Cryptosystems secure information by turning plaintext into ciphertext through encryption (using a cipher and a key) and allow authorized users to transform it back through decryption.
Keyspace: This is the entire range of possible values that a key could have within a specific encryption system. In simple terms, it’s the set of all possible keys that could be generated. The larger the keyspace, the more possible keys there are, and thus, the harder it is for an attacker to guess or "brute-force" the correct key.
The principle here discusses whether security in cryptography should rely on keeping algorithms secret or only on the secrecy of the keys used within those algorithms.
Security through Obscurity vs. Kerckhoffs' Principle:
Security through Obscurity means that a system relies on keeping its methods, algorithms, or entire system hidden to maintain security. This is often considered weak because, if the system is discovered or analyzed, security could be compromised.
Kerckhoffs' Principle (or the principle of the open door) suggests that the security of a cryptographic system should depend only on the secrecy of the key, not on the secrecy of the algorithm. This principle implies that the system should remain secure even if the attacker has complete knowledge of the algorithm.
Key Points of Kerckhoffs' Principle:
The cryptographic system's security is rooted in the secrecy of the key itself.
It ensures that even if someone knows every detail about how the system operates (algorithm, protocols, software components), they cannot break the encryption without knowing the specific key.
Kerckhoffs' principle has become the standard in modern cryptography since publicly available, tested, and vetted algorithms tend to be more secure than proprietary or hidden methods.
The strength of cryptography is measured by a concept called the work factor, which is an estimate of the time, computational effort, and resources required for an attacker to break a cryptosystem. The goal is to make this effort so high that it becomes impractical or infeasible for attackers to break through the encryption.
Work Factor:
This is the amount of effort it would take to break an encrypted system. A high work factor makes it more secure, as it requires significant time or computing power to breach.
Strength of Encryption:
Algorithm: The mathematical procedures or rules governing how plaintext (readable data) is converted to ciphertext (encrypted data). Strong algorithms use complex, tested techniques that are difficult to reverse-engineer.
Secrecy of the Key: The key is a unique piece of data used to lock and unlock information within the algorithm. Its secrecy is crucial since the algorithm itself may be public knowledge (as per Kerckhoffs' principle).
Key Length: This is the number of bits in the key, directly impacting security. The longer the key, the more possible combinations an attacker has to attempt, increasing the work factor exponentially.
Integration in the Cryptosystem: The way the algorithm, key secrecy, and key length work together within the entire cryptosystem adds to its overall security. A good design ensures these elements are combined in a way that maximizes the work factor, enhancing the cryptosystem’s resistance to attacks.
A well-designed cryptosystem balances all of these elements to make breaching it too resource-intensive for most attackers.
Breaking a cryptosystem usually involves finding a way to reveal the encrypted information, often by compromising the key. Here’s a breakdown of key methods and best practices to prevent this:
Brute-Force Attack:
In a brute-force attack, an attacker tries every possible key value until they find one that successfully decrypts the ciphertext into readable plaintext. This approach is time-intensive, especially if the key size is large, which makes it more secure.
Improper Key Protection:
If the key is not adequately protected, even a strong cryptosystem can be compromised. Attackers often target weaknesses in how keys are stored or managed, so safeguarding the key is crucial.
Best Practices to Enhance Cryptosystem Security:
Use a Flawless Algorithm: Choose algorithms that are well-vetted and widely regarded as secure (like AES, RSA, etc.).
Choose a Large Key Size: Larger keys (128, 256 bits, or higher) make brute-force attacks significantly harder by increasing the number of possible keys.
Use Randomly Selected Keyspace Values: This helps prevent attackers from guessing the key based on patterns, increasing security.
Protect the Key: The key should be stored securely (e.g., in a secure key management system) and accessed only by authorized parties.
Following these practices ensures that even if attackers attempt to break the cryptosystem, the effort and resources required will likely exceed what they can reasonably expend.
A few historical examples:
- Accomplished on paper
- Based on shifting the alphabet
* Atbash:
- flip each letter to another one
- uses only one alphabet, monoalphabetic substitution cipher
- e.g.:
ABCDEFGHIJKLMNOPQRSTUVWXYZ
ZYXWVUTSRQPONMLKJIHGFEDCBA
A few historical examples:
* Caesar cypher:
replace each letter with k-th letter before it (enc)
replace each letter with k-th letter after it (dec)
plaintext: CYBERSECURITY k=2
ciphertext: AWZCPQCASPGRW
* later on polyalphabetic substitution ciphers were used
A One-Time Pad (OTP) is a cryptographic method where a plaintext message is combined with a random key or "pad" that is as long as the message itself. Each bit or character of the plaintext is encrypted by combining it with the corresponding bit or character from the key using XOR (exclusive or) in binary systems or modular arithmetic in character-based systems. The result is a ciphertext that is theoretically unbreakable—if certain conditions are met:
Key Properties of One-Time Pad
Truly Random Key: The key must be completely random and unpredictable, not generated by an algorithm.
Key Length Matches Message Length: The key must be as long as the message itself to ensure each bit/character has a unique corresponding bit/character in the key.
Single Use: The key should be used only once and then discarded. Reusing any part of the key compromises security.
Secure Key Transmission: The key must be securely shared between sender and receiver. This is often a challenge in practical use, as the key itself must be exchanged securely before communication can take place.
Security of the One-Time Pad
When these conditions are strictly followed, the OTP is provably secure and provides perfect secrecy. This means an attacker who intercepts the ciphertext and does not know the key has no better chance of guessing the original message than random guessing.
Limitations
While OTPs offer perfect security, their practical use is limited:
Key Distribution and Management: Distributing a secure, random key for each message is highly impractical, especially for frequent or large messages.
Key Storage: Both sender and receiver must store and protect these keys, which can be cumbersome.
In modern cryptography, due to these challenges, OTPs are rarely used except in very high-security contexts, like diplomatic or military communication, where key management is controlled rigorously.
Unbreakable One-Time Pad:
- must be used only one time
- must be at least as long as the message
- must be securely distributed and protected at its destination
- must be made up of truly random values
computers do not have truly RNGs
have pseudorandom RNGs (algorithmic, an input: seed, given the same seed same sequence is generated)
* impractial, secure key distribution is an issue, the only perfect cryptosystem
Cryptographic methods are primarily divided into two categories: symmetric key cryptography and asymmetric key cryptography.
Symmetric Key Cryptography
Key Structure: Symmetric cryptography, also called secret key cryptography, relies on a single key shared by both the sender and receiver. This key is used for both encryption and decryption.
Efficiency: Because it uses a single key, symmetric encryption is generally faster and more efficient, making it suitable for encrypting large volumes of data.
Security Requirement: The main challenge in symmetric cryptography is securely sharing and managing the secret key. If the key is intercepted, an attacker can decrypt the communication.
Examples: AES (Advanced Encryption Standard) and DES (Data Encryption Standard) are popular symmetric algorithms.
Asymmetric Key Cryptography
Key Structure: Also known as public key cryptography, asymmetric cryptography uses two keys, a public key and a private key. The public key is made publicly available, while the private key is kept secret.
Encryption and Decryption: Data encrypted with the public key can only be decrypted by the corresponding private key, and vice versa. This structure allows secure communication without the need to share the private key.
Public Key Use: One key is shared openly, which allows anyone to encrypt messages or verify digital signatures.
Security Foundation: Asymmetric cryptography relies on mathematical principles that are computationally intensive to reverse without the private key. This often involves powers of prime numbers, where factoring large prime products is difficult.
Elliptic Curve Cryptography (ECC): ECC is a variant that uses elliptic curves instead of large prime numbers, providing similar security with shorter keys, making it highly efficient for devices with limited processing power, like mobile devices.
Comparison:
Symmetric key cryptography is faster and simpler but requires secure key exchange.
Asymmetric key cryptography supports secure public sharing and digital signatures, though it is slower.
Symmetric Key Cryptography: e.g. DES, AES
Strengths:
• Much faster (less computationally intensive) than asymmetric
• Hard to break if using a large key size
Weaknesses:
• Requires a secure mechanism to deliver keys properly
• Each pair of users needs a unique key, as the number of individuals increases, key management issues arise
• Provides confidentiality but not authenticity or nonrepudiationWHY?
In symmetric key cryptography, both block ciphers and stream ciphers are used to transform plaintext into ciphertext, each with distinct approaches to handling data.
Block Ciphers
How They Work: In a block cipher, the message is divided into fixed-size blocks of bits (like 64 or 128 bits). Each block is then processed independently through a series of mathematical functions using the encryption key.
Example: If a message is 640 bits long and the block cipher size is 64 bits, the message is split into 10 blocks of 64 bits. Each block is encrypted separately but in sequence.
Block and Key Sizes: Common block sizes are 64 or 128 bits, while key sizes often include 128, 192, or 256 bits. Larger key sizes generally mean greater security but at the cost of speed.
Use Cases: Block ciphers are widely used in protocols that handle structured data (like files and blocks in storage systems). AES (Advanced Encryption Standard) is a popular example of a block cipher.
Stream Ciphers
How They Work: Stream ciphers handle data as a continuous stream of bits rather than dividing it into blocks. Each bit in the stream is encrypted one at a time with a keystream generated by the encryption key.
Keystream Generators: A keystream generator creates a sequence of bits based on the key, which is combined with the plaintext bits to produce ciphertext. This process allows for real-time encryption, as bits are processed immediately without waiting for a block to be filled.
Use Cases: Stream ciphers are suitable for applications that require data to be processed quickly and continuously, like voice over IP (VoIP) and real-time communications. RC4 is a well-known stream cipher (though it’s not commonly used today due to security concerns).
Initialization Vectors (IVs)
Purpose: An initialization vector (IV) is a random, non-secret value that adds randomness at the beginning of the encryption process. It’s used to ensure that the same plaintext encrypted multiple times will yield different ciphertexts.
Randomness and Security: While the IV doesn’t need to be secret, it must be unique for each encryption session. This randomness protects against patterns in the encrypted output, making it harder for attackers to find patterns or deduce the plaintext.
Implementation: The size of the IV depends on the encryption method and is often a fixed number of bits or bytes (for example, 128 bits for AES).
Asymmetric Key Cryptography:
- keys of an asymmetric cryptosystem are mathematically related, but having the public key will not enable someone to calculate the private key
Strengths:
• Better key distribution than symmetric systems, HOW?
• Better scalability than symmetric systems
• Can provide authentication and nonrepudiation
Weaknesses:
• Works much more slowly than symmetric systems
• Mathematically intensive tasks
Examples:
• Rivest-Shamir-Adleman (RSA)
• Elliptic curve cryptography (ECC)
Hybrid Encryption: A Blend of the Best
Hybrid encryption is a cryptographic technique that combines the strengths of both symmetric-key and asymmetric-key cryptography. It's designed to provide efficient and secure communication.
How it Works:
Symmetric Key Generation: A random symmetric key is generated. This key will be used to encrypt the actual data.
Symmetric Key Encryption: The symmetric key is encrypted using the recipient's public key.
Data Encryption: The actual data is encrypted using the symmetric key.
Transmission: The encrypted symmetric key and the encrypted data are transmitted together.
Decryption:
The recipient decrypts the symmetric key using their private key.
The decrypted symmetric key is then used to decrypt the actual data.
Why Hybrid Encryption?
Efficiency: Symmetric-key encryption is generally much faster than asymmetric-key encryption, making it ideal for large amounts of data.
Security: Asymmetric-key encryption ensures secure key exchange, preventing eavesdropping and tampering.
Flexibility: Hybrid encryption can be used in various scenarios, including secure email, file transfer, and database encryption.
Real-World Applications:
Secure Email: Hybrid encryption is used to protect the confidentiality of email messages.
Secure File Transfer: It's used to securely transmit files over networks.
Database Encryption: It can be used to encrypt sensitive data stored in databases.
Cloud Storage: It's used to protect data stored in cloud storage services.
In essence, hybrid encryption offers a practical and secure solution for protecting sensitive information in the digital age.
Integrity in cryptography ensures that data (like a message or file) hasn’t been altered during transmission or storage. It guarantees that what you receive is exactly what was sent.
Hashing for Integrity
Hashing Process: A hashing algorithm takes an input (any size message) and produces a fixed-length string of characters, known as a hash value. Even a small change in the input produces a completely different hash.
One-Way Function: Hashing is a one-way function—while it’s easy to generate a hash from a message, it’s virtually impossible to reverse-engineer the message from the hash value alone. This is crucial for security, as the algorithm is public knowledge, and the secrecy relies solely on its “one-way” nature.
Integrity Verification
Sender: The sender creates a hash of the message and sends both the message and its hash.
Receiver: The receiver then applies the same hashing algorithm to the received message. If the newly generated hash matches the one sent by the sender, the integrity is confirmed.
Collision and Security
Collision: A collision occurs if two different messages produce the same hash value. A strong hashing algorithm minimizes the likelihood of collisions, which would otherwise make it easier for attackers to find two inputs with identical hashes and potentially deceive the integrity check.
Common Hashing Algorithms
Examples include SHA-256 and MD5 (though MD5 is outdated due to collision vulnerabilities). Secure algorithms are carefully chosen to ensure low collision chances, enhancing integrity checks.
Integrity:
- An attacker can attempt to force a collision: birthday attack
- Birthday paradox of statistics:
* How many people must be in the same room for the chance to be greater
than even that another person has the same birthday as you? (looking for
someone with a specific birthday date)
Answer: 253
* How many people must be in the same room for the chance to be greater
than even that at least two people share the same birthday? (looking for any
two people who share the same birthday)
Answer: 23
- any random set of 23 people most likely (at least a 50 percent chance)
includes two people who share a birthday
- it is easier to find two matching values in a sea of values than to find a
match for just one specific value
Explanation of the Birthday Paradox
In probability, the birthday paradox refers to the counterintuitive idea that in a group of just 23 people, there’s a 50% chance that two people share the same birthday. With 253 people, there’s a greater than 50% chance of finding someone who shares your exact birthday.
In cryptography, this concept applies to hash collisions:
Instead of trying to match a hash for a specific message (like a specific birthday), attackers can simply look for any two messages with the same hash, which is statistically easier.
Birthday Attack on Hashing
A birthday attack is an attack method that leverages this paradox. Rather than attempting to find the exact hash of a particular message, an attacker can search for any two different inputs that produce the same hash (a collision). Due to the birthday paradox, this is significantly easier than matching a specific hash, reducing the time and computational resources needed to compromise the system’s integrity.
The paragraph’s point is that finding any two messages with matching hashes is much easier than finding a specific hash, which is why strong hash functions with low collision probabilities are essential for security.
X.509 Public Key Infrastructure (PKI):
X.509 is a standard for creating public key certificates, which bind a public key to the identity of a person, computer, or organization.
It provides a framework for a robust system to verify and trust digital identities.
Certificate Definition:
A digital certificate is a signed data structure. It contains information about the public key and the identity of the owner (such as a person or organization).
Certificates are signed by Certification Authorities (CAs), which are trusted entities that validate and issue these certificates.
Contents of an X.509 Certificate:
An X.509 certificate includes several key fields that provide essential information about the certificate, the public key, and the identity it is associated with. Here’s a breakdown:
Version: Identifies the version of the certificate format. The latest version is 3.
Serial Number: A unique identifier for each certificate issued by a CA. It helps distinguish this certificate from others.
Signature Algorithm: Specifies the algorithm used by the CA to sign the certificate, confirming its authenticity.
Issuer: The name of the CA that issued the certificate. It helps verify the certificate's source.
Validity: Contains the start and end dates for which the certificate is valid.
Subject: The name of the entity (person, organization, or device) to which the certificate is issued.
Subject Public Key Info: Contains the public key associated with the subject, which others can use to encrypt messages to the subject.
Issuer Unique ID: An optional field for uniquely identifying the issuing CA if there are multiple certificates with the same issuer name.
Subject Unique ID: An optional field for uniquely identifying the subject, in case they have multiple certificates.
Extensions: Optional fields that add additional information or functionality, like usage restrictions (e.g., only for email or SSL/TLS connections).
Purpose of Digital Certificates:
Digital certificates ensure secure communication, data integrity, and authenticity by linking a verified identity to a public key.
Files Associated with Certificates:
Key files are stored along with the certificate and are sometimes bundled in formats like
.pfxfor ease of use.
In summary, an X.509 digital certificate acts as a digital identity card, verifying the authenticity of the public key holder in a secure and standardized manner, and it's issued and validated by a trusted third party (CA).
Attack Against Cryptography
- Key and Algorithm Attacks: targets the algorithms or the keyspaces, require serious
math. knowledge, rarely used
- Brute Force: systematically try all possible keys until you find the right one
- Ciphertext-Only Attacks: attacker has the ciphertext of one or more messages,
encrypted using the same encryption algorithm and key. Goal is to discover the key
- Known-Plaintext Attacks: attacker has the plaintext and corresponding ciphertext
of one or more messages. Goal is to discover the key
- Chosen-Plaintext Attacks: attacker has the plaintext and ciphertext, but can choose
the plaintext that gets encrypted to see the corresponding ciphertext
- Chosen-Ciphertext Attacks: attacker can choose the ciphertext to be decrypted and
has access to the resulting decrypted plaintext
- Frequency Analysis: statistical attack, identifies statistically significant
patterns in the ciphertext generated by a cryptosystem
Digital Signatures: A Visual Breakdown
Purpose:
Just like a handwritten signature on a physical document, a digital signature ensures the authenticity and integrity of a digital message or document.
Process:
Message Hashing: The message is transformed into a unique, fixed-size string of characters called a message digest (or hash). This hash represents the essence of the message.
Encryption with Private Key: The sender uses their private key to encrypt the message digest. This encrypted hash is the digital signature.
Signature Appending: The encrypted hash (digital signature) is attached to the original message.
Transmission: The message with the attached digital signature is sent to the recipient.
Decryption with Public Key: The recipient uses the sender's public key to decrypt the digital signature. This reveals the original message digest.
Hashing the Received Message: The recipient also calculates the hash of the received message.
Verification: The recipient compares the decrypted message digest (from the digital signature) with the newly calculated hash of the received message.
If the two hashes match, it confirms:
Integrity: The message hasn't been altered during transmission.
Authenticity: The message originated from the claimed sender (non-repudiation).
Key Points:
Private Key: Only the sender possesses the private key, ensuring that only they can create the digital signature.
Public Key: The sender's public key is widely available, allowing anyone to verify the signature.
Hash Function: The hash function ensures that even a slight change in the message results in a completely different hash, making tampering easily detectable.
In essence, digital signatures provide a robust way to authenticate and verify the integrity of digital information in a world where information can be easily copied and manipulated.
This image illustrates the steps in Public Key Infrastructure (PKI) for obtaining and verifying a digital certificate to secure communications. Here’s a breakdown of the process using the example of Sue and Tom:
Sue Registers with CA through RA:
Sue, who wants a digital certificate (DC), begins by registering her information with a Certification Authority (CA). This is done through a Registration Authority (RA), which acts as an intermediary.
Registration Authority (RA) Verifies Owners:
The RA is responsible for verifying Sue's identity to ensure she is who she claims to be. This step is crucial to ensure that the certificate is issued to the correct person or entity.
Send Approved DC Request:
After verifying Sue's information, the RA sends an approved digital certificate request to the CA.
Sue Sends Tom a Message Signed with Digital Signature:
Once Sue has received her digital certificate from the CA, she can send a message to Tom. To secure this communication, she signs her message with a digital signature using her private key. This signature assures Tom that the message indeed came from Sue and has not been tampered with.
Tom Requests Sue’s DC:
To verify Sue’s digital signature, Tom needs Sue’s public key. He requests Sue’s digital certificate (DC) from the CA.
CA Sends Sue’s DC:
The CA responds to Tom’s request by sending Sue’s digital certificate, which contains her public key.
Tom Confirms Sue’s Digital Signature (DS):
Using the public key in Sue’s digital certificate, Tom can verify the digital signature on the message. If the signature is valid, Tom can trust that the message is indeed from Sue and that it has not been altered.
Summary of Key Components:
Certificate Authority (CA): Issues and manages digital certificates, ensuring trust in the identities associated with the certificates.
Registration Authority (RA): Verifies the identity of certificate requesters.
Digital Certificate (DC): A digital document that binds Sue’s public key with her identity.
Digital Signature (DS): Sue’s way of signing a message to prove her identity and ensure message integrity.
This process demonstrates how PKI enables secure and trustworthy communication by verifying identities and ensuring message authenticity and integrity.
This image breaks down the structure and process of creating a digital signature. Digital signatures are used to verify the authenticity and integrity of a message or document. Here’s what each section in the diagram represents:
1. Content Info (Signed Data):
This is the main content or data that will be signed. It’s the actual information or document that needs to be authenticated.
2. Signed Data:
This section includes several components related to the original data that needs to be protected:
Version: The version of the digital signature format being used.
SHA-256: The hashing algorithm applied to the data (here, SHA-256) to create a fixed-length hash value.
Encapsulated Data (Original Data): This is the original content or data being signed.
Certificate: A digital certificate that binds the signer’s identity to their public key.
Signer Info: Information about the signer.
3. Signer Info:
This section contains detailed information about the signer and the signature:
Version: Version of the signer information format.
Signer Identifier: Identifies the signer, possibly linking to a public key certificate.
SHA-256: The hashing algorithm used.
Signed Attributes: Additional details signed along with the document (e.g., hashing algorithm and signature format, here shown as
sha256withRSA).Signature: The actual digital signature generated by encrypting the hash of the data with the signer’s private key.
Signed Attributes:
These are attributes associated with the signature:
Hash: The hash of the original content/data.
Time: A timestamp indicating when the signature was created.
Content Type Data: Information about the content type being signed.
Certificate (Hash): A hash of the certificate, linking the signature to the signer’s identity.
Process for Creating the Digital Signature:
DER Encoding: The data and attributes are encoded in Distinguished Encoding Rules (DER) format, a binary format for data structures.
Hash: A hash of the data is generated using the SHA-256 algorithm.
RSA (Encryption): The hash is then encrypted using the RSA algorithm with the signer’s private key, creating the digital signature.
Summary:
The digital signature process starts with hashing the content, then adding signer-specific attributes, and finally creating the signature using the RSA algorithm on the hash. This allows the recipient to verify the integrity and authenticity of the signed data by decrypting the signature with the signer’s public key and comparing it to the computed hash of the received data. If they match, the data is confirmed to be authentic and unaltered.