What Are Digital Signatures?

By Kurt Wuckert Jr.

Digital signatures are one of the main ways we use asymmetric cryptography in the real world. At a low level they are just big numbers produced by algorithms like RSA, ECDSA or DSA. At a higher level they act like a secure stamp that you can attach to digital information.

As commerce, contracts and communication have moved online, we needed a way to do the same thing with bits that we used to do with ink on paper. Digital signatures fill that role. They help prevent tampering and impersonation, so two parties can trust what they are sending each other over a network.

Over the last few decades, many legal systems have caught up with the technology. Around the year 2000, a number of countries passed laws that recognize digital signatures as legally binding. In many places, a properly created digital signature on a document can be treated just like a handwritten signature.

Comparing Physical and Digital Signatures

A physical signature is usually your name written in a style that is hard for someone else to copy. It has two key purposes:

  • It ties your identity to the document.

  • It is unique enough that forgery should be difficult.

Digital signatures are built to provide the same two guarantees, but with more power and better security.

With a paper document, verifying a signature often involves a human being watching you sign or comparing it to a sample. With digital signatures, the signing and verification steps are handled by carefully tested cryptographic libraries. That automation lets computers check large numbers of signatures quickly and consistently.

The Basic Digital Signature Protocol

To explain how digital signatures work, it helps to use two characters, Alice and Bob. Alice is the one signing. Bob is the one verifying.

At a high level, the process has three steps.

Step 1: Key Generation

First, Alice generates an asymmetric key pair. This gives her two related keys:

  • A private key, which she keeps secret.

  • A public key, which she is free to share with anyone, including Bob.

These keys are mathematically linked. They are not random unrelated numbers. The system is designed so that:

  • It is easy to compute the public key if you know the private key.

  • It is practically impossible to compute the private key from the public key.

Because only Alice should know the private key, any valid signature produced with that key can be attributed to her. The public key then becomes a tool anyone can use to check those signatures.

In real systems, public keys are often published in some kind of registry, website, or directory. That way other people can look up Alice’s public key and associate it with her identity.

Step 2: Signing

When Alice wants to sign a document, she feeds two things into a signing algorithm:

  • The content she wants to sign, often called the message.

  • Her private key.

The algorithm outputs the digital signature, which is another number. You can think of it as a special code that only Alice could have created for that particular message, given her private key.

In practice, most systems do not sign the raw message directly if it is large. Instead, the message is first passed through a hash function, which produces a fixed length digest. The signature is then generated over that digest. Sometimes the hashing step is handled inside the signature algorithm itself.

Step 3: Verification

Bob’s side is the mirror image of Alice’s.

The verification algorithm takes three inputs:

  • The message that was signed.

  • The digital signature.

  • Alice’s public key.

It then runs the math and returns a simple true or false answer. True means the signature matches the message and the public key. False means something is wrong: the message changed, the signature does not match, or the public key does not belong to the signer.

End to End View

Put together, the flow looks like this:

  1. Alice generates a private and public key pair.

  2. She shares the public key, for example by publishing it in a directory.

  3. She signs a message with her private key and sends Bob both the message and the signature.

  4. Bob retrieves or uses Alice’s public key to verify the signature.

  5. The verification routine gives him a yes or no answer.

The concrete algorithms that do the heavy lifting are schemes like RSA and ECDSA. They define exactly how keys are generated and how the signing and verification equations work.

Key Properties of Digital Signatures

Beyond basic identification, digital signatures are designed to provide three important security properties.

Integrity

Because the signature is a function of both the message and the private key, changing the message will change the signature. If someone tampers with the content after it has been signed, the old signature will no longer verify. The check returns false and the recipient can see that something has been altered.

This is a big improvement over handwritten signatures. With paper, it is often possible to modify the content of a document without disturbing the original signature at the bottom.

Message Authentication

If everything is working properly, only Alice knows her private key. That means only she can generate valid signatures with it. When Bob sees a signature that verifies against Alice’s public key, he has strong evidence that the message really came from her. This is called message authentication. It lets the receiver confirm both the contents and the claimed origin of the message.

Non Repudiation

Non repudiation is about preventing the signer from denying what they did later. If Alice’s private key is under her control, and a valid signature can be traced to that key, then she will have a hard time claiming she never signed the message.

In the legal or contractual sense, this becomes important when there is a dispute. A third party, such as a court, can examine the digital evidence. If the signature checks out against Alice’s public key, and she is known to have held the private key, that fact supports the other party’s claim that the signature is genuine.

Of course, all of this assumes that private keys are managed responsibly, which is its own separate topic. The design of the system, however, is meant to make forgery extremely difficult and to tie actions to keys in a reliable way.

ELI5(ish...)

Here is a simpler way to picture digital signatures.

Imagine you have a special kind of pen and stamp that only you own. The pen is your private key. The matching stamp outline that everyone knows about is your public key.

  • When you write a message and stamp it with your secret pen, you create a digital signature.

  • Anyone who has the public stamp shape can check whether that stamp really came from your pen or if someone tried to fake it.

The trick is that the stamp does not just mark the paper. It combines with the exact words you wrote. If someone changes even a few words in the message, the stamp no longer matches. The check will fail and people will know the message was altered.

This gives three helpful guarantees:

  1. Integrity: If the message changes, the signature breaks.

  2. Authentication: If the signature is valid, it almost certainly came from you, because only you have the special pen.

  3. Non repudiation: Later on, you cannot easily say “that was not me,” because the working signature points back to your unique pen and everyone knows it was yours.

In practice, all the math happens behind the scenes in your wallet, browser or software. What you get as a user is a way to “sign” digital stuff so that others can trust it the same way they trust ink on a contract, only with less guesswork and better protection against tampering.