✍️ Digital Signatures
Proving you wrote it and it wasn't changed — without a secret handshake⏱ ~3 min
A wax seal proves the letter came from someone with that seal stamp. A DNA test proves the stamp was held by a specific person. Digital signatures do both simultaneously and mathematically: they prove the message came from someone holding a specific private key, and that the message hasn't been altered since signing.
How Digital Signatures Work
- 1.Hash the message — compute H = SHA-256(message). This produces a fixed-length fingerprint.
- 2.Sign the hash — compute Signature = Sign(H, private_key). The signature is a large number.
- 3.Send both — transmit (message, signature) together. The message is NOT encrypted.
- 4.Verify — recipient computes H' = SHA-256(message), then checks: Verify(signature, H', public_key).
- 5.Accept if match — if H' matches what the signature decodes to, the message is authentic and unmodified.
Why Hash Before Signing?
Asymmetric operations (RSA, ECDSA) are slow and can only process data smaller than the key size. Hashing the message first reduces any message — whether 1 byte or 1 GB — to a fixed 256-bit fingerprint. Then you only sign the small fingerprint. If even one bit of the message changes, the hash changes completely (avalanche effect), and signature verification fails.
Common Digital Signature Algorithms
| Algorithm | Based On | Key Size | Status |
|---|---|---|---|
| RSA-PSS | RSA factoring | 2048–4096 bits | ✓ Widely supported, secure with PSS padding |
| ECDSA | Elliptic curves | 256–521 bits | ✓ Fast, smaller signatures — used in TLS certs |
| Ed25519 | Edwards curve 25519 | 256 bits (fixed) | ✓✓ Best choice for new systems — fast, safe, no nonce pitfall |
| DSA | Discrete logarithm | 1024–3072 bits | ⚠️ Legacy; NIST deprecated for new use |
Real-World Uses of Digital Signatures
- •TLS certificates — the CA digitally signs your certificate to vouch that your public key belongs to your domain
- •Code signing — Windows, macOS, and app stores require executables to be signed; unsigned code triggers warnings
- •Git commits — developers sign commits with GPG to prove authorship; GitHub shows a 'Verified' badge
- •Email (DKIM) — email servers sign outgoing mail; receiving servers verify to prevent spoofing
- •Software updates — OS update packages are signed; if the signature fails, the update is rejected
- •Cryptocurrency — every Bitcoin transaction is an ECDSA signature proving the spender owns the coins
A digital signature is created with…