What Is a Digital Signature?
A digital signature proves two things about a message: who created it (authenticity) and that nobody changed it since (integrity). It combines hashing with asymmetric cryptography — the same math behind HTTPS certificates, signed software, and secure email.
How does a digital signature work?#
Signing and verifying are mirror operations:
- Sign: the sender hashes the message, then encrypts that hash with their private key. The encrypted hash is the signature, attached to the message.
- Verify: the receiver decrypts the signature with the sender’s public key to recover the original hash, then independently hashes the received message. If the two hashes match, the message is authentic and unaltered.
The private key never leaves the signer, so only they could have produced a signature that their public key verifies. And because the signature covers a hash of the exact content, any tampering changes the hash and breaks verification.
What does a signature prove — and not prove?#
| Proves | Does not prove |
|---|---|
| The holder of the private key signed it | That the signer is who they claim (needs PKI) |
| The content is unchanged | That the content is true or safe |
| Non-repudiation of the signing act | Confidentiality — signing does not hide anything |
The gap in the right column is why signatures rely on public key infrastructure: a signature proves a key signed something, and PKI is what binds that key to a real identity.
Digital signatures deliver the authenticity and non-repudiation that the CIA triad alone does not name. Continue at the Security Fundamentals hub.
Frequently asked questions#
How does a digital signature work?
The signer hashes the message, then encrypts that hash with their private key — that encrypted hash is the signature. Anyone can verify it by decrypting the signature with the signer’s public key and comparing the result to a fresh hash of the message. A match proves both the signer’s identity and that the message is unchanged.
What is the difference between a digital signature and encryption?
Encryption hides content; a digital signature proves origin and integrity without hiding anything. In fact, signing uses the private key to sign and the public key to verify — the reverse of encrypting for confidentiality. A message can be signed and readable by all, or both signed and encrypted.