HashThat!

Digital Signatures

Picture this scenario. Your bank decides to send you your monthly bank account statement via e-mail. You check your inbox and there you find the statement in an attachment. How sure can you be that you are viewing the same document that the bank sent you and that it wasn’t modified by anyone while it made its way through cyber space around the world to your inbox? How do you tell that it had really come from your bank?

Meet Digital Signatures - A security measure used to verify the source of a document and to ensure that the document has not been tampered with, analogous to a person’s signature in real life.

If the bank had digitally signed your bank statement, you can be sure that it did come from them and that it was not tampered with.

How it works

A digital signature, being a type of public-key cryptography or asymmetric key cryptography uses a pair of mathematically related keys, called the public key and private key to encrypt and decrypt data. The document to be signed is first hashed into a unique message digest of a smaller and fixed size using any of the popular hashing algorithms like MD5, in order to enhance the efficiency of signing process. The private key of the person who is signing the document is then used to encrypt the message digest. A digital certificate containing the person’s public key, identifies that the public key indeed belongs to the signer. This certificate is provided by a certifying agency like VeriSign, Entrust and GeoTrust. This digital certificate The message digest and the digital certificate are together called the digital signature. The signature is embedded within the document and transmitted along it.

A digital certificate

At the receiving end, a fresh message digest of the document is generated using the same hashing algorithm that was used to sign it. Then, the encrypted message digest that is part of the digital signature is decrypted using the public key and the resulting message digest is compared with the one that was generated from the original document. If the digests match, we can conclude the following :

i. The message was not tampered with

A message digest is unique to a given text. Making even minor modifications to the text, wwill result in a different message digest. You can try this out yourself. Here’s a link to an applet we found, that computes the SHA1 or MD5 hash for a given text.

http://www.jensign.com/JavaScience/www/messagedigestj2/index.html

Suppose we hash the text: “This is some text and we are using it to demonstrate that small changes in the text will modify the resulting message digest.”

We get the MD5 hash as “5824A3D2AD810CC070FCA69F64B3E1F2”.

Now we modify the same text as “This is some text and we are using it to demonstrate that small changes in the text will modify the resulting message digest” (The full stop (period) at the end of the line has been removed).

We now get the MD5 has as “9B524A8370638AFF9962F3182A807680”, which is entirely different from the previous hash value. Notice how the change (of even removing one character) produces a different hash value.

ii. The identity of the sender is verified and is genuine

If this were not the case, the public key in the digital certificate would decrypt the message digest into something other than the actual message digest which would not match with the generated message digest.

Thus digital signatures are used to verify the identity and integrity of a document transmitted over the internet.

Relevance Today

• Relevance Today Home
• Politics and Defence
• Economy
• Communication
• Entertainment Industry
• Cryptographic Technologies
  • Encryption
  • Authentication
    • Hash Codes
    • Digital Signatures
  • Protocols
• Social and Privacy Issues
• Behind the Scenes