Cyber Security Digital Signatures and PKI

The Idea Behind a Digital Signature

To sign a message, the sender first hashes it to produce a fixed-length digest, then encrypts that digest using their own private key. This encrypted digest is the signature, and it gets sent along with the original message.

To verify it, the receiver independently hashes the message they actually received, then uses the sender's public key to decrypt the signature back into the original digest. If the two digests match, that proves two things at once: authenticity (only the holder of the private key could have produced a signature that decrypts correctly with the matching public key) and integrity (any change to the message, even a single character, would have produced a different hash and broken the match).

1. The sender hashes the message.
2. The sender encrypts that hash with their own private key — this encrypted hash is the signature.
3. The sender transmits the original message plus the signature.
4. The receiver independently hashes the message they received.
5. The receiver decrypts the signature using the sender's public key, recovering the original hash.
6. The receiver compares the two hashes — a match confirms the message is authentic and unaltered.

Why We Need a Certificate, Not Just a Public Key

A public key by itself proves nothing about who it belongs to — anyone can generate a fresh key pair and simply claim, 'this public key belongs to your bank.' A certificate solves this trust gap: it's a document that binds a specific public key to a verified identity (a domain name, a company, a person), and it is itself digitally signed by a trusted Certificate Authority (CA), so a certificate's validity can be checked the same way any other digital signature is checked.

Public Key Infrastructure (PKI)

• Certificate Authority (CA) — an organization trusted to verify identities and issue signed certificates.
• Registration Authority (RA) — handles verifying the requester's identity before a CA issues a certificate.
• Certificate (typically X.509 format) — the document binding a public key to a verified identity.
• Revocation mechanisms (CRL / OCSP) — ways to check whether a certificate has been revoked before its expiration date, e.g. because its private key was compromised.

Where You See This Every Day

The padlock icon in your browser means it validated the website's certificate chain, from the site's own certificate up through one or more intermediate CAs to a root CA it already trusts. The exact same signature-and-certificate pattern shows up in code-signing certificates that let a software publisher prove an installer hasn't been tampered with, and in S/MIME email signing, which lets a recipient verify a message really came from the claimed sender.