HOME

TheInfoList




A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the prerequisites are satisfied, gives a recipient very strong reason to believe that the message was created by a known sender (
authenticity Authenticity or authentic may refer to: * Authentication, the act of confirming the truth of an attribute Arts and entertainment * Authenticity in art, ways in which a work of art or an artistic performance may be considered authentic Music * Au ...
), and that the message was not altered in transit (
integrity Integrity is the practice of being honest and showing a consistent and uncompromising adherence to strong moral and ethical principles and values. In ethics Ethics or moral philosophy is a branch of philosophy Philosophy (from , ) is the ...
). Digital signatures are a standard element of most
cryptographic protocol A security protocol (cryptographic protocol or encryption protocol) is an abstract or concrete protocol that performs a security Security is freedom from, or resilience against, potential harm (or other unwanted Coercion, coercive change) caused b ...
suites, and are commonly used for software distribution, financial transactions,
contract management softwareContract management software is the range of computer programmes, libraries and data used to support contract management, contract lifecycle management, and contractor management on projects. It may be used with project management software. Advantag ...
, and in other cases where it is important to detect forgery or tampering. Digital signatures are often used to implement
electronic signature An electronic signature, or e-signature, is data that is logically associated with other data and which is used by the signature, signatory to sign the associated data. This type of signature has the same legal standing as a handwritten signature as ...
s, which includes any electronic data that carries the intent of a signature,US ESIGN Act of 2000
/ref> but not all electronic signatures use digital signatures.

Electronic signatures have legal significance in some countries, including
Canada Canada is a country in the northern part of . Its extend from the to the and northward into the , covering , making it the world's . Its southern and western , stretching , is the world's longest bi-national land border. Canada's capital ...

Canada
,
South Africa South Africa, officially the Republic of South Africa (RSA), is the southernmost country in Africa. With over 60 million people, it is the world's 23rd-most populous nation and covers an area of . South Africa has three capital cities ...

South Africa
, the
United States The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country in . It consists of 50 , a , five major , 326 , and some . At , it is the world's . The United States shares significan ...

United States
,
Algeria ) , image_map = Algeria (centered orthographic projection).svg , map_caption = , image_map2 = , capital = Algiers Algiers ( ; ar, الجزائر; Berber language, Berber: ''Dzayer;'' French language, French'': Alger'') is ...

Algeria
,
Turkey Turkey ( tr, Türkiye ), officially the Republic of Turkey, is a country located mainly on Anatolia in Western Asia, with a small portion on the Balkans in Southeast Europe. It shares borders with Greece and Bulgaria to the northwest; the ...

Turkey
,
India India, officially the Republic of India (: ), is a country in . It is the by area, the country, and the most populous in the world. Bounded by the on the south, the on the southwest, and the on the southeast, it shares land borders wit ...

India
,
Brazil Brazil ( pt, Brasil; ), officially the Federative Republic of Brazil (Portuguese: ), is the largest country in both and . At 8.5 million square kilometers (3.2 million square miles) and with over 211 million people, Brazil is the ...

Brazil
,
Indonesia Indonesia ( ), officially the Republic of Indonesia ( id, Republik Indonesia, links=yes ), is a country in Southeast Asia and Oceania between the Indian Ocean, Indian and Pacific Ocean, Pacific oceans. It consists of over List of islands of I ...

Indonesia
,
Mexico Mexico ( es, México ; Nahuan languages: ), officially the United Mexican States (; EUM ), is a List of sovereign states, country in the southern portion of North America. It is borders of Mexico, bordered to the north by the United States; ...

Mexico
,
Saudi Arabia (''Shahada The ''Shahada'' ( ar, ٱلشَّهَادَةُ ' , "the testimony"), also spelled Shahadah, is an Islamic oath, one of the Five Pillars of Islam and part of the Adhan. It reads: "I bear witness that none deserves worship e ...

Saudi Arabia
,
Uruguay Uruguay (; ; pt, Uruguai), officially the Oriental Republic of Uruguay ( es, República Oriental del Uruguay), is a country in South America South America is a continent entirely in the Western Hemisphere and mostly in the Southern He ...

Uruguay
,
Switzerland ,german: Schweizer(in),french: Suisse(sse), it, svizzero/svizzera or , rm, Svizzer/Svizra , government_type = Federalism, Federal semi-direct democracy under a multi-party assembly-independent Directorial system, directorial republic , leader_t ...

Switzerland
,
Chile Chile, officially the Republic of Chile, is a country in the western part of South America South America is a continent A continent is one of several large landmasses. Generally identified by convention (norm), convention ra ...

Chile
and the countries of the
European Union The European Union (EU) is a political and economic union of that are located primarily in . The union has a total area of and an estimated total population of about 447million. has been established through a standardised that apply in ...

European Union
. Digital signatures employ
asymmetric cryptography 250px, In this example the message is digitally signed, but not encrypted. 1) Alice signs a message with her private key. 2) Bob can verify that Alice sent the message and that the message has not been modified. Public-key cryptography, or ...
. In many instances, they provide a layer of validation and security to messages sent through a non-secure channel: Properly implemented, a digital signature gives the receiver reason to believe the message was sent by the claimed sender. Digital signatures are equivalent to traditional handwritten signatures in many respects, but properly implemented digital signatures are more difficult to forge than the handwritten type. Digital signature schemes, in the sense used here, are cryptographically based, and must be implemented properly to be effective. They can also provide
non-repudiationNon-repudiation refers to a situation where a statement's author cannot successfully dispute its authorship or the validity of an associated contract A contract is a legally binding document between at least two parties that defines and governs th ...
, meaning that the signer cannot successfully claim they did not sign a message, while also claiming his
private key 250px, In this example the message is digitally signed, but not encrypted. 1) Alice signs a message with her private key. 2) Bob can verify that Alice sent the message and that the message has not been modified. Public-key cryptography, or ...
remains secret. Further, some non-repudiation schemes offer a timestamp for the digital signature, so that even if the private key is exposed, the signature is valid. Digitally signed messages may be anything representable as a
bitstring A bit array (also known as bit map, bit set, bit string, or bit vector) is an array data structure ARRAY, also known as ARRAY Now, is an independent distribution company launched by film maker and former publicist Ava DuVernay in 2010 under the ...
: examples include electronic mail, contracts, or a message sent via some other cryptographic protocol.


Definition

A digital signature scheme typically consists of three algorithms; * A ''
key generation Key generation is the process of generating keys KEYS (1440 AM broadcasting, AM) is a radio station serving the Corpus Christi, Texas, Corpus Christi, Texas area with a talk radio, talk format. It broadcasts on AM broadcasting, AM frequency 1440&nbs ...
'' algorithm that selects a ''private key'' uniformly at random from a set of possible private keys. The algorithm outputs the private key and a corresponding ''public key''. * A ''signing'' algorithm that, given a message and a private key, produces a signature. * A ''signature verifying'' algorithm that, given the message, public key and signature, either accepts or rejects the message's claim to authenticity. Two main properties are required. First, the authenticity of a signature generated from a fixed message and fixed private key can be verified by using the corresponding public key. Secondly, it should be computationally infeasible to generate a valid signature for a party without knowing that party's private key. A digital signature is an authentication mechanism that enables the creator of the message to attach a code that acts as a signature. The
Digital Signature AlgorithmThe Digital Signature Algorithm (DSA) is a Federal Information Processing Standard The United States' Federal Information Processing Standards (FIPS) are publicly announced standardization, standards developed by the National Institute of Standards ...
(DSA), developed by the
National Institute of Standards and Technology The National Institute of Standards and Technology (NIST) is a physical sciences Physical science is a branch of natural science that studies abiotic component, non-living systems, in contrast to life science. It in turn has many branches, e ...
, is one of many examples of a signing algorithm. In the following discussion, 1''n'' refers to a unary number. Formally, a digital signature scheme is a triple of probabilistic polynomial time algorithms, (''G'', ''S'', ''V''), satisfying: * ''G'' (key-generator) generates a public key (''pk''), and a corresponding private key (''sk''), on input 1''n'', where ''n'' is the security parameter. * ''S'' (signing) returns a tag, ''t'', on the inputs: the private key (''sk''), and a string (''x''). * ''V'' (verifying) outputs ''accepted'' or ''rejected'' on the inputs: the public key (''pk''), a string (''x''), and a tag (''t''). For correctness, ''S'' and ''V'' must satisfy : Pr (''pk'', ''sk'') ← ''G''(1''n''), ''V''( ''pk'', ''x'', ''S''(''sk'', ''x'') ) = ''accepted'' = 1.Pass, def 135.1 A digital signature scheme is secure if for every non-uniform probabilistic polynomial time
adversary An adversary is generally considered to be a person, group, or force that opposes and/or strike (attack), attacks. Adversary may also refer to: * Satan ("adversary" in Hebrew), in Judeo-Christian religion Entertainment Fiction * Adversary (comic ...
, ''A'' : Pr (''pk'', ''sk'') ← ''G''(1''n''), (''x'', ''t'') ← ''A''''S''(''sk'', · )(''pk'', 1''n''), ''x'' ∉ ''Q'', ''V''(''pk'', ''x'', ''t'') = ''accepted''< negl(''n''), where ''A''''S''(''sk'', · ) denotes that ''A'' has access to the
oracle An oracle is a person or agency Agency may refer to: * a governmental or other institution Institutions, according to Samuel P. Huntington, are "stable, valued, recurring patterns of behavior". Institutions can refer to mechanisms which go ...
, ''S''(''sk'', · ), ''Q'' denotes the set of the queries on ''S'' made by ''A'', which knows the public key, ''pk'', and the security parameter, ''n'', and ''x'' ∉ ''Q'' denotes that the adversary may not directly query the string, ''x'', on ''S''.Goldreich's FoC, vol. 2, def 6.1.2. Pass, def 135.2


History

In 1976,
Whitfield Diffie Bailey Whitfield 'Whit' Diffie (born June 5, 1944), ForMemRS, is an American cryptographer Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logia ''-logy'' is a suffix ...

Whitfield Diffie
and
Martin Hellman Martin Edward Hellman (born October 2, 1945) is an American cryptologist, best known for his invention of public key cryptography File:Private key signing.svg, 250px, In this example the message is digital signature, digitally signed, but n ...
first described the notion of a digital signature scheme, although they only conjectured that such schemes existed based on functions that are trapdoor one-way permutations."New Directions in Cryptography", IEEE Transactions on Information Theory, IT-22(6):644–654, Nov. 1976.Signature Schemes and Applications to Cryptographic Protocol Design
, Anna Lysyanskaya, PhD thesis,
MIT Massachusetts Institute of Technology (MIT) is a private land-grant research university A research university is a university A university ( la, universitas, 'a whole') is an educational institution, institution of higher education, hi ...
, 2002.
Soon afterwards,
Ronald Rivest Ronald Linn Rivest (; born May 6, 1947) is a cryptography, cryptographer and an List of Institute Professors at the Massachusetts Institute of Technology, Institute Professor at Massachusetts Institute of Technology, MIT. He is a member of MIT' ...
,
Adi Shamir Adi Shamir ( he, עדי שמיר; born July 6, 1952) is an i . He is a co-inventor of the (RSA) (along with and ), a co-inventor of the (along with and ), one of the inventors of and has made numerous contributions to the fields of and . E ...
, and
Len Adleman Leonard Adleman (born December 31, 1945) is an American computer scientist. He is one of the creators of the RSA encryption algorithm, for which he received the 2002 Turing Award The ACM A. M. Turing Award is an annual prize given by the Ass ...
invented the RSA algorithm, which could be used to produce primitive digital signatures (although only as a proof-of-concept – "plain" RSA signatures are not secureFor example any integer, ''r'', "signs" ''m''=''r''''e'' and the product, ''s''1''s''2, of any two valid signatures, ''s''1, ''s''2 of ''m''1, ''m''2 is a valid signature of the product, ''m''1''m''2.). The first widely marketed software package to offer digital signature was
Lotus Notes HCL Notes (formerly IBM Notes and Lotus Notes; see #Branding, Branding below) and HCL Domino (formerly IBM Domino and Lotus Domino) are the client–server, client and client-server architecture, server, respectively, of a collaborative software, ...
1.0, released in 1989, which used the RSA algorithm. Other digital signature schemes were soon developed after RSA, the earliest being
Lamport signatureIn cryptography, a Lamport signature or Lamport one-time signature scheme is a method for constructing a digital signature. Lamport signatures can be built from any cryptographically secure one-way function; usually a cryptographic hash function is u ...
s,"Constructing digital signatures from a one-way function.",
Leslie Lamport Leslie B. Lamport (born February 7, 1941) is an American computer scientist A computer scientist is a person A person (plural people or persons) is a being that has certain capacities or attributes such as reason, morality, consciousness or ...

Leslie Lamport
, Technical Report CSL-98, SRI International, Oct. 1979.
Merkle signatures (also known as "Merkle trees" or simply "Hash trees"),"A certified digital signature", Ralph Merkle, In Gilles Brassard, ed., Advances in Cryptology –
CRYPTO Crypto or Krypto may refer to: Cryptography and cryptanalysis * Cryptography, the practice and study of hiding information * Cryptanalysis, the study of methods for obtaining the meaning of encrypted information * CRYPTO (conference), an annual ...
'89, vol. 435 of Lecture Notes in Computer Science, pp. 218–238, Spring Verlag, 1990.
and Rabin signatures."Digitalized signatures as intractable as factorization."
Michael O. Rabin Michael Oser Rabin ( he, מִיכָאֵל עוזר רַבִּין; born September 1, 1931) is an Israeli mathematician A mathematician is someone who uses an extensive knowledge of mathematics Mathematics (from Ancient Greek, Greek: ) inc ...
, Technical Report MIT/LCS/TR-212, MIT Laboratory for Computer Science, Jan. 1979
In 1988,
Shafi Goldwasser en, Shafrira Goldwasser , name = Shafi Goldwasser , image = Shafi Goldwasser.JPG , caption = Shafi Goldwasser in 2010 , birth_date = , birth_place = New York City, New York (state), New York, U.S. , death_date = , death_place = , nation ...

Shafi Goldwasser
,
Silvio Micali Silvio Micali (born October 13, 1954) is an Palermo, Italian computer scientist at MIT Computer Science and Artificial Intelligence Laboratory and a professor of computer science in Massachusetts Institute of Technology, MIT's Department of Elect ...

Silvio Micali
, and
Ronald Rivest Ronald Linn Rivest (; born May 6, 1947) is a cryptography, cryptographer and an List of Institute Professors at the Massachusetts Institute of Technology, Institute Professor at Massachusetts Institute of Technology, MIT. He is a member of MIT' ...
became the first to rigorously define the security requirements of digital signature schemes."A digital signature scheme secure against adaptive chosen-message attacks.", Shafi Goldwasser, Silvio Micali, and Ronald Rivest. SIAM Journal on Computing, 17(2):281–308, Apr. 1988. They described a hierarchy of attack models for signature schemes, and also presented the GMR signature scheme, the first that could be proved to prevent even an existential forgery against a chosen message attack, which is the currently accepted security definition for signature schemes. The first such scheme which is not built on trapdoor functions but rather on a family of function with a much weaker required property of one-way permutation was presented by
Moni Naor Moni Naor ( he, מוני נאור) is an Israeli computer scientist, currently a professor at the Weizmann Institute of Science. Naor received his Ph.D. in 1989 at the University of California, Berkeley The University of California, Berk ...
and
Moti Yung Mordechai M. "Moti" Yung is a cryptographer and computer scientist A computer scientist is a person A person (plural people or persons) is a being that has certain capacities or attributes such as reason, morality, consciousness or self-cons ...
.Moni Naor, Moti Yung: Universal One-Way Hash Functions and their Cryptographic Applications. STOC 1989: 33–43


Method

One digital signature scheme (of many) is based on RSA. To create signature keys, generate an RSA key pair containing a modulus, ''N'', that is the product of two random secret distinct large primes, along with integers, ''e'' and ''d'', such that ''e'' ''d''   1 (mod ''φ''(''N'')), where ''φ'' is the
Euler's totient function The first thousand values of . The points on the top line represent when is a prime number, which is In number theory, Euler's totient function counts the positive integers up to a given integer that are relatively prime to . It is written ...
. The signer's public key consists of ''N'' and ''e'', and the signer's secret key contains ''d''. To sign a message, ''m'', the signer computes a signature, ''σ'', such that ''σ'' ≡  ''m''''d'' (mod ''N''). To verify, the receiver checks that ''σ''''e'' ≡ ''m'' (mod ''N''). Several early signature schemes were of a similar type: they involve the use of a
trapdoor permutation A trapdoor function is a function that is easy to compute in one direction, yet difficult to compute in the opposite direction (finding its inverse) without special information, called the "trapdoor". Trapdoor functions are widely used in cryp ...

trapdoor permutation
, such as the RSA function, or in the case of the Rabin signature scheme, computing square modulo composite, ''N''. A trapdoor permutation family is a family of
permutation In , a permutation of a is, loosely speaking, an arrangement of its members into a or , or if the set is already ordered, a rearrangement of its elements. The word "permutation" also refers to the act or process of changing the linear order o ...

permutation
s, specified by a parameter, that is easy to compute in the forward direction, but is difficult to compute in the reverse direction without already knowing the private key ("trapdoor"). Trapdoor permutations can be used for digital signature schemes, where computing the reverse direction with the secret key is required for signing, and computing the forward direction is used to verify signatures. Used directly, this type of signature scheme is vulnerable to key-only existential forgery attack. To create a forgery, the attacker picks a random signature σ and uses the verification procedure to determine the message, ''m'', corresponding to that signature."Modern Cryptography: Theory & Practice", Wenbo Mao, Prentice Hall Professional Technical Reference, New Jersey, 2004, pg. 308. In practice, however, this type of signature is not used directly, but rather, the message to be signed is first hashed to produce a short digest, that is then padded to larger width comparable to ''N'', then signed with the reverse trapdoor function.Handbook of Applied Cryptography by Alfred J. Menezes, Paul C. van Oorschot, Scott A. Vanstone. Fifth Printing (August 2001) page 445. This forgery attack, then, only produces the padded hash function output that corresponds to σ, but not a message that leads to that value, which does not lead to an attack. In the random oracle model, hash-then-sign (an idealized version of that practice where hash and padding combined have close to ''N'' possible outputs), this form of signature is existentially unforgeable, even against a
chosen-plaintext attack A chosen-plaintext attack (CPA) is an attack model for cryptanalysis which presumes that the attacker can obtain the ciphertexts for arbitrary plaintexts.Ross Anderson, ''Security Engineering: A Guide to Building Dependable Distributed Systems''. T ...

chosen-plaintext attack
. There are several reasons to sign such a hash (or message digest) instead of the whole document. ;For efficiency: The signature will be much shorter and thus save time since hashing is generally much faster than signing in practice. ;For compatibility: Messages are typically bit strings, but some signature schemes operate on other domains (such as, in the case of RSA, numbers modulo a composite number ''N''). A hash function can be used to convert an arbitrary input into the proper format. ;For integrity: Without the hash function, the text "to be signed" may have to be split (separated) in blocks small enough for the signature scheme to act on them directly. However, the receiver of the signed blocks is not able to recognize if all the blocks are present and in the appropriate order.


Notions of security

In their foundational paper, Goldwasser, Micali, and Rivest lay out a hierarchy of attack models against digital signatures: # In a ''key-only'' attack, the attacker is only given the public verification key. # In a ''known message'' attack, the attacker is given valid signatures for a variety of messages known by the attacker but not chosen by the attacker. # In an ''adaptive chosen message'' attack, the attacker first learns signatures on arbitrary messages of the attacker's choice. They also describe a hierarchy of attack results: # A ''total break'' results in the recovery of the signing key. # A universal forgery attack results in the ability to forge signatures for any message. # A selective forgery attack results in a signature on a message of the adversary's choice. # An
existential forgeryIn a cryptographic Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or '' -logia'', "study", respectively), is the practice and study of techniques for secure communication in the ...
merely results in some valid message/signature pair not already known to the adversary. The strongest notion of security, therefore, is security against existential forgery under an adaptive chosen message attack.


Applications

As organizations move away from paper documents with ink signatures or authenticity stamps, digital signatures can provide added assurances of the evidence to provenance, identity, and status of an
electronic document An electronic document is any electronic media content (other than computer program In imperative programming In computer science, imperative programming is a programming paradigm that uses Statement (computer science), statements that change a ...
as well as acknowledging informed consent and approval by a signatory. The United States Government Printing Office (GPO) publishes electronic versions of the budget, public and private laws, and congressional bills with digital signatures. Universities including Penn State,
University of Chicago The University of Chicago (UChicago) is a private university, private research university in Chicago, Illinois. Founded in 1890, its main campus is located in Chicago's Hyde Park, Chicago, Hyde Park neighborhood. In Fall 2021, it enrolled 18,45 ...
, and Stanford are publishing electronic student transcripts with digital signatures. Below are some common reasons for applying a digital signature to communications:


Authentication

Although messages may often include information about the entity sending a message, that information may not be accurate. Digital signatures can be used to authenticate the identity of the source messages. When ownership of a digital signature secret key is bound to a specific user, a valid signature shows that the message was sent by that user. The importance of high confidence in sender authenticity is especially obvious in a financial context. For example, suppose a bank's branch office sends instructions to the central office requesting a change in the balance of an account. If the central office is not convinced that such a message is truly sent from an authorized source, acting on such a request could be a grave mistake.


Integrity

In many scenarios, the sender and receiver of a message may have a need for confidence that the message has not been altered during transmission. Although encryption hides the contents of a message, it may be possible to an encrypted message without understanding it. (Some encryption algorithms, called nonmalleable, prevent this, but others do not.) However, if a message is digitally signed, any change in the message after signature invalidates the signature. Furthermore, there is no efficient way to modify a message and its signature to produce a new message with a valid signature, because this is still considered to be computationally infeasible by most cryptographic hash functions (see
collision resistance In cryptography, collision resistance is a property of cryptographic hash functions: a hash function ''H'' is collision-resistant if it is hard to find two inputs that hash to the same output; that is, two inputs ''a'' and ''b'' where ''a'' ≠ ''b ...
).


Non-repudiation

Non-repudiationNon-repudiation refers to a situation where a statement's author cannot successfully dispute its authorship or the validity of an associated contract A contract is a legally binding document between at least two parties that defines and governs th ...
, or more specifically non-repudiation of origin, is an important aspect of digital signatures. By this property, an entity that has signed some information cannot at a later time deny having signed it. Similarly, access to the public key only does not enable a fraudulent party to fake a valid signature. Note that these authentication, non-repudiation etc. properties rely on the secret key prior to its usage. Public revocation of a key-pair is a required ability, else leaked secret keys would continue to implicate the claimed owner of the key-pair. Checking revocation status requires an "online" check; e.g., checking a
certificate revocation list In cryptography Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logy, -logia'', "study", respectively), is the practice and study of techniques for secure communication in t ...
or via the
Online Certificate Status Protocol The Online Certificate Status Protocol (OCSP) is an Internet The Internet (Capitalization of Internet, or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate be ...
. Very roughly this is analogous to a vendor who receives credit-cards first checking online with the credit-card issuer to find if a given card has been reported lost or stolen. Of course, with stolen key pairs, the theft is often discovered only after the secret key's use, e.g., to sign a bogus certificate for espionage purpose.


Additional security precautions


Putting the private key on a smart card

All public key / private key cryptosystems depend entirely on keeping the private key secret. A private key can be stored on a user's computer, and protected by a local password, but this has two disadvantages: * the user can only sign documents on that particular computer * the security of the private key depends entirely on the
security Security is freedom from, or resilience against, potential Potential generally refers to a currently unrealized ability. The term is used in a wide variety of fields, from physics Physics is the natural science that studies matter, its El ...
of the computer A more secure alternative is to store the private key on a
smart card A smart card, chip card, or integrated circuit card (ICC or IC card) is a physical electronic authorization device, used to control access to a resource. It is typically a plastic credit card #REDIRECT Credit card A credit card is a paym ...
. Many smart cards are designed to be tamper-resistant (although some designs have been broken, notably by Ross Anderson and his students). In a typical digital signature implementation, the hash calculated from the document is sent to the smart card, whose CPU signs the hash using the stored private key of the user, and then returns the signed hash. Typically, a user must activate his smart card by entering a
personal identification number A personal identification number (PIN), or sometimes redundantly a PIN number or PIN code, is a numeric (sometimes alpha-numeric Alphanumericals are a combination of alphabetical and wiktionary:numerical, numerical Character (symbol), charact ...
or PIN code (thus providing
two-factor authentication Multi-factor authentication (MFA; encompassing Two-factor authentication or 2FA, along with similar terms) is an electronic authentication method in which a device user is granted access to a website or application only after successfully pres ...
). It can be arranged that the private key never leaves the smart card, although this is not always implemented. If the smart card is stolen, the thief will still need the PIN code to generate a digital signature. This reduces the security of the scheme to that of the PIN system, although it still requires an attacker to possess the card. A mitigating factor is that private keys, if generated and stored on smart cards, are usually regarded as difficult to copy, and are assumed to exist in exactly one copy. Thus, the loss of the smart card may be detected by the owner and the corresponding certificate can be immediately revoked. Private keys that are protected by software only may be easier to copy, and such compromises are far more difficult to detect.


Using smart card readers with a separate keyboard

Entering a PIN code to activate the smart card commonly requires a
numeric keypad A numeric keypad, number pad, numpad, or ten key, is the palm-sized, usually-17-key section of a standard computer keyboard A computer keyboard is a peripheral A peripheral or peripheral device is an auxiliary device used to put info ...

numeric keypad
. Some card readers have their own numeric keypad. This is safer than using a card reader integrated into a PC, and then entering the PIN using that computer's keyboard. Readers with a numeric keypad are meant to circumvent the eavesdropping threat where the computer might be running a keystroke logger, potentially compromising the PIN code. Specialized card readers are also less vulnerable to tampering with their software or hardware and are often EAL3 certified.


Other smart card designs

Smart card design is an active field, and there are smart card schemes which are intended to avoid these particular problems, despite having few security proofs so far.


Using digital signatures only with trusted applications

One of the main differences between a digital signature and a written signature is that the user does not "see" what they sign. The user application presents a hash code to be signed by the digital signing algorithm using the private key. An attacker who gains control of the user's PC can possibly replace the user application with a foreign substitute, in effect replacing the user's own communications with those of the attacker. This could allow a malicious application to trick a user into signing any document by displaying the user's original on-screen, but presenting the attacker's own documents to the signing application. To protect against this scenario, an authentication system can be set up between the user's application (word processor, email client, etc.) and the signing application. The general idea is to provide some means for both the user application and signing application to verify each other's integrity. For example, the signing application may require all requests to come from digitally signed binaries.


Using a network attached hardware security module

One of the main differences between a
cloud In meteorology, a cloud is an aerosol consisting of a visible mass of minute liquid drop (liquid), droplets, ice crystals, frozen crystals, or other particulates, particles suspended in the atmosphere of a planetary body or similar space. Wate ...

cloud
based digital signature service and a locally provided one is risk. Many risk averse companies, including governments, financial and medical institutions, and payment processors require more secure standards, like
FIPS 140-2 The Federal Information Processing Standard Publication 140-2, (FIPS PUB 140-2), is a U.S. government computer security standardization, standard used to approve cryptography, cryptographic modules. The title is ''Security Requirements for Crypt ...
level 3 and FIPS 201 certification, to ensure the signature is validated and secure.


WYSIWYS

Technically speaking, a digital signature applies to a string of bits, whereas humans and applications "believe" that they sign the semantic interpretation of those bits. In order to be semantically interpreted, the bit string must be transformed into a form that is meaningful for humans and applications, and this is done through a combination of hardware and software based processes on a computer system. The problem is that the semantic interpretation of bits can change as a function of the processes used to transform the bits into semantic content. It is relatively easy to change the interpretation of a digital document by implementing changes on the computer system where the document is being processed. From a semantic perspective this creates uncertainty about what exactly has been signed. WYSIWYS (What You See Is What You Sign) means that the semantic interpretation of a signed message cannot be changed. In particular this also means that a message cannot contain hidden information that the signer is unaware of, and that can be revealed after the signature has been applied. WYSIWYS is a requirement for the validity of digital signatures, but this requirement is difficult to guarantee because of the increasing complexity of modern computer systems. The term WYSIWYS was coined by and Torben Pedersen to describe some of the principles in delivering secure and legally binding digital signatures for Pan-European projects.


Digital signatures versus ink on paper signatures

An ink signature could be replicated from one document to another by copying the image manually or digitally, but to have credible signature copies that can resist some scrutiny is a significant manual or technical skill, and to produce ink signature copies that resist professional scrutiny is very difficult. Digital signatures cryptographically bind an electronic identity to an electronic document and the digital signature cannot be copied to another document. Paper contracts sometimes have the ink signature block on the last page, and the previous pages may be replaced after a signature is applied. Digital signatures can be applied to an entire document, such that the digital signature on the last page will indicate tampering if any data on any of the pages have been altered, but this can also be achieved by signing with ink and numbering all pages of the contract.


Some digital signature algorithms

* RSA *
DSADSA may refer to: Education * DeKalb School of the Arts, a grades 8–12 public school in DeKalb County, Georgia, US * Denver School of the Arts, a grades 6–12 public school in Denver, Colorado, US * Detroit School of Arts, Michigan, US * ''D ...
*
ECDSA In cryptography, the Elliptic Curve Digital Signature Algorithm (ECDSA) offers a variant of the Digital Signature Algorithm (DSA) which uses elliptic curve cryptography. Key and signature-size As with elliptic-curve cryptography in general, the bit ...
*
EdDSA In public-key cryptography 250px, In this example the message is digitally signed, but not encrypted. 1) Alice signs a message with her private key. 2) Bob can verify that Alice sent the message and that the message has not been modified. ...
* RSA with
SHA Sha or SHA may refer to: Places * Sha County, Fujian, China * Shanghai Hongqiao International Airport, IATA code * Sia, Cyprus, also spelled ''Sha'' * Sagamihara Housing Area, an army installation in Japan * Vehicle registration plates in the d ...
* ECDSA with SHARFC 5758 *
ElGamal signature schemeThe ElGamal signature scheme is a digital signature A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the prerequisites are satisfied, gives a recipient v ...
as the predecessor to DSA, and variants
Schnorr signature In cryptography, a Schnorr signature is a digital signature produced by the Schnorr signature algorithm that was described by Claus P. Schnorr, Claus Schnorr. It is a digital signature scheme known for its simplicity, among the first whose security ...
and Pointcheval–Stern signature algorithm * Rabin signature algorithm *
Pairing In mathematics, a pairing is an ''R''-Bilinear map#Modules, bilinear map from the Cartesian product of two ''R''-Module (mathematics), modules, where the underlying Ring (mathematics), ring ''R'' is Commutative ring, commutative. Definition Let ''R ...

Pairing
-based schemes such as BLS * NTRUSign is an example of a digital signature scheme based on hard lattice problems *
Undeniable signatureAn undeniable signature is a digital signature scheme which allows the signer to be selective to whom they allow to verify signatures. The scheme adds explicit signature repudiation, preventing a signer later refusing to verify a signature by omissio ...
s * – a signature scheme that supports aggregation: Given n signatures on n messages from n users, it is possible to aggregate all these signatures into a single signature whose size is constant in the number of users. This single signature will convince the verifier that the n users did indeed sign the n original messages. A scheme by
Mihir Bellare Mihir Bellare is a cryptographer and professor at the University of California San Diego. He has published several seminal papers in the field of cryptography Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; a ...
and Gregory Neven may be used with
Bitcoin Bitcoin (₿) is a cryptocurrency A cryptocurrency, crypto-currency, or crypto is a collection of binary data which is designed to work as a medium of exchange. Individual coin ownership records are stored in a ledger, which is a compu ...

Bitcoin
. * Signatures with efficient protocols – are signature schemes that facilitate efficient cryptographic protocols such as
zero-knowledge proofs In cryptography, a zero-knowledge proof or zero-knowledge protocol is a method by which one party (the prover) can prove to another party (the verifier) that they know a value , without conveying any information apart from the fact that they know t ...
or secure computation.


The current state of use – legal and practical

Most digital signature schemes share the following goals regardless of cryptographic theory or legal provision: # Quality algorithms: Some public-key algorithms are known to be insecure, as practical attacks against them having been discovered. # # Quality implementations: An implementation of a good algorithm (or
protocol Protocol may refer to: Sociology and politics * Protocol (politics) Protocol originally (in Late Middle English, c. 15th century) meant the minutes or logbook taken at a meeting, upon which an agreement was based. The term now commonly refers to a ...
) with mistake(s) will not work. # # Users (and their software) must carry out the signature protocol properly. # # The private key must remain private: If the private key becomes known to any other party, that party can produce ''perfect'' digital signatures of anything. # # The public key owner must be verifiable: A public key associated with Bob actually came from Bob. This is commonly done using a
public key infrastructure A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificate In cryptography Cryptography, or cryptology (from grc, , tr ...
(PKI) and the public key↔user association is attested by the operator of the PKI (called a
certificate authority In cryptography Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logia ''-logy'' is a suffix In linguistics Linguistics is the science, scientific study of lang ...
). For 'open' PKIs in which anyone can request such an attestation (universally embodied in a cryptographically protected
public key certificate In cryptography Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logia ''-logy'' is a suffix In linguistics Linguistics is the science, scientific study of la ...
), the possibility of mistaken attestation is non-trivial. Commercial PKI operators have suffered several publicly known problems. Such mistakes could lead to falsely signed, and thus wrongly attributed, documents. 'Closed' PKI systems are more expensive, but less easily subverted in this way. Only if all of these conditions are met will a digital signature actually be any evidence of who sent the message, and therefore of their assent to its contents. Legal enactment cannot change this reality of the existing engineering possibilities, though some such have not reflected this actuality. Legislatures, being importuned by businesses expecting to profit from operating a PKI, or by the technological avant-garde advocating new solutions to old problems, have enacted statutes and/or regulations in many jurisdictions authorizing, endorsing, encouraging, or permitting digital signatures and providing for (or limiting) their legal effect. The first appears to have been in
Utah Utah ( , ) is a U.S. state, state in the Mountain states, Mountain West subregion of the Western United States. Utah is a landlocked U.S. state bordered to its east by Colorado, to its northeast by Wyoming, to its north by Idaho, to its so ...

Utah
in the United States, followed closely by the states
Massachusetts Massachusetts (, ), officially the Commonwealth of Massachusetts, is the most populous state State may refer to: Arts, entertainment, and media Literature * ''State Magazine'', a monthly magazine published by the U.S. Department of State * T ...

Massachusetts
and
California California is a U.S. state, state in the Western United States. With over 39.3million residents across a total area of approximately , it is the List of states and territories of the United States by population, most populous and the List of ...

California
. Other countries have also passed statutes or issued regulations in this area as well and the UN has had an active model law project for some time. These enactments (or proposed enactments) vary from place to place, have typically embodied expectations at variance (optimistically or pessimistically) with the state of the underlying cryptographic engineering, and have had the net effect of confusing potential users and specifiers, nearly all of whom are not cryptographically knowledgeable. Adoption of technical standards for digital signatures have lagged behind much of the legislation, delaying a more or less unified engineering position on
interoperability Interoperability is a characteristic of a product or system, whose interfaces are completely understood, to work with other products or systems, at present or in the future, in either implementation or access, without any restrictions. While the ...

interoperability
,
algorithm In and , an algorithm () is a finite sequence of , computer-implementable instructions, typically to solve a class of problems or to perform a computation. Algorithms are always and are used as specifications for performing s, , , and other ...

algorithm
choice,
key length In cryptography Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logia ''-logy'' is a suffix in the English language, used with words originally adapted from Ancient Greek ...
s, and so on what the engineering is attempting to provide.


Industry standards

Some industries have established common interoperability standards for the use of digital signatures between members of the industry and with regulators. These include the
Automotive Network ExchangeThe Automotive Network Exchange (ANX), a large private extranet that connects automotive suppliers to automotive manufacturers. Founded in 1995 by Automotive Industry Action Group (a consortium of major US auto companies), ANX since 1999 has been own ...
for the automobile industry and the SAFE-BioPharma Association for the
healthcare industry The healthcare industry (also called the medical industry or health economy) is an aggregation and integration of sectors within the economic system An economic system, or economic order, is a system A system is a group of interacting I ...
.


Using separate key pairs for signing and encryption

In several countries, a digital signature has a status somewhat like that of a traditional pen and paper signature, as in the 1999 EU digital signature directive and 2014 EU follow-on legislation. Generally, these provisions mean that anything digitally signed legally binds the signer of the document to the terms therein. For that reason, it is often thought best to use separate key pairs for encrypting and signing. Using the encryption key pair, a person can engage in an encrypted conversation (e.g., regarding a real estate transaction), but the encryption does not legally sign every message he or she sends. Only when both parties come to an agreement do they sign a contract with their signing keys, and only then are they legally bound by the terms of a specific document. After signing, the document can be sent over the encrypted link. If a signing key is lost or compromised, it can be revoked to mitigate any future transactions. If an encryption key is lost, a backup or
key escrow Key escrow (also known as a "fair" cryptosystem) is an arrangement in which the keys KEYS (1440 AM broadcasting, AM) is a radio station serving the Corpus Christi, Texas, Corpus Christi, Texas area with a talk radio, talk format. It broadcasts on ...
should be utilized to continue viewing encrypted content. Signing keys should never be backed up or escrowed unless the backup destination is securely encrypted.


See also

* 21 CFR 11 *
X.509 In cryptography Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logy, -logia'', "study", respectively), is the practice and study of techniques for secure communication in ...
*
Advanced electronic signature An advanced electronic signature (AdES) is an electronic signature that has met the requirements set forth under Regulation (European Union), EU Regulation No 910/2014 (eIDAS-regulation) on electronic identification and trust services for electronic ...
*
Blind signatureIn cryptography a blind signature, as introduced by David Chaum, is a form of digital signature in which the content of a message is disguised (blinding (cryptography), blinded) before it is signed. The resulting blind signature can be publicly verif ...
* Detached signature *
Digital certificate In cryptography Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logy, -logia'', "study", respectively), is the practice and study of techniques for secure communication in ...
*
Digital signature in EstoniaElectronic signature allows users to electronically perform the actions for which they previously had to give a signature on paper. Estonia's digital signature system is the foundation for some of its most popular e-services including registering a c ...
*
Electronic lab notebookAn electronic lab notebook (also known as electronic laboratory notebook, or ELN) is a computer program designed to replace paper lab notebook, laboratory notebooks. Lab notebooks in general are used by scientists, engineers, and technicians to docu ...
*
Electronic signature An electronic signature, or e-signature, is data that is logically associated with other data and which is used by the signature, signatory to sign the associated data. This type of signature has the same legal standing as a handwritten signature as ...
* Electronic signatures and law *
eSign (India)'Aadhaar eSign'' is an online electronic signature An electronic signature, or e-signature, refers to data in electronic form, which is logically associated with other data in electronic form and which is used by the signature, signatory to sign. Thi ...
*
GNU Privacy Guard GNU Privacy Guard (GnuPG or GPG) is a free-software Free software (or libre software) is computer software Software is a collection of Instruction (computer science), instructions and data (computing), data that tell a computer how to wo ...
*
Public key infrastructure A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificate In cryptography Cryptography, or cryptology (from grc, , tr ...
*
Public key fingerprint In public-key cryptography 250px, In this example the message is digitally signed, but not encrypted. 1) Alice signs a message with her private key. 2) Bob can verify that Alice sent the message and that the message has not been modified. ...
* Server-based signatures *
Probabilistic signature schemeProbabilistic Signature Scheme (PSS) is a Cryptography, cryptographic Digital signature, signature scheme designed by Mihir Bellare and Phillip Rogaway. RSA-PSS is an adaptation of their work and is standardized as part of PKCS_1, PKCS#1 v2.1. In ge ...


Notes


References

* * *


Further reading

* J. Katz and Y. Lindell, "Introduction to Modern Cryptography" (Chapman & Hall/CRC Press, 2007) * Lorna Brazell, Electronic Signatures and Identities Law and Regulation (2nd edn, London: Sweet & Maxwell, 2008) * Dennis Campbell, editor, E-Commerce and the Law of Digital Signatures (Oceana Publications, 2005). * M. H. M Schellenkens, Electronic Signatures Authentication Technology from a Legal Perspective, (TMC Asser Press, 2004). * Jeremiah S. Buckley, John P. Kromer, Margo H. K. Tank, and R. David Whitaker, The Law of Electronic Signatures (3rd Edition, West Publishing, 2010).
''Digital Evidence and Electronic Signature Law Review''
Free open source {{Authority control