Digital Signatures - Verifying Data Authenticity

About 2 min read

A digital signature is a technique that uses public-key cryptography to simultaneously achieve tamper detection of data and verification of the sender's identity. The sender signs the hash value of the data with a private key, and the receiver verifies it with the public key, proving that the data has not been altered in transit and that it was indeed created by that sender. As of 2025, with the spread of electronic contract services, the use of digital signatures is expanding rapidly.

How Unsigned Software Is Treated

The presence of digital signatures is easiest to see when software is distributed without code signing. Operating systems and security software use the presence and issuer of an executable's signature to judge the trustworthiness of a distributed file, and an unsigned executable, whose origin cannot be confirmed, is likely to be warned about or blocked as a suspicious program. When a developer obtains a code-signing certificate and signs a release, users' systems can mechanically verify the publisher's identity and that the file has not been tampered with after distribution, allowing installation without warnings. For distributing legitimate software, code signing has effectively become a prerequisite.

The Signing and Verification Flow

How Digital Signatures Work

Signature generation is performed in three steps. First, the hash value of the data to be sent is computed (for example, SHA-256); next, that hash value is encrypted with the sender's private key to generate the signature; and finally, the data and the signature are sent together. The receiver decrypts the signature with the sender's public key and compares it with the hash value they computed themselves. If they match, there has been no tampering; if they differ, tampering has occurred. PKI (public-key infrastructure) plays the role of guaranteeing the legitimacy of the public key.

Practical Applications

In electronic contract services, a digital signature is applied to a contract PDF to give it legal force. In software distribution, code signing guarantees the legitimacy of the developer and that the program has not been tampered with. In email, S/MIME and DKIM leverage digital signatures and help detect phishing emails. Digital signatures are also indispensable for verifying blockchain transactions, supporting the very foundation of cryptocurrency wallet security.

Points to Watch

The security of a digital signature depends entirely on the management of the private key. If the private key is leaked, a third party can generate impersonating signatures. Protect the private key with an HSM (hardware security module), and restrict access to the key store with a sufficiently long random password.