Digital Signature

Presented by
Snigdharani Panda
Digital Signature

 A digital signature is exactly what it sounds like a

modern alternative to signing documents with paper
and pen.
 It guarantees that the contents of a message are not
altered in transit and helps us overcome the problem of
impersonation (misuse) and tampering in digital
communications.
 Digital signatures also provide additional information
such as the origin of the message, status, and consent
by the signer.
Digital Signature
 Digital signature is a mathematical scheme to verify the authenticity of
digital documents or messages. Also, a valid digital signature allows the
recipient to trust the fact that a known sender sent the message and it
was not altered in transit.
 Like written signatures, digital signatures provide authentication of the
associated input or messages.
 Further, digital signatures authenticate the source of messages like an
electronic mail or a contract in electronic form.
How do digital signatures
work?
 Using a mathematical algorithm, digital signing solution providers
such as Zoho Sign will generate two keys: a public key and a
private key.
 When a signer digitally signs a document, a cryptographic hash is
generated for the document.
 That cryptographic hash is then encrypted using the sender's
private key, which is stored in a secure HSM box. It is then
appended to the document and sent to the recipients along with
the sender's public key.
 The recipient can decrypt the encrypted hash with the sender's
public key certificate. A cryptographic hash is again generated on
the recipient's end.
 Both cryptographic hashes are compared to check its authenticity.
If they match, the document hasn't been tampered with and is
considered valid.
What is a digital certificate?

 A digital certificate contains the public key for a digital

signature and also specifies the identity associated with
the key.
 Digital certificates are usually issued by trusted
authorities and valid for a specified period.
 The certificate authority will act as the guarantor in the
whole process.
Important features of digital
signature
The three important features of digital features are:
 Authentication – They authenticate the source of
messages. Since the ownership of a digital certificate is
bound to a specific user, the signature shows that the
user sent it.
 Integrity – Sometimes, the sender and receiver of a
message need an assurance that the message was not
altered during transmission. A digital certificate
provides this feature.
 Non-Repudiation – A sender cannot deny sending a
message which has a digital signature.
Security features and methods
 Security is the main benefit of digital signatures. Security
capabilities embedded in digital signatures ensure a document is
not altered and signatures are legitimate.
 Security features and methods used in digital signatures include
the following:
 Personal identification numbers (PINs), passwords and codes.
Used to authenticate and verify a signer's identity and approve
their signature. Email, username and password are the most
common methods used.
 Asymmetric cryptography. Employs a public key algorithm that
includes private and public key encryption and authentication.
 Checksum. A long string of letters and numbers that represents
the sum of the correct digits in a piece of digital data, against
which comparisons can be made to detect errors or changes. A
checksum acts as a data fingerprint.
 Cyclic redundancy check (CRC). An error-detecting code and verification
feature used in digital networks and storage devices to detect changes to
raw data.
 Certificate authority (CA) validation. CAs issue digital signatures and act
as trusted third parties by accepting, authenticating, issuing and
maintaining digital certificates. The use of CAs helps avoid the creation of
fake digital certificates.
 Trust service provider (TSP) validation. A TSP is a person or legal entity
that performs validation of a digital signature on a company's behalf and
offers signature validation reports.
Benefits to using digital signatures
 Timestamping. By providing the data and time of a digital signature,
timestamping is useful when timing is critical, such as for stock trades, lottery
ticket issuance and legal proceedings.

 Globally accepted and legally compliant. The public key infrastructure (PKI)
standard ensures vendor-generated keys are made and stored securely.
Because of the international standard, a growing number of countries are
accepting digital signatures as legally binding.

 Time savings. Digital signatures simplify the time-consuming processes of

physical document signing, storage and exchange, enabling businesses to
quickly access and sign documents.

 Cost savings. Organizations can go paperless and save money previously spent
on the physical resources and on the time, personnel and office space used to
manage and transport them.
► Positive environmental impact. Reducing paper use also cuts down
on the physical waste generated by paper and the negative
environmental impact of transporting paper documents.

► Traceability. Digital signatures create an audit trail that makes

internal record-keeping easier for business. With everything recorded
and stored digitally, there are fewer opportunities for a manual
signee or record-keeper to make a mistake or misplace something.
Classes of digital signatures
There are three different classes of digital signature certificates (DSCs):
 Class 1. Class 1 signatures provide a basic level of security and are used in
environments with a low risk of data compromise. Cannot be used for
legal business documents as they are validated based only on an email ID
and username.
 Class 2. Often used for electronic filing (e-filing) of tax documents,
including income tax returns and goods and services tax (GST) returns.
Class 2 digital signatures authenticate a signer's identity against a pre-
verified database. Class 2 digital signatures are used in environments
where the risks and consequences of data compromise are moderate.
 Class 3. The highest level of digital signatures, Class 3 signatures require a
person or organization to present in front of a certifying authority to prove
their identity before signing. Class 3 digital signatures are used for e-
auctions, e-tendering, e-ticketing, court filings and in other environments
where threats to data or the consequences of a security failure are high.
Authentication Technology

 There is a broad range of technology used for authentication:

passwords, OTPs, zero-knowledge protocols, MAC-based
protocols and using digital signatures.
 Authentication happens through an interaction between the
user (device) and the verifier (server). Contrary to digital
signatures, where the verifier can perform the verification at
any time in the future.
 To build an authentication mechanism from digital signatures,
interaction is needed, to ensure liveness. By using digital
signatures in a carefully designed cryptographic protocol, many
additional security properties can be achieved, such as liveness,
but also confidentiality of the communication. Another
advantage of using digital signatures as building block for
authentication, is that there is good support on modern
smartphones for hardware-backed signatures.