- For one thing, a digital signature serves to prove the undeniable authorship of the email
- For another, the digital signature serves to prove the integrity of the email.
In other words, the digital signature can be used, on the one hand, to check if and ensure that the email actually comes from the sender shown in the email program. On the other hand, it can be used to check if the contents of the email have been changed during sendin
How does the digital signature work – how are these two goals achieved?
The procedure for creating a digital signature is based on the principle of asymmetric cryptography. Asymmetric here means that a key pair is always used to sign and encrypt a message. Everyone involved in the process has a public and a private – which is always and consistently kept secret – key. The two keys form the key pair.
Sign:
- Alice encrypts the message to be sent to Bob with here private key.
- Bob decrypts the message from Alice with her public key
What does this achieve? Alice’s message can only be decrypted with her public key.
If the decryption works, you have proof that
- this email was not changed during sending
- and that it was actually sent by Alice.
Both the authorship and the integrity of the email are thus proven
However, the message was by no means encrypted by merely signing it. Anyone who has Alice’s public key could have read the email from Alice to Bob – and in principle that is everyone. Therefore:
Sign & encrypt
- Alice signs the email with her private key (providing for undisputable authorship and integrity) and then encrypts the email with Bob’s public key (confidentiality)
- Bob first decrypts Alice’s email with his private key. In the next step, Bob checks the authorship and integrity by further “decrypting” with Alice’s public key.
In practice, the respective client program handles the signing and encryption. Established procedures for the practical implementation of asymmetric cryptography are S/MIME (X.509) and PGP or GnuPG. Various algorithms are used (AES, RSA, etc.). A public key infrastructure (PKI) and key management systems are often used here.