Home / Knowledge hub / Digital signature
Knowledge hub
Digital signature
A value that proves who produced data and that it has not changed since.
What it means
A digital signature is a value computed from some data and a private key. Anyone holding the matching public key can check it. If the check passes, two things are true: the data came from the holder of that key, and not one bit has changed since signing.
It works like a seal that only one party can press, but that everyone can inspect. The signer keeps the private key secret. Verifiers need only the public key, so you can prove authenticity to people you have never met.
Why it matters
Signatures are what let you trust things you did not produce yourself: a software update, a webhook from a payment provider, a signed token, a contract. If a signature is skipped or checked loosely, an outsider can send forged data that your system accepts as genuine.
They also give you evidence. A valid signature ties an action to a key, which matters in audits and disputes. A signature that nobody verifies gives the same comfort as a lock nobody turns.
How it shows up
You meet signatures in JWTs, in webhook headers, in package and container signing, in TLS certificates and in document signing. Each depends on the receiver checking the signature before acting on the content.
The usual faults are quiet. The code decodes a token but never verifies it. A signature is checked against an algorithm the sender chose. A webhook secret is compared with a slow string match. Or a private key sits in a repository. Check that verification happens first, on every path.
Questions people ask
Digital signature, answered
What is the difference between a digital signature and encryption?
Encryption hides data from people who lack the key. A signature proves who sent data and that it is unchanged, but the data stays readable.
They are often used together: sign, then encrypt, or use a mode that does both.
Is a digital signature the same as an electronic signature?
No. An electronic signature is any mark that shows intent to sign, including a typed name or a drawn squiggle. A digital signature is a cryptographic check.
Some e-signature products use digital signatures underneath. The legal weight depends on local law.
Which algorithms are used for digital signatures?
NIST's FIPS 186-5 approves RSA, ECDSA and EdDSA. HMAC is sometimes called a signature, but it uses a shared secret and so cannot show which party produced the data.
Pick a current standard algorithm and key size, and avoid inventing your own.
What happens if the private key leaks?
Anyone can then sign data as you, and receivers cannot tell the difference. You must revoke the key, issue a new one and decide which past signatures to distrust.
This is why private keys belong in a vault or hardware module, not in source code.
How do we test that signatures are really verified?
Send altered data with the original signature, a missing signature and a signature made with a different key. Each should be refused.
These checks need the running app, because the fault is often in a code path that only runs in production.
Sources
Where this comes from
Related
Terms that sit next to this one
Public key cryptography
Encryption with a pair of keys: one shared openly, one kept private.
JWT
A signed token a client carries to prove who is signed in.
HMAC
A hash mixed with a secret key, proving a message is unchanged and from the key holder.
Webhook
A URL you hand to another service so it can call you when something happens.
JWT algorithm confusion
Tricking a server into verifying a token with the wrong signing method.
Is the signature actually checked?
Unverified tokens, forged webhooks and signature checks that can be skipped are the kind of flaw we look for, and a finding shows the request that got through. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.