A digital signature is a cryptographic value computed over data with a private key, which anyone holding the matching public key can verify to confirm that the data came from the key holder and has not been altered since signing. In cryptography it provides three properties at once: integrity, authenticity and non-repudiation, the last one meaning the signer cannot plausibly deny having signed, provided the private key stayed under their sole control.
Digital signatures protect software updates, TLS certificates, code packages, email, documents and blockchain transactions. They rely on asymmetric cryptography and on a hash function, and they are distinct from an electronic signature in the legal sense, which may be nothing more than a typed name or a scanned image.
How a digital signature is created and verified
Signing is a two-step process. First the signer computes a cryptographic hash of the message, such as SHA-256, producing a short fixed-length digest. Then the signing algorithm combines that digest with the private key to produce the signature. Hashing first keeps the operation fast and fixed in size regardless of whether the message is a sentence or a multi-gigabyte disk image.
Verification reverses the logic without needing any secret. The verifier recomputes the hash of the received message and runs the verification algorithm with the signature and the signer’s public key. The result is a simple yes or no. A single changed bit in the message produces a different hash, so the signature fails verification.
- Hash the message with an approved hash function.
- Sign the digest with the private key, using the scheme’s padding or randomization.
- Transmit the message, the signature and an identifier of the public key or certificate.
- The recipient hashes the message and verifies the signature with the public key.
- The recipient checks that the public key truly belongs to the claimed signer.
The last step is the one most often neglected. A mathematically valid signature only proves possession of a key; binding that key to an identity requires a certificate from a trusted authority, a pinned key, or another trust mechanism.
Digital signature algorithms and key sizes
Several signature schemes are in production use, and they differ in key size, signature size and speed. The table summarizes the common choices at roughly the 128-bit security level, which is the usual target for new systems.
| Scheme | Key size | Signature size | Characteristics |
|---|---|---|---|
| RSA-PSS | 3072-bit modulus | 384 bytes | Fast verification, slow signing, large keys |
| ECDSA P-256 | 256-bit | About 64 to 72 bytes | Compact; needs a high-quality random nonce |
| Ed25519 | 256-bit | 64 bytes | Deterministic nonce, fast, simple to implement safely |
| ML-DSA-65 | About 1.9 KB public key | About 3.3 KB | Post-quantum lattice scheme, FIPS 204 |
| SLH-DSA | 32 to 64 bytes | About 8 to 50 KB | Hash-based, conservative, very large signatures |
RSA with 2048-bit keys remains widely deployed and is considered acceptable for current use, but 3072 bits is recommended for long-lived keys. Elliptic-curve schemes reach similar strength with far smaller keys. Large quantum computers would break RSA and elliptic-curve signatures, which is why standards bodies have published post-quantum signature standards and many systems are planning hybrid or phased migrations.
Digital signatures compared with related mechanisms
A digital signature is often confused with other integrity mechanisms in cryptography. The decisive differences are who can create the value and who can verify it.
| Mechanism | Key type | Who can verify | Non-repudiation |
|---|---|---|---|
| Hash function | No key | Anyone | No; anyone can recompute it |
| MAC or HMAC | Shared secret key | Only key holders | No; both sides can create it |
| Digital signature | Private and public key pair | Anyone with the public key | Yes, if the private key is protected |
| Encryption | Symmetric or asymmetric | Not a verification tool | No; protects confidentiality only |
A frequent misconception is that a digital signature is “encryption with the private key”. That description loosely fits textbook RSA, but it is wrong for real schemes such as ECDSA, Ed25519 or ML-DSA, and even modern RSA signing uses dedicated padding that differs from encryption padding. A signature also provides no confidentiality: the signed message remains readable.
Where digital signatures are used
Digital signatures underpin most trust decisions on the internet. Each application adds its own format and rules about which keys are trusted and how long signatures remain valid.
| Application | What is signed | Common format or standard |
|---|---|---|
| TLS certificates | Certificate contents and handshake data | X.509 with RSA or ECDSA |
| Software and code signing | Executables, drivers, packages | Authenticode, signed packages, Sigstore |
| Message body and headers | S/MIME, OpenPGP, DKIM | |
| Documents | PDF content and signing time | PAdES, CAdES, XAdES |
| Firmware and secure boot | Boot images and updates | Vendor keys anchored in hardware |
Long-term document signatures add a trusted timestamp, so the signature remains verifiable after the signing certificate expires. Without a timestamp, a verifier cannot prove that signing happened while the certificate was still valid.
Pitfalls that break digital signature security
Signature algorithms are rarely broken directly; failures almost always come from key management and implementation errors. The most famous class of failure is nonce reuse in ECDSA: signing two different messages with the same random value lets an attacker compute the private key with simple algebra.
- Stolen private keys turn signatures into a weapon; protect signing keys in an HSM or a hardware token.
- Weak hash functions such as MD5 and SHA-1 allow collision attacks that transfer a signature to a forged document.
- Skipped certificate checks, including revocation and expiry, accept signatures from untrusted or compromised keys.
- Signing the wrong data, for example only part of a file, leaves unsigned regions open to tampering.
- Algorithm confusion in token formats lets attackers swap a signature scheme for a weaker one or for none.
The short version
A digital signature works like a wax seal that only one person can make but everyone can check. The signer has a secret stamp, and the whole world has a picture of what that stamp looks like.
If anyone changes even one letter of a signed document, the seal no longer matches, and the check fails. The signature proves who sent something and that nobody changed it on the way, but it does not hide the content from anyone who reads it.
Where it makes a difference
A company ships a desktop application to about 50,000 computers through an automatic update service. The development team signs each update package with an Ed25519 key stored in a hardware security module, and the application contains the matching public key built in.
One day an attacker compromises the download server and replaces the update file with a modified version containing malware. Every installed copy downloads the file, recomputes the hash and checks the signature. The verification fails because the attacker does not have the private key.
The outcome is that no client installs the tampered update. The incident becomes a server cleanup task instead of a mass compromise, because trust was placed in the signing key rather than in the server delivering the file.