Sender authentication part 25: Digital signatures

  • Article

We've seen encryption, secret key encryption and public key encryption.  Public key encryption allows a sender to encrypt the contents of the message and have only the intended recipient read it.  They do this by encrypting with the public key and decrypting with the private key. 

However, recall that either key can be used to encrypt and decrypt.  That is, we can encrypt with the private key and decrypt with the public key.  This effectively means that anyone can read the message.  As it turns out, there are times when we want to do this.

Enter the concept of a digital signature.  In regular life, a signature is something that does the following:

  1. Provides proof that a person authorized the contents of the document. 
  2. Is unique to the individual.

Public key encryption allows us to digitally sign a document.  Here is how the process of authentication works:

  1. Bob creates a document and signs it with his signature (ie, I am Bob and I signed this document).
  2. Bob encrypts the document with my private key and send it to Alice.
  3. Alice receives the message, reportedly from Bob, and asks Bob for his public key.  Bob sends it to Alice.
  4. Alice takes the public key and decrypts the message.  The contents of the message contains Bob's signature, which verifies that the message came from Bob.

What would happen if Bob sent a key that was not part of the key pair?  Assume someone claims to be Bob and sent Alice a message.  Alice asks the real Bob for his public key, who sends it to Alice.  Alice decrypts the message, but because Bob's public key only works with his private key, the contents of the message do not decrypt properly.  Alice judges that the message did not actually come from Bob. 

If the contents of the message did decrypt properly, then Alice could have judged that the message did come from Bob.  Since the keys can only work in pairs, only the private key that was used to encrypt the message could have been the one used to create the signature, and only the public key could have decrypted it.  In other words, encrypting a message with a private key allows others with a public key to verify (authenticate) the original signer of a message.

Now that we understand how digital signatures work, we are finally ready to be move onto DomainKeys.