Is this update really from the vendor?
A digital signature proves that a message came from the holder of a private key and has not changed since. A certificate ties a public key to a name, such as a bank's website, so you know whose key you are checking.
Your phone installs an update. It must be sure the vendor made it, and that nobody edited it on the way.
By the end of this lesson
Note
I can explain how a signature and a certificate prove who sent something.
Key words
| Word | What it means |
|---|---|
| Digital signature | a value only the private key holder can make |
| Verify | to check a signature with the public key |
| HMAC | a hash mixed with a shared secret key |
| Certificate | a signed note that a public key belongs to a name |
| Certificate authority | an organisation trusted to sign certificates |
| Chain of trust | certificates linked, each signed by the next |
The cells students fill in are left blank in this preview.
Sign with private, verify with public
Signing turns the roles round. The sender hashes the message, then applies the private key to the hash. That value is the signature.
The receiver hashes the message too and applies the public key to the signature. If the two answers match, only the key holder could have signed, and nothing has changed.
Worked example: a toy signature on a payment
| Step | Working | Result |
|---|---|---|
| Hash the message | SHA-256 of pay 10 pounds to Sam, cut to the remainder after dividing by 3233 | 968 |
| Sign | 968 to the power 2753, remainder after dividing by 3233 | 817 |
| Verify | 817 to the power 17, remainder after dividing by 3233 | 968, a match |
| A changed message | The same cut hash of pay 90 pounds to Sam | 373, no match |
The cells students fill in are left blank in this preview.
Hash the payment, cut to a small number
python3 -c "import hashlib; print(int(hashlib.sha256(b'pay 10 pounds to Sam').hexdigest(), 16) % 3233)"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Sign it with the private exponent
python3 -c "print(pow(968, 2753, 3233))"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Verify it with the public exponent
python3 -c "print(pow(817, 17, 3233))"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Hash the changed payment
python3 -c "import hashlib; print(int(hashlib.sha256(b'pay 90 pounds to Sam').hexdigest(), 16) % 3233)"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think a signed message is hidden. It is not. Anyone can read it. A signature shows who sent it and that it is unchanged. To keep the contents secret as well, encrypt the message too.
Hash, MAC and signature prove different things
A plain hash shows a change only if you trust where the hash came from. An HMAC mixes in a secret key that both sides share. Only they can make it, so it shows the message came from one of them.
A signature uses a private key that only one side holds. So it shows exactly who signed, and the signer cannot deny it.
Worked example: what each one proves
| Tool | Key used | Shows unchanged? | Shows who? |
|---|---|---|---|
| Hash | None | Yes | No |
| HMAC | One shared secret key | Yes | One of the two sides |
| Signature | Private key signs, public key verifies | Yes | Exactly one signer |
The cells students fill in are left blank in this preview.
Make an HMAC with a shared key
python3 -c "import hmac, hashlib; print(hmac.new(b'shared-key', b'pay 10 pounds to Sam', hashlib.sha256).hexdigest())"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A certificate links a key to a name
You can verify a signature only with the right public key. But how do you know a public key belongs to your bank and not to a thief?
A certificate answers that. It holds a name, a public key, an expiry date and the name of the issuer. The issuer, a certificate authority, signs it with its own private key.
A browser makes five checks on a certificate
First, does the name match the site you asked for? Second, is today before the expiry date? Third, does each certificate's issuer match the next certificate's name?
Fourth, does each signature verify? Fifth, does the chain end at a root your device already trusts? If any answer is no, the browser warns you.