Digital Signature - Simplified and Explained

This lesson will help CISSP candidates (and hopefully everyone else) to fully understand what a digital signature is, and how it works from a lay person’s perspective. For students, this is part of the CBK Domain 3, Security Architecture and Engineering. https://www.facebook.com/CISSPMicroModules/ A digital signature is a method of providing accountability for electronic transactions where a handwritten signature is not possible for feasible. It provides authenticity – in other words the source is who it claims to be It also provides non-repudiation, or the inability of both sender and receiver to deny that it was sent or received. It also provides integrity, or the assurance that unauthorized changes haven’t been made. Here is how a digital signature works. The sender creates a message, it can be an email, a document, or transmitted data, but we’ll just call it a message for purposes of this video. The software performs a hashing function on the message to create a small digital representation, called a digest. The software then encrypts the hash (or the digest) with the sender’s private key, and the message is sent on its way. The receiver gets the message plus the encrypted digest/hash and decrypts it using the sender’s public key to reveal the hash / digest. The receiver’s software then runs a hashing function on the original message, and compares the two hashes / digests to see if they’re the same. A few examples of digital signature software are: Docusign, and Adobe. Digital signatures have several practical uses, such as: email signatures, e-commerce transactions, software patches, digital certificates, contract / agreement signing.