Digital Signature

A digital signature is a short sequence of numbers attached to a file or message. It answers two questions at once. First: Does this really come from the stated person or company? Second: Was anything altered along the way? Whoever receives the file can check both with a single computation, without having to ask the sender. Unlike a scanned signature, a digital signature cannot simply be copied out and pasted somewhere else. It always belongs to exactly this one document.

Why software and contracts could otherwise not be trusted

On the internet you don't look the other party in the face. An email with your bank's address as the sender could come from anyone. A downloaded file could have been tampered with along the way, for example by someone controlling the Wi-Fi at a café. Digital signatures close exactly this gap, because they cannot be forged without knowing a secret.

This is especially important for software updates. Your phone regularly downloads new program versions and installs them with far-reaching permissions. If the update were not signed, an attacker could slip in their own version. That's why operating systems check every update for a valid signature from the manufacturer and otherwise refuse to install it.

The matter also carries legal weight. In the EU, a regulation called eIDAS governs which form of electronic signature holds what value in court. The highest level, the qualified electronic signature, is legally equivalent to a handwritten signature. This allows contracts to be concluded entirely digitally.

Two keys, one fingerprint of the document

The foundation is a key pair. Every person has a private key, which they keep strictly secret, and a public key, which they distribute freely. The two keys are mathematically linked. Whatever was computed with one can only be verified with the other. Calculating the private key from the public key would be practically impossible even for huge data centers.

What gets signed is not the whole document, but its so-called hash. A hash is a short checksum computed from the content, always the same length, and one that changes completely with the smallest alteration. You can think of it as the file's fingerprint. This fingerprint is combined with the private key, and the result is the signature.

On the recipient's side, this runs in reverse. Their program computes the hash of the received file itself and checks with the public key whether the signature matches it. If even a single comma is off, the values no longer match and the check fails. What remains open, however, is whether the public key really belongs to the right person. That's what certificates are for: a trusted authority confirms with its own signature who a key belongs to.

From the browser padlock to the blockchain

The padlock icon in your browser's address bar relies on digital signatures. The website proves with a signed certificate that it truly belongs to that address. Apps from the App Store are signed too, as are PDF invoices from government agencies and tax assessments.

In the world of finance, you encounter this principle with cryptocurrencies. Every Bitcoin transfer is a message signed with the private key. Whoever loses that key loses access to their funds permanently, since there is no bank that could reset it.

A common misconception: a signature encrypts nothing. The text remains readable to everyone; it is only protected against unnoticed alteration. Encryption and signing are two separate tools that are often used together. With the rise of AI-generated images and videos, the technique is gaining additional importance: cameras and software are beginning to sign recordings right at the moment of creation, so that it later remains traceable where a file came from.