What is a Digital Signature?

A digital signature is a message digest used to cryptographically sign a message.

Digital signatures rely on asymmetric, or public key, cryptography.

To create a digital signature, you sign the message with your private key. The digital signature then becomes part of the message.

This has two effects:

Any changes to the message can be detected, due to the message digest algorithm.
You can not deny signing the message, because it was signed with your private key.

These two features, message integrity and non-repudiation, make digital signatures a very useful component for e-commerce applications.

Books on Digital Signatures

Digital Signatures

This is the definitive book on digital signatures, written by RSA insiders, and backed by RSA Security, Inc., the most trusted name in e-security. This expert resource explains the main goals of security--confidentiality, authentication, integrity, and non-repudiation--and gives insight into actual real-world digital signature implementations.

Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption

If you've been charged with setting up a public key infrastructure (PKI) for an organization, or if you're just not content to trust commercial products' claims of security, have a look at Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption for a clear and complete overview of digital certificate management techniques. This richly detailed and heavily referenced volume generally stays clear of implementation specifics. Readers can count on it to provide the background in concepts and terminology that they'll need to make PKI design decisions.

Without exception, this is a very clearly written book, but there are rather few conceptual diagrams--and a few more graphics might have clarified the relationships among entities. Regardless, it's abundantly evident that the authors did a great deal of research--a rarity in this field. Nearly every other sentence contains a reference to an endnote. To truly understand how PKI works, study this book and the material it references, and participate in online forums on PKI issues.