Digital signatures

I've been working on writing up an overview of digital signatures — what they are, how they work, and how they're used — and I've decided to post it here in installments. Every few days, I'll post another part, and I'll update the list at the bottom of this post with pointers to each one as it's posted.

---

1.0  Introduction

When we speak of "security" in the context of computers and electronic documents, there are really a number of interrelated things that we're talking about:

1. Authentication: who am I, and how can I prove it?
2. Authorization: what am I allowed to do?
3. Privacy: how are others prevented from seeing my information?
4. Integrity: how are others prevented from altering my information without my knowledge?
5. Non-repudiation: what prevents me from denying that I did or said something?

Consider these in the context of a paper document, and let's see how we accomplish each of these. Suppose you and I sign a contract. We have to be sure we know who we are — who is signing the contract. We satisfy ourselves of that, and then perhaps we engage a notary public, who checks our identification, attests to our identities and signatures, and affixes a seal confirming that testament. If I'm signing the contract on behalf of my employer, you have to assure yourself that I'm authorized to do that, or the contract might not be valid. If we need secrecy (privacy), we might seal each copy of the contract in an envelope. The fact of having multiple copies, of having the contract written and signed in ink, and of having the original notary seal on each official copy makes it difficult for someone to modify the contract surreptitiously. And the witness to our signatures provides the non-repudiation — if I should later claim that I didn't agree to that, the notary can testify that I did, indeed, sign it.

But with Internet email, we normally lack all of those assurances. I can send email using any "from" address I want; the mail traverses various email servers on its path from me to you, and administrators or other parties can look at it or modify it along the way; I can very easily claim that someone else sent that message and purported to be me.

Because of this, it's difficult to use Internet email for secure communication — to request or authorize financial transactions, for instance. We need a way to enable such usage.

And we have one: encryption and digital signatures. We'll take a closer look, here, at those technologies — at what they do and how they do it, and how they can be used for secure transactions using email.

Next time: Cryptography Basics

---

For convenient reference, here are pointers to all the parts of this discussion, which I'll update as I post subsequent parts:

1.0  Introduction
2.0  Cryptography Basics   ...and...
    2.1  Symmetric-Key Encryption
    2.2  Public-Key Encryption   ...and...
    2.3  Hash Functions
3.0  Digital Signatures   ...and...
    3.1  Formatting the Message
    3.2  Key Distribution   ...and...
    3.3  Certificates
    3.4  The User Experience
4.0  DKIM — Signing at the Domain   ...and...
5.0  Next Steps   ...and...
References
 
Appendix  More on the user experience with digital certificates