Chapter 6
Digital signatures
A digital signature is a value only the private-key holder can compute for a message, and anyone with the public key can check that it matches that exact, unchanged message.
Topic
Hashes and signatures
A hash is a short fingerprint of data; any change gives a different fingerprint. A digital signature is made with a private key over that data, and anyone with the matching public key can check it. A signature is not "encrypting with the private key".
This hub covers how signatures work, why they need certificates to say whose key signed, and how code and document signing use timestamps so a signature can still be checked after the certificate expires.
Understand it: handbook chapters
Plain words first, then the real mechanism, what it looks like at work and why it matters.
Chapter 5
Hashes and fingerprints
A cryptographic hash turns any data into a short, fixed-size fingerprint; any change gives a completely different fingerprint, and you cannot run it backwards to get the data.
Chapter 24
Signed and sealed: code and document signing
A code or document signature proves who signed a file and that nobody changed it since; a trusted timestamp keeps that proof valid after the signing certificate expires.
Chapter 7
Whose key is it? Binding identity to keys
Encryption and signatures only help if you use the right person's public key, so something you already trust must vouch that a key belongs to a name.
Do it: how-to guides
Step-by-step, with real commands and a way to check it worked.
How to sign code with signtool and cosign
You will sign and timestamp a Windows program with SignTool, sign a release file with Sigstore cosign, and verify both, including who signed and when.
How to check that a private key matches a certificate
You will have proved, without exposing the key, that a private key, its CSR and a certificate share one public key, or found the file that does not belong.
Check yours: browser tools
They run in your browser. Nothing you paste is sent anywhere.
Tool
Certificate decoder
Paste a PEM certificate and read every field in plain words.
The big picture: crash course
Short lessons of about nine minutes each, with check questions.
Look it up: glossary terms
Every term in plain words, linked to its full entry.
- Authenticode
- Avalanche effect
- Code signing
- Digital signature
- ECDSA
- eIDAS
- Fingerprint
- Hash
- Hash function
- HMAC
- Key substitution
- Man-in-the-middle
- Message authentication code (MAC)
- PKI
- Public key infrastructure (PKI)
- Qualified electronic signature (QES)
- S/MIME
- SHA-256
- Sigstore
- Timestamp
- Timestamping
- Timestamping authority (TSA)