> Hashes, digital signatures, and signing code and documents with timestamps. Chapters and guides in one place. Source: https://pkizerotohero.com/topics/signing/ Topic # Hashes and signatures A hash is a short fingerprint of data; any change gives a different fingerprint. A digital signature is made with a private key over that data, and anyone with the matching public key can check it. A signature is not "encrypting with the private key". This hub covers how signatures work, why they need certificates to say whose key signed, and how code and document signing use timestamps so a signature can still be checked after the certificate expires. ## Understand it: handbook chapters Plain words first, then the real mechanism, what it looks like at work and why it matters. Chapter 6 ### [Digital signatures](https://pkizerotohero.com/handbook/digital-signatures/) A digital signature is a value only the private-key holder can compute for a message, and anyone with the public key can check that it matches that exact, unchanged message. - Beginner - Developer - IT ops Chapter 5 ### [Hashes and fingerprints](https://pkizerotohero.com/handbook/hashes/) A cryptographic hash turns any data into a short, fixed-size fingerprint; any change gives a completely different fingerprint, and you cannot run it backwards to get the data. - Beginner - Developer - IT ops Chapter 24 ### [Signed and sealed: code and document signing](https://pkizerotohero.com/handbook/code-signing/) A code or document signature proves who signed a file and that nobody changed it since; a trusted timestamp keeps that proof valid after the signing certificate expires. - Developer - IT ops - Expert Chapter 7 ### [Whose key is it? Binding identity to keys](https://pkizerotohero.com/handbook/binding-identity/) Encryption and signatures only help if you use the right person's public key, so something you already trust must vouch that a key belongs to a name. - Beginner - Developer - IT ops ## Do it: how-to guides Step-by-step, with real commands and a way to check it worked. ### [How to sign code with signtool and cosign](https://pkizerotohero.com/guides/code-signing-signtool-cosign/) You will sign and timestamp a Windows program with SignTool, sign a release file with Sigstore cosign, and verify both, including who signed and when. - Windows - Linux - macOS ### [How to check that a private key matches a certificate](https://pkizerotohero.com/guides/check-key-matches-certificate/) You will have proved, without exposing the key, that a private key, its CSR and a certificate share one public key, or found the file that does not belong. - Linux - macOS - Windows - Java ## Check yours: browser tools They run in your browser. Nothing you paste is sent anywhere. Tool ### [Certificate decoder](https://pkizerotohero.com/tools/decoder/) Paste a PEM certificate and read every field in plain words. ## The big picture: crash course Short lessons of about nine minutes each, with check questions. - [Lesson 3: Fingerprints and signatures](https://pkizerotohero.com/course/fingerprints-and-signatures/) - [Lesson 4: Whose key is it?](https://pkizerotohero.com/course/whose-key-is-it/) - [Lesson 10: Beyond the browser, and what comes next](https://pkizerotohero.com/course/beyond-the-browser/) ## Look it up: glossary terms Every term in plain words, linked to its full entry. - [Authenticode](https://pkizerotohero.com/handbook/glossary/#authenticode "Microsoft's code signing format for Windows programs, drivers and scripts, with the signature embedded inside the file.") - [Avalanche effect](https://pkizerotohero.com/handbook/glossary/#avalanche-effect "The property that a tiny change in the input of a hash function or cipher changes about half of the output bits.") - [Code signing](https://pkizerotohero.com/handbook/glossary/#code-signing "Signing software so users and systems can check who published it and that it has not been changed since.") - [Digital signature](https://pkizerotohero.com/handbook/glossary/#digital-signature "A value computed from a message and a private key that anyone with the public key can check, proving who signed and that nothing changed.") - [ECDSA](https://pkizerotohero.com/handbook/glossary/#ecdsa "The Elliptic Curve Digital Signature Algorithm, widely used in TLS certificates, often on the P-256 curve.") - [eIDAS](https://pkizerotohero.com/handbook/glossary/#eidas "The EU regulation on electronic identification and trust services, including electronic signatures, seals, time stamps and qualified certificates.") - [Fingerprint](https://pkizerotohero.com/handbook/glossary/#fingerprint "A hash of a certificate or public key, used as a short, unique way to identify and compare it.") - [Hash](https://pkizerotohero.com/handbook/glossary/#hash "The short, fixed-size output of a hash function, such as a 256-bit SHA-256 value. Also called a digest.") - [Hash function](https://pkizerotohero.com/handbook/glossary/#hash-function "A function that turns any data into a short fixed-size value, so that changing the data changes the value unpredictably.") - [HMAC](https://pkizerotohero.com/handbook/glossary/#hmac "A message authentication code built from a hash function and a secret key, such as HMAC-SHA256.") - [Key substitution](https://pkizerotohero.com/handbook/glossary/#key-substitution "An attack in which someone swaps a public key for their own, so you encrypt to them or trust their signatures by mistake.") - [Man-in-the-middle](https://pkizerotohero.com/handbook/glossary/#man-in-the-middle "An attacker who sits between two parties, relays their messages and can read or change them, often by swapping keys.") - [Message authentication code (MAC)](https://pkizerotohero.com/handbook/glossary/#message-authentication-code "A short value computed from a message and a shared secret key, which proves the message is unchanged and came from a key holder.") - [PKI](https://pkizerotohero.com/handbook/glossary/#pki "Short for public key infrastructure: everything needed to issue, trust, check and revoke certificates that bind public keys to identities.") - [Public key infrastructure (PKI)](https://pkizerotohero.com/handbook/glossary/#public-key-infrastructure "The people, policies, systems and standards that create, distribute, check and revoke certificates binding public keys to identities.") - [Qualified electronic signature (QES)](https://pkizerotohero.com/handbook/glossary/#qualified-electronic-signature "Under EU eIDAS, an advanced electronic signature made with a qualified signature device and a qualified certificate; legally equal to handwriting.") - [S/MIME](https://pkizerotohero.com/handbook/glossary/#s-mime "The standard for signing and encrypting email with certificates, defined in RFC 8551.") - [SHA-256](https://pkizerotohero.com/handbook/glossary/#sha-256 "The most widely used hash function today, from the SHA-2 family, producing a 256-bit value.") - [Sigstore](https://pkizerotohero.com/handbook/glossary/#sigstore "An open-source signing service that issues short-lived certificates for an OpenID Connect identity and records signatures in a public transparency log.") - [Timestamp](https://pkizerotohero.com/handbook/glossary/#timestamp "A token, signed by a timestamping authority, proving that some data, such as a signature, existed at a given time.") - [Timestamping](https://pkizerotohero.com/handbook/glossary/#timestamping "Adding a trusted timestamp to a signature, so the signature remains verifiable after its certificate expires.") - [Timestamping authority (TSA)](https://pkizerotohero.com/handbook/glossary/#timestamping-authority "A trusted service that signs timestamps, using a key and certificate reserved only for that purpose.") ## Other topics - [Certificates](https://pkizerotohero.com/topics/certificates/) - [Chains and trust stores](https://pkizerotohero.com/topics/chains-and-trust/) - [TLS and HTTPS](https://pkizerotohero.com/topics/tls/) - [Lifecycle and automation](https://pkizerotohero.com/topics/lifecycle-and-automation/) - [Revocation and transparency](https://pkizerotohero.com/topics/revocation-and-transparency/) - [Private PKI](https://pkizerotohero.com/topics/private-pki/) - [Post-quantum cryptography](https://pkizerotohero.com/topics/post-quantum/)