2. What is Digital Signature?What is Digital Signature?
Digital signature technique is based on public key
cryptography with a difference.
In public key cryptography a pair of keys are used, one public
key and one private key. The public key is often used for
message encryption , and the private key is often used for
decrypting the message.
However in case of digital signature message is encrypted with
the private key and decrypted with the public key.
Only a specific person with the corresponding private key can
encrypt the message or in other words sign the message.
However any party who has the signatory’s public key can
encrypt the message, in other words can verify the message.
6. Authentication: Authentication means the act of proving who you say you
are. Authentication means that you know who created and sent the message.
Digital signature is used to authenticate the source of messages. It ensures the
user of the sender.
Integrity: Integrity ensures that when a message is sent over a network,
the data that arrives is the same as the data that was originally sent. Integrity
is the assurance that the information is trustworthy and accurate. Digital
signature ensures the integrity of message.
Non-repudiation: This is an important criteria of digital signature. As
digital signature ensures the authentication of the message, so the sender
can’t repudiate it later. At the same time it also ensures the identity of the
receiver, so the receiver can’t repudiate it later.
6
WHY DIGITAL SIGNATURE
7. Why Digital Signature ?
– Authenticate identity of sender
– Ensure the original Content of
Message
– Non-Repudiation
– Verifiability by independent,
public or third party
9. How digital Signature works?
User A
User B
Use A’s private key to sign the document
Transmit via the Internet
User B received
the document with
signature attachedVerify the signature
by A’s public key stored
at the directory
10. Digital Signatures (1)
Required Conditions:
1. Receiver can verify claimed identity of sender.
2. Sender cannot later repudiate(deny) contents
of message.
3. Receiver cannot have concocted message
himself.
11. Uses secure hash algorithm
Condenses message to 160 bit
Key size 512-1024 bits
Proposed by NIST(National Institute of Standards
and Technology) in 1991
DIGITAL SIGNATURE
STANDARDS
12. Trusted Third Party
An organization which issues public key certificates
Assures the identity of the parties to whom it issues
certificates
Maintains online access to the public key certificates
issued
CERTIFYING AUTHORITY(CA)
14. What is Digital Certificate ?
An attachment to an
electronic message used
for security purposes.
15. What are Digital Certificates?
A digital certificate (DC) is a digital file that certifies
the identity of an individual or institution, or even a
router seeking access to computer- based
information. It is issued by a Certification Authority
(CA), and serves the same purpose as a driver’s
license or a passport.
17. Digital Certificates
• Digital Certificate is a data with digital
signature from one trusted Certification
Authority (CA).
• This data contains:
– Who owns this certificate
– Who signed this certificate
– The expired date
– User name & email address
18. Who issues Digital
Certificate?
An individual wishing to send an encrypted message
applies for a digital certificate from a Certificate
Authority. The CA issues an encrypted digital
certificate containing the applicant's public key
and a variety of other identification information. The
CA makes its own public key readily available
through print publicity or perhaps on the Internet.
19. How it Works?
The recipient of an encrypted message uses
the CA's public key to decode the digital
certificate attached to the message, verifies
it as issued by the CA and then obtains the
sender's public key and identification
information held within the certificate. With
this information, the recipient can send an
encrypted reply.
20. What are Certification
Authorities?
Certification Authorities are the digital
world’s equivalent to passport offices. They
issue digital certificates and validate
holders’ identity and authority.
They embed an individual or institution’s
public key along with other identifying
information into each digital certificate and
then cryptographically sign it as a tamper-
proof seal verifying the integrity of the data
within it, and validating its use.
21. What is the Process of
obtaining a certificate?
1.Subscriber (sender) generates a publicprivate key pair. Applies to
CA for digital certificate with the public key.
2.CA verifies subscriber's identity and issues digital certificate
containing the public key.
3.CA publishes certificate to public, on-line repository.
4.Subscriber signs message with private key and sends message to
second party.
5.Receiving party verifies digital signature with sender's public key
and requests verification of sender's digital certificate from CA's
public repository.
6.Repository reports status of subscriber's certificate.
22. Bob’s
public
key
Bob’s
identifying
information
CA
private
key
KB
+
certificate for
Bob’s public key,
signed by CA
Digital
signature
(encrypt)
KB
+
KCA
-
Bob’s
public
key
Bob’s
identifying
information
CA
private
key
KB
+
certificate for
Bob’s public key,
signed by CA
Digital
signature
(encrypt)
KB
+
KCA
What is the Process in obtaining aWhat is the Process in obtaining a
certificate?certificate?
23. Types of Digital
Certificates
There are four main types of digital certificates :-
Server Certificates
Personal Certificates
Organization Certificates
Developer Certificates
24. Server Certificates
Allows visitors to exchange personal
information such as credit card numbers,
free from the threat of interception or
tampering.
Server Certificates are a must for building
and designing e-commerce sites as
confidential information is shared
between clients, customers and vendors.
25. Personal Certificates
Personal Certificates allow one to
authenticate a visitor’s identity and
restrict access to specified content to
particular visitors.
Personal Certificates are perfect for
business to business communications
such as offering suppliers and partners
controlled access to special web sites
for updating product availability,
shipping dates and inventory
management.
26. Organization & Developer
Certificates
Organization Certificates are used by
corporate entities to identify employees
for secure e-mail and web-based
transaction.
Developer Certificates prove authorship
and retain integrity of distributed software
programs e.g. installing a software on a
computer system in most instances
requires what is called a “serial key”
27. What Does a Digital
Certificate Contain?
It contains your name, a serial number,
expiration date, a copy of the certificate-
holder's public key (used for encrypting
messages and digital signatures), and the
digital signature of the certificate-issuing
authority so that a recipient can verify that
the certificate is real. Some digital
certificates conform to the X.509 standard.
28. Why are they Used?
There are four(4) main uses:
1. Proving the Identity of the sender of a
transaction
2. Non Repudiation – the owner of the certificate
cannot deny partaking in the transaction
3. Encryption and checking the integrity of data -
provide the receiver with the means to encode a reply.
4. Single Sign-On - It can be used to validate a user and
log them into various computer systems without having
to use a different password for each system
29. Public & Private Keys
Public and Private Key pairs comprise of
two uniquely related cryptographic keys.
Public key is made accessible to everyone,
whereas Private key remains confidential to
its respective owner.
Since both keys are mathematically related
only the corresponding private key can
decrypt their corresponding public key.
30. Where are Digital
Certificates Used?
In a number of Internet applications that include:
1.Secure Socket Layer (SSL) developed by
Netscape Communications Corporation
2. Secure Multipurpose Internet Mail Extensions
(S/MIME) Standard for securing email and
electronic data interchange (EDI).
3. Secure Electronic Transactions (SET) protocol
for securing electronic payments
4. Internet Protocol Secure Standard (IPSec) for
authenticating networking devices
