How Digital Signatures Work?
The benefits of adopting digital signatures in place of paper-based, wet-ink signatures are obvious - reduce paper waste, decrease operating costs, speed up document delivery, to name a few - but what's maybe not so clear is what's going on when you actually apply a digital signature to a document.
Let's take a look at what's going on behind the scenes and how the underlying technology verifies both the identity of the signer and that no changes have been made since the signature was applied.
Applying the Digital Signature
1. When you click "sign", a unique digital fingerprint (called a hash) of the document is created using a mathematical algorithm. This hash is speicifc to this particular document; even the slightest change would result in a different hash.
2. The hash is encrypted using the signer's private key. The encrypted hash and the signer's public key are combined into a digital signature, which is appended to the document.
3. The digitally signed document is ready for distribution.
Verifying the digital Signature
1. When you open the document in a digital signature-capable program (e.g., Adobe Reader, Microsoft Office), the program automatically uses the signer's public key (which was included in the digital signature with the document) to decrypt the document hash.
2. The program calculates a new hash for the document. If this new hash matches the decrypted hash from Step 1, the program knows the document has not been altered and displays messaging alone the lines of, "The document has not been modified since this signature was applied."
The program also validates that the public key used in the signature belongs to the signer and displays the signer's name.
The images above are from “Digital Signature diagram.svg” by Acdx used under CC BY-SA 3.0.
Examples of Verified Signatures
Now that you know how the digital signature process verifies the signer's identity and that no changes have been made, let's take a quick look at how that is communicated to people viewing the document. You can see in the screenshots below that both digitally signed Office documents and PDFs clearly display messaging about the validity of the signature and the content.
Example digital signature in Microsoft Word
Example digital signature in Adobe Acrobat
Verifying the signer's identity and protecting document integrity are two of the biggest concerns people have when moving away from paper-based signatures. I hope this post helped shed some light on how digital signatures cover off on both.
