AQA 7517 · Paper 2 · 4.5.6c

Digital
Signatures

Authentication · Non-repudiation · Integrity · Section 4.5

WHAT YOU'LL LEARN

Hash functions · Signing with private key · Verifying with public key · Non-repudiation

AQA SPEC LINK

4.5.6 — Digital signatures and their use

Why Digital Signatures?

Three Security Goals

AUTHENTICATION

Proves the message came from the claimed sender — not an impostor

INTEGRITY

Proves the message has not been tampered with since it was signed

NON-REPUDIATION

Sender cannot later deny having sent the message — signature is proof

Hash Functions

The Role of Hashing

A hash function converts any input to a fixed-length output (the hash/digest)

Deterministic — same input always gives same hash

One-way — cannot reverse a hash to get the original input

Avalanche effect — tiny change in input → completely different hash

Examples: SHA-256 produces 256-bit output regardless of input size

Creating a Signature

How to Sign a Document

1. Alice hashes her document → produces a message digest (e.g. 256 bits)

2. Alice encrypts the hash with her private key → this IS the digital signature

3. Alice sends the original document + signature to Bob

4. Note: only Alice could have created that signature (only she has her private key)

The document itself is NOT encrypted — it's still readable. Signature just proves authenticity.

Verifying a Signature

How to Verify a Signature

1. Bob receives document + signature. Gets Alice's public key (freely available)

2. Bob decrypts the signature with Alice's public key → recovers the original hash

3. Bob hashes the document himself using the same hash function

4. Bob compares the two hashes: if identical → valid; if different → tampered or wrong sender

Works because: only Alice's public key can decrypt something made with her private key.

What Signatures Provide

Security Properties in Practice

Authentication — signature verifies via Alice's public key → proves Alice signed it

Integrity — if anyone changes even one byte of the document, the hash won't match

Non-repudiation — Alice can't deny sending it; only she has her private key

Confidentiality? No — the document itself is not encrypted. For privacy, also encrypt with Bob's public key

Real-World Use

Where Digital Signatures Are Used

Software Updates

Windows and macOS verify software is signed by the developer — prevents malware masquerading as legitimate software

SSL/TLS Certificates

Website certificates are digitally signed by a Certificate Authority — proves the website is genuine

Email (S/MIME, PGP)

Signed emails prove the sender's identity; financial and legal organisations use signed email

Signatures vs Encryption

Combining Both for Full Security

Encryption alone: only provides confidentiality — doesn't prove who sent it
Signature alone: only provides authenticity/integrity — message readable by anyone
Both together: sign with sender's private key, then encrypt with recipient's public key

This combination gives: Confidentiality + Authentication + Integrity + Non-repudiation

AQA Exam Style

Practice Question

AQA 7517 — Paper 2 Style

(a) Describe how Alice creates a digital signature for a document. [3]
(b) Describe the steps Bob takes to verify Alice's digital signature. [3]
(c) State what is meant by 'non-repudiation' in the context of digital signatures. [1]
(d) A digital signature does not make a message confidential. Explain why. [1]

[8 marks]

3 marks

(a) Alice applies a hash function to the document to produce a message digest [1]. She encrypts the digest using her private key [1]. The encrypted digest is the digital signature, sent with the document [1]

3 marks

(b) Bob decrypts the signature using Alice's public key to recover the hash [1]. Bob hashes the received document using the same hash function [1]. Compares both hashes — if identical, signature is valid [1]

1 mark

(c) The sender cannot deny having signed/sent the message, as only they possess the private key used to create the signature

1 mark

(d) The document itself is not encrypted — only the hash is encrypted. Anyone can read the document contents.

Summary

Key Points to Remember

Signing — hash the document → encrypt hash with sender's private key

Verifying — decrypt signature with sender's public key → compare with fresh hash

Provides — authentication, integrity, non-repudiation (NOT confidentiality)

Non-repudiation — sender cannot deny signing because only they hold the private key

Used in software signing, TLS certificates, signed email, legal documents

🎉 Lesson complete — move to the quiz!