Digital Signature Technology

Exchanging documents over the web is common in e-commerce. Such documents usually contain sensitive information—for example, legal contracts, data regarding technological innovation, money transactions. to forestall hackers from intercepting and reading e-commerce documents traveling through e-space, you need to encode those documents. If you would like your documents to be really secure, however, you need to sign them digitally. A digital signature on AN e-commerce document is a warrantor of information origin, integrity, and nonrepudiation. once a client digitally signs a web commercial document, for instance, the merchandiser—through the document’s digital signature—can determine the client UN agency originated the order, will verify that nobody tampered with the contents of the order in transit, and has proof that a selected client created a particular order.

Digital signatures are with US since 1976, once Diffie ANd dramatist introduced the digital signature as an application of public key cryptography. solely recently, however, have businesses and governments began to use digital signature technology to safeguard sensitive documents on the globe Wide internet. In Sept 1998, President Clinton ANd Irish Prime Minister Bertie Ahern digitally signed an intergovernmental e-commerce document that’s the world’s initial such document to use digital signature technology. Microsoft used digital signature technology to develop Authenticode technology, that secures Web-downloadable codes.

As the would like for digital signature online technology grows, many software package corporations, together with Entrust Technologies and Network Associates, have delivered industrial security software package that lets users use digital signatures to secure e-commerce documents. during this article, i am going to make a case for digital signature technology. i am going to conjointly discuss some presently obtainable digital signature software package merchandise and provide tips to assist you propose your company’s digital signature answer.

What Is a Digital Signature?

Digital signature technology grew out of public key cryptography. publically key cryptography, you’ve got 2 keys: a non-public key and a public key. once you send a document to somebody, you employ your personal key to sign the document. once recipients receive the signed document, they use the sender’s public key to certify the document.

Figure one illustrates the digital signature method. Suppose you would like to send a digitally signed document to John. once you produce the document, you pass it through a message hash formula. The formula generates a hash of the document that’s a substantiation of the contents of the document. You then encode the message hash together with your personal key. The result’s a digital signature. You append this digital signature to the document to create a digitally signed document, then send it to John.

When John receives the document, he passes the document contents through a similar message hash formula that you simply used, and creates a brand new hash. At a similar time, John uses your public key to decipher your digital signature, thereby changing the signature to the first hash. John then compares the recently generated hash and therefore the original hash. If the hashes match, John may be positive that the document he received is absolutely from you which nobody altered it throughout transmission. If the hashes do not match, John is aware of that meddling or a transmission error modified the document contents.

The most unremarkably used message hash algorithms area unit Message Digest five (MD5) and Secure Hash formula one (SHA-1). MD5 will manufacture a 128-bit hash, and SHA-1 will manufacture a 160-bit hash. The hash formula may be a unidirectional perform that generates a unidirectional hash. Therefore, nobody will derive original document contents from a message hash. the possibility that 2 documents can have a similar hash is sort of zero. for instance, the likelihood that MD5 can output a similar hash for 2 completely different documents is 1/2128. (2128 interprets into regarding one,500 documents for each centare of the surface.)

A digital signature is superior to a conventional written signature. a talented forger will alter the contents of a document with a written signature or move a signature from one document to a different while not being detected. With digital signature technology, however, any modification in a very signed document—such as content modification or signature replacement—causes the digital signature verification method to fail.

Public Key Trust Models

The personal key that you simply use to sign documents belongs to you alone. you would like to stay your personal key secure: for instance, you’ll be able to encode a non-public key in your laptop or store it in a very password-protected smartcard. In distinction, you would like to publish your public key in order that recipients of documents you send will use your public key to verify your signature. you may publish your public key in your company directory, in order that different users will access it, otherwise you would possibly send your public key on to different users, UN agency can store it in their laptop.

Before users UN agency receive documents from you’ll be able to verify your digital signature, they need to have the way of knowing that your public secret is real. while not assurance that a public secret is legitimate, trusting whether or not a signed document and its attendant public key area unit from the acknowledged sender may be risky. A hacker will use your name to come up with a false public key combine, produce a document and use the false personal key to sign it, then send the signed document and false public key to John. Therefore, you and John should establish a public key trust relationship before exchanging documents.

There area unit 2 public key trust models: trust and third-party trust. within the trust model, you and John apprehend and trust one another directly and exchange public keys in person or firmly. within the third-party trust model, you and John may not apprehend one another directly, however you each trust a 3rd party or middleman to exchange your keys. for instance, if you and John each trust Peter, then you and John will trust one another. once Peter offers your public key to John, John will believe the secret is very yours. The trust model works for tiny teams or corporations within which folks apprehend and might contact each other directly. The third-party trust model is a lot of suited to massive corporations and intercompany relationships within which folks may not apprehend each other or cannot contact each other directly.