The private key is known only to the signer and used to create the signature. The public key is ordinarily more widely known and is used by a relying party to verify the digital signature. Another fundamental process, termed a hash function, is used in both creating and verifying the signature. A hash function is an algorithm, which creates a digital representation in the form of a hash value of a standard length, which is usually much smaller than the message but nevertheless, substantially unique to it. To further assure that the appropriate parties have sent, received or signed a contract, a third party referred to as a certification authority is employed.
Certification authorities are vendors trusted by both parties to a business transaction.
They verify that the parties have received and signed agreements through the application of their key codes. To associate a key pair with a prospective signer, a certification authority issues a certificate, an electronic record, which lists a public key as the subject of the certificate, and confirms that the prospective signer identified in the certificate hold the corresponding private key. To assure both message and identity authenticity of the certificate, the certification authority digitally signs it. The authorities also maintain secure repositories for electronic documents known as digital certificates, which are issued once the authority has verified the authenticity of the parties to a transaction. One problem with a digital certificate is where it resides once it is obtained.