A private key is needed to encrypt and create the signature or to convert contract language or other data into the unintelligible forms. The public key, whose numerical code is known to more parties than know the code for the private key, is then used to decrypt and read the document. Even if several people know a public key code, that information is not sufficient to derive the private key. Therefore, they cannot use their public key information to forge or alter a document sent by the holder of a private key. To further assure that the appropriate parties have sent, received or signed a contract and its specific language, a third party referred to as a certification authority is employed.
Certification authorities are vendors trusted by both parties to a business transaction.
They verify that the parties have received and signed agreements through the application of their key codes. The authorities also maintain secure repositories for electronic documents known as digital certificates, which are issued once the authority has verified the authenticity of the parties to a transaction. But similar protections don't exist for large business transactions. Now however, business transactions can be protected through the use of digital signatures that can be secured and verified for their authenticity. Parties conducting Internet transactions can do so with greater confidence, experts say.