Talk:Digital signature

message: In Canadian law, a secure electronic signature can be used (most) everywhere a notarized signature or Minister's signature is required. In other words, this specific form of electronic signature is considered as strong as the strongest form of "ink-and-paper" signature. (The PIPEDA S-E-S regulations can only be satisfied with digital signatures.)
Why do we care? Because there are places where the analogy isn't an analogy, it's a homology: Present a notarized signature on a paper document and a secure electronic signature on the homologous electronic document to a Canadian judge and the judge will likely conclude that for legal purposes they are they same signatures and the same documents. Neither has any greater or lesser standing that the other.
And this needs to be borne in mind when this page is rewritten, especially when the section on legality is rewritten.
Think of it this way: For anyone other than an autograph hound, a signature is of interest for its legal value. Ultimately, the same is true of digital signatures. The technology may be interesting, but, ultimately, the reason we want to get the technology (and procedures and policy) right is so that these things stand up in a court of law.
Perhaps the page needs to be broken into two overall sections: Technology (just the facts) and legality (with no overall content but references to various jurisdictions.
Alternatively, remove any subjective or legal content, and make reference to appropriate pages.
For example, repudiation is not a fact, it is a legal matter.
PeterWhittaker (talk) 17:52, 1 October 2008 (UTC)
thread_title: Where the analogy holds

message: "Unlike a traditional handwritten signature a digital signature may be generated automatically, without the knowledge of the authorized user", "paper signatures can be copied [or] created under coercion", "However, if the right software is used in the right way, including not leaking the private key, then the digital signature on some message can be created only by definite actions of the person in question, therefore validating the use of digital signatures." are all mutually exclusive.
I'm not claiming to be able to write definitively on this subject, but this just reeks...
Dtada69 Btada69 (talk) 02:23, 12 December 2013 (UTC)
thread_title: This bit is just garbage and needs rewritten

message: Many of the legal enactments (statute or regulation) surrounding digital signatures is concerned with their admissibility as evidence. More controversial, however, is their actual value as evidence. Unlike a traditional handwritten signature, a digital signature may be generated automatically, without the knowledge of the authorized user. However, very few can reliably prove a handwritten signature is legitmate, too, since paper signatures can be copied, created under coercion, few have handwritten signature cards to compare against, pages may have been changed after the signature was applied, etc.  A digital signature is generated by complex software, operating on an operand whose nature and existence cannot be fully or directly verified by the authorized user. Whereas the existence of a digital signature can be evidentially significant in establishing that an electronic communication is uncorrupted, and that it had a certain provenance, it cannot of itself provide any evidence as to whether a particular individual intended or authorized or associated himself or herself with any such communication. In that regard, the term "signature" is potentially misleading as the engineering does not know, and may possibly not be able to coincide with, the assumptions underlying many of the legal enactments. Legal enactments which affirmatively declare that a digital signature is presumptively deemed a valid signature are at variance with the possibilities afforded by the cryptography.
However, if the right software is used in the right way, including not leaking the private key, then the digital signature on some message can be created only by definite actions of the person in question, therefore validating the use of digital signatures.
I.K. 03.12.2009: I can not agree with aforementioned doubts. If system-generated digital signature is technically possible, all comes down to credibility of implementer.
We need some practical examples here. One from my experience - in Estonia every person has digital signature linked to their personal ID-card. For usage one must have valid ID card and two PIN codes - for authentication of person and for actual signing. This kind of digital signature is for all purposes deemed more secure than handwritten signature - for example one does not have to have his his digital signature proved by notary in most if not all actions where notary is required in case of handwritten signature. This digital signature solution is cornerstone of Estonian E-State solution: for example citisens portal - https://portaal.riik.ee/x/kodanik/ - enables to access many public databases, have ones taxes declared, participate on e-elections etc. In business, for example people do not need to gather for signing mutually signed documents (Board meeting decisions etc) as after teleconference meetings documentc can either be e-mailed and signed or posted on designated central website (https://digidoc.sk.ee/) where documents can be securely stored, signed, shared etc.
When signing document(s) .ddoc file is created. It has nothing to do with Microsofts .doc files. Actually, one can sign either 1 file, or several - in which case bundle is created which from onwards has appearance of one .ddoc file - until bundle is opened, in which case all files can be separately seen and read but not saved back into bundle - for obvious reasons files will lose signture after edit. File type (doc, xls, txt, jpeg) is not important, system supports all file types.  —Preceding unsigned comment added by 217.159.213.182 (talk) 08:50, 3 December 2009 (UTC)
thread_title:  Evidential status 

message: The current article mingles too much digital signatures and encryption. It might give the reader the impression that by digitally signing, the message also becomes encrypted. Though public key encryption is also used in encryption, the purpose of signing is not encryption. There are two reasons why private keys for digital signatures should not be used to encrypt.
*First quite often you might want something signed (digitally) but readable by everyone. E.g. diplomas, birth certificate, identity certificates, drivers license, the fact that you are the owner of something, etc... These should be in plain text but the digital signature is used to verify that they are not forged.
*Secondly, and much more important, the fact that you engage in an encrypted conversation does not mean that you want to sign all these messages in a legal sense. E.g. I might have an email conversation with a Rolls Royce dealer about buying a car, but this does not mean that I signed an electronic contract with that dealer. For that reason it is advised to use separate private keys for encryption and digitally signing. If a signed document needs to be encrypted, encryption is used on top of the signing.
Wintermute314 14:17, 13 May 2006 (UTC)
replies: text: Agreed (now that I've finally noticed this comment). And I remeber that I'd noted this in my last major edit. I'll look again. ww 15:46, 27 July 2006 (UTC)
thread_title:  Digital signatures use encryption techniques, but are not used to encrypt 

message: Greetings Wikipedia Crypto editors.
First of all, I am not a crypto-anything.  I'm simply trying to learn enough from these pages to give me a good working grasp of the technology, from a practical, everyday point of view.  That said, may I suggest inclusion of the following  section, probably somewhere near the top, which clears up an aspect of digital signatures that I was finding particularly confusing..
"In the context of pens and sheets of paper the term signature
refers solely to the name of the document author scribbled at the
bottom of the page.  If his signature is to attest to the document's
authenticity, the author must use the same signature each time he
signs a document.
A digital signature, on the other hand, is the result of
encrypting some digital information with a private key.  Thus, a
digital signature contains the information it is attesting to (in
encrypted form) and will be different for each different set of
information.
:The last entence above is not necessarily so for some types of digital signature. Admittedly, not so useful a type, but... ww 15:50, 27 July 2006 (UTC)
replies: text: Mostly, yes. ww 15:50, 27 July 2006 (UTC)

text: You've got more of it than most people do. Consider yourself a crypto cognocenti, for someone who's only intested in the practical side. ww 15:50, 27 July 2006 (UTC)
replies: text: So just to be clear on this, verification of a signature involves decryption into plain-text, using the public key.  Why is it so hard for people to say this? I read most of a book and half a dozen websites, and it still was not easy to determine that signing and verification is essentially the same as encryption & decryption, but just the other direction (private key to public key instead of public to private), but in both cases you can get back to plain-text. Nerfer (talk) 20:14, 3 December 2013 (UTC)
thread_title:  Clarification of the use of the word ''signature'' in the term 'digital signature' 

message: The history section in this article is the same as in electronic signature. This is confusing. Since it is made clear that digital sigs are a special case of electronic sigs and there are already links to electronic signatures, I propose to delete the history section in this article. --Wintermute314 13:50, 11 June 2006 (UTC)
replies: text: I think I'm the culprit. I left it in both articles as a way to head off some of the misconceptions so many acquire. WP being a didactic and informative medium, it's an obligation of editors to head off common confusions if possible. i agree that the duplication offends a sense of prsimony, mine included, but I assuaged mine with the observation that a reader who didn't do what I would prefer him/her to do (namely follow the links out, and weld the info found into a coherent whole) will be misled in a subtle way by omission. I've wrenched myself to a point of aggrieved acceptance. Perhaps it's an invitable result of an encyclopedia sort of format? ww 15:56, 27 July 2006 (UTC)
thread_title:  Remove history section?  

message: I understand that there is a large number of people that feel the same regarding electronic vs digital. I agree that an electronic signature does not mean that a cryptographic solution is present. However we also cannot assume that a PKI/Cryptographic solution is the ONLY way to capture a digital signature. It is merely ONE way out of many.
:Agreed. It is only one of many, PKIs not being what the legal beagles had assumed they would become a decade ago when they began enacting and all. But it (or the general class, there are several crypto signature algorithms) is the only sort which can provide robust security if used correctly. PKI is not a useful distinction. ww 16:01, 27 July 2006 (UTC)
replies: text: Readers cna indeed drill down. The Average Reader cannot be expected to do. See my comments (re Wintermute's observations) about an intent to be achieved in these two articles. ww 16:01, 27 July 2006 (UTC)

text: It would indeed do so. My last major edit of these tried not to do so. I'll take a look to see if that remains. ww 16:01, 27 July 2006 (UTC)
thread_title:  Why does [[Digital Signature]] have to only focus on [[PKI]]? 

message: A recent edit changed "Furthermore, there is no efficient way to modify a message and its signature to produce a new message with a valid signature, because this is still considered to be computationally infeasible by most cryptographic hash functions (see colission resistance)." to "Furthermore, there is no efficient way to modify a message and its signature to produce a new message with a valid signature, because this would be a type of forgery.
I consider the revision incorrect, because whether or not an alteration is a type of forgery has nothing to do with whether or not there is an efficient way to modify a message and produce a valid signature. Indeed, it is because some digital signature schemes make it extremely inefficient to modify a message and produce a valid signature that those schemes are attractive.
Mangojuice provided this edit summary: "revise; signatures don't always involve hashes; when they do, hashes are just another type of integrity guarantee." I don't disagree with the edit summary, but if the text needs modification, we need to find a formulation that does not reverse cause and effect. --Gerry Ashton 17:47, 14 February 2007 (UTC)
replies: text: I suspect what Mango was aiming at was something along the lines of "...would be detectable as a type of forgery." I agree with you that your interpretation of his edit suggests an unfortunate conclusion for some readers. Please change it. ww 20:37, 14 February 2007 (UTC)
replies: text: The old text seems to imply that both (1) signature schemes are always used with hash functions, and (2) it's the hash function that provides the integrity property; both are false.  In any case, we should probably rewrite that section because integrity is an implied sub-property of authentication anyway (and I'm not aware of any applications that use digital signature schemes when only integrity is sought: they'd just use a hash function or a checksum instead, much cheaper).  Mangojuicetalk 02:54, 15 February 2007 (UTC)
thread_title: Cause and effect

message: Can someone please talk about the digital signed emails? Jackzhp 21:20, 27 April 2007 (UTC)
thread_title:  Digital signed email 

message: The recent edit to this section reminds me of some points that might be made in this section, but I don't have sources:
*If cryptographically secure timestamps are used, and a key-holder can identify when a key was compromised, the key-holder can repudiate only those signatures that were signed after the compromise date.
*I understand that some CAs delete all expired keys from their database, no matter whether they merely expired, or if they were revoked. Thus, a person verifying a signature must assume all expired keys were compromised and revoked, since there is no way to verify that the key merely expired in the normal course of events. --Gerry Ashton 15:21, 6 July 2007 (UTC)
replies: text: This shows the danger in even discussing non-repudiation techniques without context.  Digital signatures alone or with a basic PKI are vulnerable to repudiation.  Modifications to the model (such as, for instance, key revocation lists, or other techniques) can circumvent repudiation.  Some standard techniques deserve coverage, and can be linked from here (eg Key revocation list).  Note that non-repudiation isn't needed in all applications, particularly ones that use signatures ephemerally.  More could probably go at Non-repudiation, though.  Mangojuicetalk 17:12, 6 July 2007 (UTC)

text: Would you suggest some other term instead? --Gerry Ashton (talk) 17:50, 1 October 2008 (UTC)

text: I see nothing in your argument that is relevant to use of the words "repudiation" or "non-repudiation" in a technical context, and nothing in this article that uses those words outside of a technical context. To use an example from Wikipedia, something might well be wikt:notable without being WP:Notable; perhaps the choice of terminology is unfortunate, but trying to argue something is WP:Notable by using the definition of wikt:notable isn't going to get you anywhere. Anomie⚔ 21:06, 1 October 2008 (UTC)

text: tl;dr. You still seem to be hung up on the legal definition of the term to the exclusion of the technical definition, which is unfortunate as the technical definition is what is in question here. The "notability comment" was an analogy. Anomie⚔ 12:01, 2 October 2008 (UTC)

text: I'm with ww here.  This is not about repudiation the legal term at all.  If this discussion belongs anywhere, it belongs in the (poorly developed) Digital signatures and law page, which could probably use a lot more content.  Mangojuicetalk 02:13, 16 October 2008 (UTC)
thread_title: Non-repudiation

message: Quoting from the above, the key-holder can repudiate only those signatures: I talked about this recently with a former private sector contracts lawyer whose current responsibilities with the Canadian federal government include interpreting statute and policy in this area. The lawyer's comment was basically that the quoted statement is flat out wrong: Any signature, ink-and-paper or electronic (secure, digital, whatever) can be repudiated. The issue is always whether the repudiation can be justified.
For example, put a gun to my head and I will quite happily enter my password and create a secure electronic signature authorizing you to do pretty much anything! Now, by Canadian law, I've just created a binding digital signature that identifies me as the signer and one that carries an evidentiary presumption under the Canada Evidence Act, a presumption that the signed electronic document is exactly what you claim it to be: An authentic authorization that somehow benefits you.
And of course I will repudiate it! And with the right evidence, I'll win. So I will have successfully repudiated something all of us technologists like to describe as non-repudiable.
Extreme example, I know, but carefully considering it and what that lawyer told me led me to eliminate the term non-repudiation from my vocabulary: It is pretty much useless to a lawyer or a judge, misleading for business executives and policy makers, and used only by technologists who are hoping to bring black-and-white to a grey area.
As far as I can tell from my research, the term "non-repudiation" was invented by technologists and has no legal meaning. I'd love to see statute examples to the contrary (quote me legs and regs and case law, in that order, and nothing else, 'cause those trump everything else when a judge speaks...).
End rant. I just get nervous when I see this term being used in an otherwise sophisticated discussion.  —Preceding unsigned comment added by PeterWhittaker (talk • contribs) 17:40, 1 October 2008 (UTC)
replies: text: Would you suggest some other term instead? --Gerry Ashton (talk) 17:50, 1 October 2008 (UTC)

text: I see nothing in your argument that is relevant to use of the words "repudiation" or "non-repudiation" in a technical context, and nothing in this article that uses those words outside of a technical context. To use an example from Wikipedia, something might well be wikt:notable without being WP:Notable; perhaps the choice of terminology is unfortunate, but trying to argue something is WP:Notable by using the definition of wikt:notable isn't going to get you anywhere. Anomie⚔ 21:06, 1 October 2008 (UTC)

text: tl;dr. You still seem to be hung up on the legal definition of the term to the exclusion of the technical definition, which is unfortunate as the technical definition is what is in question here. The "notability comment" was an analogy. Anomie⚔ 12:01, 2 October 2008 (UTC)

text: I'm with ww here.  This is not about repudiation the legal term at all.  If this discussion belongs anywhere, it belongs in the (poorly developed) Digital signatures and law page, which could probably use a lot more content.  Mangojuicetalk 02:13, 16 October 2008 (UTC)
thread_title:  A term we should avoid 

message: Update Needed. More about DKIM please.195.38.17.129 (talk) 13:38, 12 March 2009 (UTC)
replies: text: Do you mean DomainKeys Identified Mail? If so, feel free to find a spot in the article to provide a link to that article. --Jc3s5h (talk) 13:52, 12 March 2009 (UTC)
thread_title: DKIM

message: It seems to me this article misses completely the most important part at all: a simple explanation on how a digital signature is generated and attached to a document. Both Definition and History chapters explains a bit of the procedure, but both fails to do so properly. The first diagram is useful for understand the whole procedure, but, again, it is not explained enough: note a certificate is depicted there and the term is is not even mentioned in the text, let alone explained! I think this has to be fixed. Luca Mauri (talk) 15:03, 19 April 2009 (UTC)
replies: text: The diagram is misleading. Signatures are not "attached" to documents. The word "attached" has no meaning in this context. A signature is generated using one of the algorithms, each is different. I do not know what certificate is meant to mean in this context. I believe the diagram should be replaced. Skippydo (talk) 21:19, 20 April 2009 (UTC)
replies: text: Are you expert enough in the field to make one better? I am not, unfortunately.Otherwise we could try to ask User:Acdx if he can fix it. --Luca Mauri (talk) 08:42, 26 April 2009 (UTC)

text: Yes, this is totally misleading. I was really confused about encrypting with private key and decrypting with public key.
hsidlagh (talk) 21:11, 20 August 2014 (UTC)
thread_title: Explanation and diagram

message: Since the phrase "Digital Signature" is used by modern versions of the windows operating system, and indeed, the warning about software not having one is almost ubiquitous, there should be a section on how digital signatures are used to verify the publisher of software (as implemented in windows), or a link to an article focused on this topic. I came to this page looking for information on it (particularly, why almost no installers are signed), and while there's plenty of content that is relevant to people interested in cryptography and advanced security, there is nothing about the most visible (to a lay person) use of this technology.
38.113.0.254 (talk) 16:45, 7 January 2010 (UTC)
replies: text: This would be an interesting, but complex topic. I am not qualified to write such an article, but I understand there are many varieties of digital certificate. Just in the freestanding software arena, there are signatures good enough for general applications, and a stricter standard for those that could affect the kernel in a way that could compromise digital rights management (which allows videos to be displayed on the screen but not copied). Then there are all the ways to sign extensions for Microsoft Office applications, plus all the other vendors who sell or give away extensible software that runs on Windows. --Jc3s5h (talk) 19:01, 7 January 2010 (UTC)
thread_title:  Digital signatures in the Windows Operating System  

message: "... the digital signature on the last page will indicate tampering if any data on any of the pages have been altered, but this can also be achieved by signing with ink and numbering all pages of the contract."  (emphasis added)
Numbering a physical contract's pages does not make them tamper-proof.  It seems fairly obvious that this cannot be compared favorably with the cryptographic hash and signature of a digital document.  — Preceding unsigned comment added by Zombiedeity (talk • contribs) 06:21, 6 November 2013 (UTC)
thread_title: Inaccuracy in Digital signatures vs. ink on paper signatures

message: Hello fellow Wikipedians,
I have just added archive links to  on Digital signature. Please take a moment to review my edit. If necessary, add  after the link to keep me from modifying it. Alternatively, you can add  to keep me off the page altogether. I made the following changes:
*Added archive https://web.archive.org/20141109180215/http://www.naa.gov.au/recordkeeping/er/Security/6-glossary.html to http://www.naa.gov.au/recordkeeping/er/Security/6-glossary.html
When you have finished reviewing my changes, please set the checked parameter below to true to let others know.
Cheers. —cyberbot IITalk to my owner:Online 16:02, 28 August 2015 (UTC)
thread_title:  External links modified 

message: In the Definition section, the following is shown:
:on input 1n, where n is the security parameter
I assume that "1n" does not mean "one to the power n", since that would be silly.  Perhaps someone should clarify what it means in the article, so those without the math background will understand. 99.246.86.48 (talk) 16:55, 1 September 2016 (UTC)
replies: text: Added reference to unary number system. 99.244.233.91 (talk) 19:16, 5 November 2016 (UTC)
thread_title:  Clarification for those who are not math experts 

message: Hello fellow Wikipedians,
I have just modified one external link on Digital signature. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20060925104000/http://enterprise.state.wi.us/home/strategic/esig.htm to http://enterprise.state.wi.us/home/strategic/esig.htm
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 17:07, 10 September 2017 (UTC)
thread_title:  External links modified 

message: I feel this 'original' image  used until 15 October 2019 is a better representation then . In the new image the yellow "Verify" step is basically the same as the green "True" step. I think it is better to use the 'original' image and maybe add additional information in the accompanying text. Shall we change it back to the 'original' image? --FlippyFlink (talk) 08:14, 23 July 2020 (UTC)
replies: text: Go ahead. I just added a "Verified" message to the original for clarity. Josedanielsteller (talk) 08:25, 26 July 2020 (UTC)
replies: text: Oké, changed the image back again and also changed the signature in yellow. FlippyFlink (talk) 11:40, 26 July 2020 (UTC)
thread_title:  Better signing image? 

message: I'd like to see mention of 'Chameleon Signatures' : https://www.ndss-symposium.org/wp-content/uploads/2017/09/Chameleon-Signatures-paper-Hugo-Krawczyk.pdf, in this topic, notable for the way they don't allow the recipient of the signature to disclose the contents of the signed material without the signers consent.  — Preceding unsigned comment added by Inkhorn (talk • contribs) 12:06, 20 October 2021 (UTC)
replies: text: Lots of researchers are constantly publishing new digital signature variations. I don't think any of them should be included in this overview article until it is proven they are being used by a significant number of people. Jc3s5h (talk) 14:40, 20 October 2021 (UTC)
thread_title: Chameleon signatures

message: @Jc3s5h There is no distinction in cryptography between 'authenticity' and 'integrity' provided by digital signatures.
If you know a public key, then you can verify signed messages made by the corresponding private key or detect forgeries.  When a digital signature scheme detects a forgery, it does not distinguish whether the forgery was caused by an intelligent adversary deliberately trying to fool you or a mindless adversary like a cosmic ray flipping a bit at random in your RAM.  And without prior knowledge of a public key, a digital signature tells you nothing about a message.
The 'authenticity/integrity' distinction is a pop science interpretation with no basis in cryptography, and presenting digital signatures as if there were such a distinction is counterproductive for understanding what digital signatures do and don't do—leading people into misapprehensions like thinking that without a public key a signature can be used to verify 'integrity' but not 'authenticity'.  If you want to keep it in such a prominent place, please provide citations to the cryptography literature on digital signatures that make a real distinction.  The current citation is to a marketing blog by an HR company.
References:
# The concept of digital signatures was first published in Diffie and Hellman, New Directions in Cryptography, 1976.
# The first secure digital signature scheme in history was Rabin signature, described in Rabin's 1979 tech report.
# The modern notion of security of digital signatures was formalized in Goldwasser, Micali, and Rivest, A digital signature scheme secure against adaptive chosen-message attacks, 1988.
# Goldwasser and Bellare's lecture notes present the modern definition of digital signature security in textbook form.  Other respectable textbooks like Galbraith's Mathematics of Public-Key Cryptography provide the same definition, in a much more technical presentation that isn't suitable for a broad audience (and isn't freely available on the web as far as I know), which is why I didn't add another citation here.
None of these references make any distinction between authenticity and integrity, because there is none to be made at a technical level.  Other than additional nonstandard security properties (like nonmalleability) or extension to the multi-user setting, the notion of security provided by a digital signature scheme, EUF-CMA, hasn't changed since GMR 1988. Taylor Riastradh Campbell (talk) 21:52, 11 June 2023 (UTC)
thread_title:  Distinction without a difference: authenticity and integrity