What is a Digital Signature?An introduction to Digital Signatures, by David Youd



Bob

(Bob's public key)


(Bob's private key)

Bob has been given two keys. One of Bob's keys is called a Public Key, the
other is called a Private Key.

Bob's Co-workers:

Anyone can get Bob's Public Key, but Bob keeps his Private Key to himself

Pat Doug Susan

Bob's Public key is available to anyone who needs it, but he keeps his Private Key
to himself. Keys are used to encrypt information. Encrypting information means
"scrambling it up", so that only a person with the appropriate key can make it
readable again. Either one of Bob's two keys can encrypt data, and the
other key can decrypt that data.

Susan (shown below) can encrypt a message using Bob's Public Key. Bob uses his
Private Key to decrypt the message. Any of Bob's coworkers might have access
to the message Susan encrypted, but without Bob's Private Key, the data is
worthless.

"Hey Bob, how about lunch at Taco Bell. I hear they have free refills!"

HNFmsEm6Un
BejhhyCGKOK
JUxhiygSBCEiC
0QYIh/Hn3xgiK
BcyLK1UcYiY
lxx2lCFHDC/A

HNFmsEm6Un
BejhhyCGKOK
JUxhiygSBCEiC
0QYIh/Hn3xgiK
BcyLK1UcYiY
lxx2lCFHDC/A

"Hey Bob, how about lunch at Taco Bell. I hear they have free refills!"

With his private key and the right software, Bob can put digital signatures on
documents and other data. A digital signature is a "stamp" Bob places on the
data which is unique to Bob, and is very difficult to forge. In addition, the
signature assures that any changes made to the data that has been signed can
not go undetected.

To sign a document, Bob's software will crunch down the data into just a few lines
by a process called "hashing". These few lines are called a message digest. (It
is not possible to change a message digest back into the original data from which
it was created.)

Bob's software then encrypts the message digest with his private key. The result
is the digital signature.

Finally, Bob's software appends the digital signature to document. All of the
data that was hashed has been signed.

Bob now passes the document on to Pat.

First, Pat's software decrypts the signature (using Bob's public key) changing it back
into a message digest. If this worked, then it proves that Bob signed the
document, because only Bob has his private key. Pat's software then hashes
the document data into a message digest. If the message digest is the same
as the message digest created when the signature was decrypted, then Pat
knows that the signed data has not been changed.

Plot complication...

Doug (our disgruntled employee) wishes to deceive Pat. Doug makes sure
that Pat receives a signed message and a public key that appears to belong
to Bob. Unbeknownst to Pat, Doug deceitfully sent a key pair he
created using Bob's name. Short of receiving Bob's public key from him
in person, how can Pat be sure that Bob's public key is authentic?

It just so happens that Susan works at the company's certificate
authority center. Susan can create a digital certificate for Bob simply
by signing Bob's public key as well as some information about Bob.

Bob Info:

Name

    Department

    Cubical Number

Certificate Info:

Expiration Date

    Serial Number

Bob's Public Key:

    


Now Bob's co-workers can check Bob's trusted certificate to make sure
that his public key truly belongs to him. In fact, no one at Bob's
company accepts a signature for which there does not exist a certificate
generated by Susan. This gives Susan the power to revoke signatures if
private keys are compromised, or no longer needed. There are even more
widely accepted certificate authorities that certify Susan.

Let's say that Bob sends a signed document to Pat. To verify the signature
on the document, Pat's software first uses Susan's (the certificate
authority's) public key to check the signature on Bob's certificate.
Successful de-encryption of the certificate proves that Susan created it.
After the certificate is de-encrypted, Pat's software can check if
Bob is in good standing
with the certificate authority and that all of the certificate information
concerning Bob's identity has not been altered.

Pat's software then takes Bob's public key from the certificate and uses it
to check Bob's signature. If Bob's public key de-encrypts the signature
successfully, then Pat is assured that the signature was created using Bob's
private key, for Susan has certified the matching public key. And of course,
if the signature is valid, then we know that Doug didn't try to change the
signed content.

Although these steps may sound complicated, they are all handled behind
the scenes by Pat's user-friendly software. To verify a signature, Pat need
only click on it.


(c) 1996, David Youd

Permission to change or distribute is at the discretion of the author

Warning: You may be missing a few lines of text if you print this document.
This seems to occur on pages following pages that have blank space near
the bottom due to moving tables with large graphics in them to the next
page so that the images are not split across pages. If this happens
to you, simply print out document in sections. (Ex: I have the problem on
page 4, so I print pages 1-3, then pages 4-5.)

数字签名 转载:http://www.youdzone.com/signature.html的更多相关文章

  1. 深入浅出HTTPS工作原理(转载)

    转载自: https://blog.csdn.net/wangtaomtk/article/details/80917081 深入浅出HTTPS工作原理 HTTP协议由于是明文传送,所以存在三大风险: ...

  2. Java Security:公钥私钥、数字签名、消息摘要是什么

    1. 鲍勃有两把钥匙,一把是公钥,另一把是私钥. 2. 鲍勃把公钥送给他的朋友们----帕蒂.道格.苏珊----每人一把. 3. 苏珊要给鲍勃写一封保密的信.她写完后用鲍勃的公钥加密,就可以达到保密的 ...

  3. 和安全有关的那些事(非对称加密、数字摘要、数字签名、数字证书、SSL、HTTPS及其他)

    转自http://blog.csdn.net/bluishglc/article/details/7585965 对于一般的开发人员来说,很少需要对安全领域内的基础技术进行深入的研究,但是鉴于日常系统 ...

  4. 使用数字签名实现数据库记录防篡改(Java实现)

    本文大纲 一.提出问题 二.数字签名 三.实现步骤 四.参考代码 五.后记 六.参考资料 一.提出问题 最近在做一个项目,需要对一个现成的产品的数据库进行操作,增加额外的功能.为此,需要对该产品对数据 ...

  5. RAS非对称加密与数字证书数字签名

    它用图片通俗易懂地解释了,"数字签名"(digital signature)和"数字证书"(digital certificate)到底是什么. 我对这些问题的 ...

  6. 【Java密码学】用Java数字签名提供XML安全

    简介 众所周知,XML在产品和项目开发中起着非常重要的作用.通过XML文档可以获取很多信息,还可以使用XML文件进行CRUD(增加.查询.更新和删除)操作.然而值得注意的是,我们如何确保XML中的数据 ...

  7. signature.html

    原文网址:http://www.youdzone.com/signature.html   阮一峰:http://www.ruanyifeng.com/blog/2011/08/what_is_a_d ...

  8. 公钥与私钥的理解,以及https的应用原理

    1.公钥与私钥原理1)鲍勃有两把钥匙,一把是公钥,另一把是私钥2)鲍勃把公钥送给他的朋友们----帕蒂.道格.苏珊----每人一把.3)苏珊要给鲍勃写一封保密的信.她写完后用鲍勃的公钥加密,就可以达到 ...

  9. 公钥与私钥,HTTPS详解

    1.公钥与私钥原理1)鲍勃有两把钥匙,一把是公钥,另一把是私钥2)鲍勃把公钥送给他的朋友们----帕蒂.道格.苏珊----每人一把.3)苏珊要给鲍勃写一封保密的信.她写完后用鲍勃的公钥加密,就可以达到 ...

随机推荐

  1. SQLSever语句(增、删、改、查)一、增:有4种方法1.使用insert插入单行数据

    SQL语句(增.删.改.查) 一.增:有4种方法 1.使用insert插入单行数据: 语法:insert [into] <表名> [列名] values <列值> 例:inse ...

  2. PL/SQL developer 11.0注册码

    PL/SQL developer 11.0注册码:product key:lhsw85g33x4p7leqk63hy8q28ffxzzvbxlserial No:193085password:xs37 ...

  3. 删除重复信息且要保留一条的(roacle的rowid另类用法)

    由于表的主键失效了(disable),导致导入了一些主键重复的数据,想保留唯一的一条, 最后发现其实可以用rowid来实现,不知道算不算是rowid的另类用法. delete /*+ parallel ...

  4. oracle中表记录被另一个用户锁住

    应用场景 在查询oracle表时,提示表记录被另一个用户锁住了 有可能是在使用了pl/sql工具后修改某个表记录时,加锁,或者发生故障异常退出,下次登录进去修改不了 查询锁 --查看数据库的锁的来源. ...

  5. Centos7查看关闭防火墙

    查看防火墙状态: firewall-cmd --state 关闭防火墙 service firewalld start 开机启动 service firewalld stop 禁止开机启动 syste ...

  6. java如何读写json文件

    在实际项目开发中,有时会遇到一些全局的配置缓存,最好的做法是配置redis数据库作为数据缓存,而当未有配置redis服务器时,读取静态资源文件(如xml.json等)也是一种实现方式,但是这有一个弊端 ...

  7. 【深入浅出-JVM】(9): 方法区

    概念 方法区是虚拟机规范定义的,是所有线程共享的内存区域,保存系统的类的信息.比如:类的字段.方法.常量池.构造函数的字节码内容.代码.JIT 代码 永久代.metaspace 是对方法区的实现. H ...

  8. 前端模拟数据接口json-server

    今天要找帮前端找一个可以实现数据接口模拟的工具.首先看到的mock.js这个.但是这个需要在页面里插入Mock.js我是要给小程序使用,所以不能这么插入.然后又找到了json-server这个Node ...

  9. 用shell脚本安装MySQL-5.7.22-官方版本多实例

    Install_CentOS7_MySQL57_multi_instance.sh #!/bin/bash #请提前准备好参数文件my.cnf PORT=3307 InitMySQL() { mkdi ...

  10. k8s认证及serviceAccount、userAccount

    1.概述 用kubectl向apiserver发起的命令,采用的是http方式,K8s支持多版本并存. kubectl的认证信息存储在~/.kube/config,所以用curl无法直接获取apis中 ...