Preventing Cyber Crime & Fraud: Digital signatures

This advice has been collated by East Midlands Special Operations Unit (EMSOU) to raise awareness among businesses and the public.

If you require any further information, assistance or guidance please contact the EMSOU Protect Team EMSOU Protect Team or your local Force protect team.

Today’s cyber topic is Digital Signatures

In the Middle Ages, when illiteracy was rife, wax seals were commonly used for things we would use a signature for today, such as authenticating a will or contract. The symbol or crest on an individual seal guaranteed the identity and integrity, and acknowledgement of the contents. Some medieval clergymen are reported to have plucked out their own beard hair and added it to the melted wax, to show that the seal was truly from them.

Today we authenticate the sender and content of a digital transmission by signing it.

A digital signature is totally unique to a person or an organisation and can demonstrate that the message has not been tampered with.

Why use a digital signature?
Digital signatures increase the transparency of online interactions and develop trust between customers, business partners and vendors.

How do they work?
To understand how a digital signature works and why they should be used, we first need to understand “hashing” and how it guarantees the content has not been changed.

Hashing: Take any digital content (pictures; files, folders, software, email) and run it though a mathematical algorithm to produce a unique string of characters, this is the “hash”. Even the slightest change to the content would produce a radically different “hash”.

If the recipient uses the same algorithm but gets a different “hash” then the message has been tampered with in transit and has no integrity.

To authenticate the sender of a message “Public Key Cryptography is used.

Public key cryptography: When encrypting or decrypting, we use a different type of mathematical algorithm. We call this algorithm the ‘key’. In public key cryptography, the sender will have two keys.

One key, is called the ‘private key’ and encrypts data, it is known only to the sender and can only be used by them.

The other key, is called the ‘public key’ and decrypts the data. This public key can be used by anyone and decrypting the data validates the sender.

Finally, we have the Certificate Authority (CA). This is a trusted third party that validates a person or organisations identity and either generates a public/private key pair on their behalf or lets them use the ones they have made. They issue a digital certificate which confirms the identity of the holder as well as their keys.