Digital Signatures

A digital signature is used to validate the authenticity and integrity of a message or document. The digital signature is created using a private key and can be verified using the matching public key. Digital signatures do not secure the content while in transit, they are only used to assure the receiver that the sender sent the message, not someone pretending to be the sender, and that the message content has not been tampered with or changed while in transit. Digital signatures can be used in SOAP, SAML, XML and other web technologies.

There are two algorithms which are used with digital signatures. The sender first uses a "signing algorithm" to create the digital signature. The message, digital signature and certificate or public key are then sent to the receiver. If the sender does not include the certificate or public key, then the receiver must retrieve it some other way. The receiver then uses a "signature verifying" algorithm to check the digital signature.

The "signing algorithm" uses the message and the private key to produce a signature.

The "signature verifying" algorithm uses the message, the digital signature, and the public key to either accept or reject the message's claim to authenticity.

When a message is signed with a digital signature, the digital signature is usually sent with the message or inside of it. XML Signatures can be included in the XML itself or detached from the XML document they are signing. When the message and digital signature are additionally encrypted prior to being sent, the encryption should be done with a separate key pair so that the signing and encryption are separated and not both accomplished with the same key pair.