Digital signature: meaning, creation and verification

Meaning. Under section 2(1)(p) of the Information Technology Act, 2000, a “digital signature means authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with” section 3. Section 3 provides that “any subscriber may authenticate an electronic record by affixing his digital signature”.

Creation of a digital signature:

1. The authentication is effected by the use of an asymmetric crypto system and a “hash function, which envelop and transform the initial electronic record into another electronic record” (section 3(2)).
2. The hash function maps the record into another, generally smaller, set of bits, the hash result; the same record always yields the same hash result, and it is computationally infeasible to reconstruct the record from its hash result, or for two different records to yield the same hash result.
3. The subscriber's private key is used to create the signature: the hash result of the record is transformed with the private key, and the result, attached to the record, is the digital signature.

Verification. To verify means to determine whether “the initial electronic record was affixed with the digital signature by the use of” the private key corresponding to the public key of the subscriber, and whether the record has been retained intact or altered since it was signed (section 2(1)(zh)). The verifier uses the subscriber's public key, listed in his certificate: any person can verify the electronic record by the use of the subscriber's public key (section 3(3)); the private key and the public key are unique to the subscriber and constitute a functioning key pair (section 3(4)). In practice the verifier computes a fresh hash result of the record received, uses the subscriber's public key to recover the hash result carried in the signature, and compares the two: if they match, the record was signed with the matching private key and has not been altered.