Digital Signature Verification

Public Key Infrastructure (PKI) is the framework of policies, hardware, software, and procedures that creates, manages, distributes, uses, stores, and revokes digital certificates and public-private key pairs. It establishes a chain of trust, enabling systems to verify that a public key belongs to a legitimate entity. PKI is the foundational system that makes digital signature verification scalable and trustworthy across untrusted networks like the internet.

• Certificate Authorities (CAs) act as trusted third parties that issue and sign digital certificates.
• Digital Certificates bind a public key to an entity's identity (e.g., a domain name).
• Root of Trust is the ultimate, pre-trusted certificate at the top of the certificate hierarchy.

JSON Web Signature (JWS) is an IETF standard (RFC 7515) for representing cryptographically signed content using JSON data structures. It defines a compact, URL-safe means of representing a digital signature or MAC (Message Authentication Code) applied to any payload, commonly a JSON Web Token (JWT). JWS is extensively used in API authentication (e.g., OAuth 2.0 bearer tokens) and secure message passing.

• Structure: A JWS has three parts: a protected header (specifying the algorithm), the payload, and the signature, often concatenated with periods (e.g., xxxxx.yyyyy.zzzzz).
• Algorithms: Supports various signing algorithms like RS256 (RSA with SHA-256) and ES256 (ECDSA with SHA-256).
• Verification: The recipient must validate the signature using the signer's public key and ensure the header and payload have not been tampered with.

Hash-Based Message Authentication Code (HMAC) is a specific construction for calculating a message authentication code (MAC) involving a cryptographic hash function (like SHA-256) and a secret key. It provides both data integrity and authenticity verification, confirming a message originated from the holder of the secret key and was not altered. Unlike digital signatures, HMAC uses a symmetric key shared between parties.

• Use Case: Commonly used to verify webhook payloads (e.g., GitHub, Stripe webhooks). The sender signs the payload with a shared secret, and the receiver recomputes the HMAC to validate it.
• Verification Process: The receiver independently computes the HMAC of the received message using the shared secret and compares it to the transmitted HMAC.
• Contrast with Digital Signatures: HMAC requires a pre-shared secret, while digital signatures use a public/private key pair, enabling verification by anyone with the public key.

Elliptic Curve Digital Signature Algorithm (ECDSA) is a cryptographic algorithm used for digital signature generation and verification. It provides the same functionality as RSA but is based on elliptic curve cryptography (ECC), offering equivalent security with much smaller key sizes, leading to faster computation and reduced bandwidth.

• Key Size Efficiency: A 256-bit ECDSA key offers security comparable to a 3072-bit RSA key.
• Widespread Adoption: Used in blockchain systems (Bitcoin, Ethereum), TLS certificates, and modern API security standards like JWT's ES256 algorithm.
• Verification Process: The verifier uses the signer's public key (a point on the elliptic curve), the original message hash, and the received signature components (r, s) to mathematically confirm the signature's validity.

Code signing is the process of digitally signing executables, scripts, software updates, or drivers to confirm the author's identity and guarantee that the code has not been altered or corrupted since it was signed. It is a critical application of digital signature verification for software distribution and secure boot processes.

• Trust in Distribution: Users (or their operating systems) can verify the signature against a trusted certificate to ensure the software is from a legitimate publisher and is intact.
• Prevents Tampering: Any modification after signing invalidates the signature, triggering security warnings.
• Common Standards: Uses PKI and standards like X.509 certificates. Platforms like Windows Authenticode and Apple's Gatekeeper rely on code signing.

A Timestamp Authority (TSA) is a trusted third-party service defined in RFC 3161 that provides cryptographic proof that a specific piece of data existed at a certain point in time. It does this by issuing a timestamp token—a digital signature over a hash of the data plus a trusted time source. This is crucial for non-repudiation in digital signature verification, proving a signature was applied before a signing certificate expired or was revoked.

• Long-Term Validation (LTV): Enables the verification of digital signatures years later, even after the signer's original certificate has expired.
• Process: The signer sends a hash of the signed document to a TSA, which returns a signed timestamp token.
• Standard Format: Often implemented using Time-Stamp Protocol (TSP) and embedded in signature formats like CAdES and PAdES.