A digital signature is a cryptographic value created with a private key that lets a verifier check the integrity of signed data using the matching public key.

Signatures support trust in identity assertions and other electronic messages. A receiving service can detect a change to the signed content and verify its connection to a signing key. To associate that key with a person or organization, the service also needs a trusted registration or certification process.

How a digital signature is verified

The signer applies a signature algorithm to the data using its private key. Depending on the scheme, hashing is part of that process. The verifier uses the matching public key and algorithm to check the signature against the exact data received.

Changing the signed content should cause verification to fail. Verification also fails when the signature does not match the public key or the required algorithm. Applications should use maintained cryptographic libraries and accept only algorithms allowed by their protocol and policy.

A valid signature is one step in evaluating an identity message. The receiver may also need to check its intended audience and expiration. A correctly signed assertion can still be unsuitable for the application that received it.

Where signatures appear in identity systems

An identity provider can sign an assertion so a customer application can verify its source and integrity. Passkey authentication similarly uses a signature to prove control of a registered credential in response to a challenge.

For example, a benefits portal receiving a signed authentication assertion should verify the provider’s key and then check that the assertion was issued for that portal. Accepting any validly signed assertion from a familiar provider would overlook the context in which it was issued.

Digital certificates also contain an issuer’s signature. That signature protects the certificate’s binding between identity information and a public key. It does not make the certificate holder’s later actions automatically authorized.

What a signature does not establish

A signature does not encrypt its signed content. Someone who can read the message can generally read it even when the signature is valid; confidentiality needs separate protection.

Nor does a signature, by itself, prove a particular human knowingly approved a transaction. An application may sign automatically, or a private key may have been compromised. Key custody and the process surrounding the signing operation determine what conclusions are justified.

“Electronic signature” is a broader term for signing electronically. A digital signature is a specific cryptographic mechanism that may be used within that process. Legal effect depends on the applicable context and requirements, not only on successful cryptographic verification.

Frequently asked questions

Does a digital signature hide the message?

No. It supports integrity and verification against a signing key. Encryption is needed when the message also requires confidentiality.

Can a valid signature replace authorization checks?

No. A receiving application must still decide whether the message applies to it and whether the requested action is permitted.

Is a typed name always a digital signature?

No. A typed name can be part of an electronic-signature process, but a cryptographic digital signature requires a signing operation and verification key.

Related: Token-Based Authorization (JWT) · Verifiable Credentials · Identity Federation · Passkeys · Machine Identity · Authentication vs. Authorization