Digital signature: what is it and how does it work?

Digital signatures allow to authenticate a document’s signature by attributing it to an individual and ensuring the information integrity.

Thanks to a process based on public encryption and private decryption, a remotely signed document backed by a digital certificate can prove its authenticity. 

This type of signature, which is more secure than electronic signatures, makes it easier to sign contracts and all kinds of official documents remotely without compromising your security. 

Since it is a universal method that is spreading in the information society, in this article we will discuss what a digital signature is and how it works. 

What are digital signatures?

Digital signatures are signatures on computerized documents that are guaranteed to be associated with a non-transferable digital certificate that proves the identity of the signer and complies with worldwide legal requirements.

This type of signature creates a digital fingerprint that is unique to a person or entity and protects the integrity of a document or message. It certifies that the document has not been altered in any way since it was signed.

Unlike electronic signatures or e-signatures, digital signatures are more secure and can be used in official agencies and processes.

Why are digital signatures secure?

The fact that digital signatures are backed by a digital certificate provides proof of the signer’s identity. 

The signature is cryptographically linked to the document being signed and to the person or entity signing it. 

As a result, a digital signature provides the following guarantees:  

• Identification of the signer. 
• Authenticity of the signature. 
• Integrity of the signed document, certifying that it has not been modified or altered after being signed. 
• Traceability of the signature, which in some documents leaves a time stamp that can be notarized.

This type of signature thus creates a unique digital fingerprint for each signature. 

How does a digital signature work?

In order to have a digital signature, it is necessary to associate it with a digital certificate issued by an authorized certification authority, who is the entity providing the tool used to accredit the identity of the signing person or entity.

This certification authority is similar to a notary public and its responsibilities include verifying that a certificate has not been revoked or expired. 

Therefore, when a document is signed with this type of signature, it sends the certificate and the associated public key. 

It is important to note that the digital signature certificate can be revoked, just like other types of official identification, such as a driver’s license. 

---

---

Generally, it is valid for one year and can be renewed or, if not, a new one can be obtained as long as the requirements are met. 

To understand what the digital signature consists of, in a more technical way, it is necessary to expand the information on the 2 elements that work together: the hash function and cryptography.

Hash function

This is a mathematical algorithm – such as the Secure Hash Algorithm (SHA-1) or Message Digest 5 (MD5) – that generates an alphanumeric string that is inherent and unique to the signed document. 

It should be noted that the Secure Hash Algorithm (SHA) is considered the most secure algorithm available today. 

In any case, each time you modify a signed document, a new hash is generated, making it unique.

Cryptography 

Public key cryptography or asymmetric encryption, uses a 2-key system to encrypt and decrypt the message. 

On the one hand, a public key encrypts the data and, on the other hand, a private key decrypts it. 

In other words, the signed document is sent with a unique hash associated with a public key. 

When the recipient receives it, decrypts the hash of the sender’s document using the public key and compares it to the hash previously generated when received the document. 

If the public hash matches the private hash, authentication is successful.

The generation of public keys is supported by a Public Key Infrastructure (PKI). According to regulatory standards, they identify a user with a digital certificate and a verification authority. 

An alternative to PKI as an encryption technology is Pretty Good Privacy (PGP). This system validates the key, verifies that it belongs to the sender and, if so, authenticates the identity. This tool provides controlled access to systems and resources while ensuring privacy and traceability. 

These mechanisms guarantee the confidentiality, integrity and authenticity of information, thus increasing digital security. 

At Smowltech, security and privacy are two essential objectives of our proctoring plans. Thanks to them, you can offer remote evaluations in a safe and respectful environment for your users, while avoiding possible fraud such as identity theft. 

Ask for a free demo and we will show you how innovation and security are combined in our professional solutions.

---

---