Digital Signature

— Computer Science · AS Level (Paper 1) · Security —

★ Exam Tip: Full theory of digital signatures is an A2 topic — sir’s advice: don’t memorise extra! The whole lesson (public/private keys, hashing, analogies) exists only to make 3 lines make sense: hash → digest → encrypt with sender’s private key → decrypt with sender’s public key. Paper 1 is already very long, so save your memory for what is asked.

1. Why Do We Need a Digital Signature?

Real-world idea: two papers reach me — one has my signature, one doesn’t. The one with my signature is mine; the other may be fake / changed. A signature = confirmation of ownership.

Computer version: I send you a message — how does your device know it is really from Sir Taha and nobody else? ⇒ digital signature.

Example — Daraz.pk order:

Abdul Samad pays by card for an iPhone 15 and sends the invoice to Daraz. A hacker catches the invoice on the way, removes Samad’s address and puts his own, and forwards it. Samad thinks all is fine; Daraz receives the hacker’s address. Without a digital signature Daraz can never find out.

the problem digital signatures solve

Remember: we study it to give confirmation of ownership — NOT to stop hackers.

With a digital signature: Daraz checks the signature — if it is not Samad’s, something is wrong (hacking) ⇒ Daraz calls Samad: “this isn’t your signature.”

Common mistake: digital signature ≠ stopping people from accessing data. Sir: “someone else can access it, I don’t mind — I care about ownership.” Access/secrecy belongs to encryption, which uses the same keys in a different way.

2. Public Key & Private Key (just the basics)

Everyone has two keys that work as a pair. A key is a mathematical random number generated specially for you. (Names like asymmetric encryption — no need to memorise.)

	Private key 🔑	Public key 🔑
Who knows it?	only the owner (me)	every single person
Can someone else have it?	never — it is like my signature	yes, freely given
How others get it	they don’t	given at the handshake

Handshake: when a connection is built (like saving a contact on WhatsApp) my public key is handed over — a backend thing you never see.

The door analogy (higher-tech door that uses 2 keys)

locked with PRIVATE key ⇒ opens only with the matching PUBLIC key
locked with PUBLIC key ⇒ opens only with the matching PRIVATE key

A key never opens what it locked itself — the opposite key of the pair does.

private lock ⇒ public key opens

public lock ⇒ private key opens

Checking ownership with the door

Only Sir Taha has Sir Taha’s private key. Suppose the door was locked with it:

Prajwal tries Taha’s public key — door opens ⇒ locked by Taha’s private key ⇒ Taha’s door ✓
Fawad (a thief) opens it with Taha’s public key, then locks it with his own private key. Now Taha’s public key won’t open it — only Fawad’s public key will ⇒ Prajwal knows it is not Taha’s door.

locked by Fawad ⇒ not Taha's door

Student’s doubt (Mahadi): “After unlocking with your public key, can he lock it again using your private key?” No — nobody else has Taha’s private key. He can only lock with his own private key (or with Taha’s public key), and then Taha’s public key can’t prove ownership.

3. Proving Ownership by Encrypting an Email

Take an email from Sir Taha to Banu baji. Encrypt (= scramble) it with the sender’s private key and send it. Banu tries the sender’s public key — if the email decrypts, it was sent by the owner.

idea only — this is basic encryption, not yet a digital signature

Note: this is not yet a digital signature — only the basic key idea. In real life the sender does not encrypt the whole email; he encrypts a hash key (digest) of it — that comes next.

4. Hashing Algorithm

Analogy: bookmarks for chapters

To reach a chapter fast I make a short key using my own rule — “take the first letter of every word”.

Content (chapter)	Key made by my rule
Hardware System	HS
Automatic Repeat Request	ARR
Database Management System	DBMS

The short key stands for the whole chapter, and I use it to reach the content. A hashing algorithm does this for data.

A computer does not understand text — it only handles numbers (ASCII values are denary numbers → binary). So the rule has to be maths on numbers (add, subtract, multiply, divide…).

Definition:A hashing algorithm is a mathematical function that produces a hash key (also called a digest) from the data.

Careful: “digest” is used for the hash key and for the hash key after it is encrypted — it’s the same word, not something else.

Toy example (for understanding only — do NOT learn this)

Number 05419722 → split into pairs and keep adding in loops:

loop 1 0 + 5 = 54 + 1 = 59 + 7 = 162 + 2 = 4

loop 2 5 + 5 = 1016 + 4 = 20

loop 3 10 + 20 = 30= hash key of the number

just a toy hashing algorithm — long data ⇒ one short number

Real algorithms are different (many exist — A2 level). Just imagine: a maths function (multiply, divide…) that shrinks any content into a small value. Using the key (like DBMS for the chapter) I can access the content it represents.

Don’t: try to remember how any hashing algorithm works — it is not in your syllabus. Only know: hashing algorithm → digest.

5. Creating a Digital Signature (Sender)

An email is text → numbers (ASCII) → binary, so it can go through a hashing algorithm.

Put the email message through the hashing algorithm → hash key = digest (e.g. 54).
Encrypt the digest with the sender’s private key → this is the digital signature.
Send the email + digital signature to the receiver (“this is my signature, keep it”).

Sender → Email → Hashing algorithm → Hash key (digest) → Encrypted with private key → Digital signature

sender’s side: email → hash → digest → encrypt with private key = digital signature

Agreed hashing algorithm: sender and receiver decide beforehand to use the same algorithm (like Sir and Daniyal both agreeing to “first letter of each word”).

6. Checking the Signature (Receiver)

Receiver has the email + the encrypted digest (the signature).
Decrypt the signature with the sender’s public key → gives the sender’s digest (54). Decrypts ⇒ owner confirmed.
Receiver puts the received email through the same hashing algorithm → makes its own digest.
Compare the two digests.

receiver’s side: two checks — (1) does it decrypt? (2) do the digests match?

Benefit	How it is checked	Result
① Ownership / authentic	signature decrypts with sender’s public key	sent by that sender ✓
② Not altered (integrity)	digest A = digest B	content unchanged ✓

Example of tampering:

Sender’s email gave digest 54. Someone changes the content on the way. The receiver hashes the changed email and gets 64.

digest from sender = 54 digest made by receiver = 64 54 ≠ 64 ⇒ altered!

Same email ⇒ 54 and 54 ⇒ no alteration; Taha really sent exactly this.

7. Exam Answers — Past-Paper Questions

The whole concept was for these lines. Learn the wording — sir read it as the model answer.

Past paperExplain · 3 marking points

Explain how a digital signature is used to ensure an email is authentic.

Email message is put through a hashing algorithm to produce a digest.
The digest is encrypted with the sender’s private key to create the digital signature.
The digital signature can only be decrypted with the matching sender’s public key ⇒ confirms the sender (ownership).

Extra questionExplain · alteration

Explain how a digital signature is used to ensure that data is not altered.

Email message put through the agreed hashing algorithm to produce a digest.
Digest is encrypted with the sender’s private key to create the digital signature.
Digital signature (sent with the message) is decrypted with the public key of the sender ⇒ ownership confirmed.
Receiver passes the received email through the same hashing algorithm to produce a digest.
The sender’s digest and the receiver’s digest are compared; if both are the same, the data has not been altered.

★ Exam Tip: Use the words “agreed/same hashing algorithm”, “digest”, “sender’s private key”, “sender’s public key” and “compare” — they are the marking points. Two questions are possible: authentic (ownership) and not altered (digests match).

✓ Quick Recap — Digital Signature

Purpose: confirm ownership (who sent it) + that data was not altered — not to hide or protect access.
Keys: private = only owner (like a signature); public = everyone has it. Lock with one ⇒ open with the other.
Hashing algorithm: maths function ⇒ short hash key = digest; same algorithm on both sides (agreed).
Create: email → hash → digest → encrypt with sender’s private key = digital signature → send with email.
Check: decrypt signature with sender’s public key ⇒ owner ✓; hash received email ⇒ compare digests ⇒ same ⇒ not altered ✓.
Different digests (54 vs 64) ⇒ someone altered the content in transit.
A2 has the detailed theory — AS only needs the 3-line answer.