Creation & Verification of Digital Signatures - Legal Aspects of E-Commerce | E-Commerce - B Com PDF Download

Creation and Verification of Digital Signature: Steps for creation and verification of digital signature are as follows:

1. Message:
Signer has to prepare the message for e.g. in the form of electronic mail message to be sent including his name on a computer.

2. Hash function: The digital signature is created by computing a value known as ‘hash function’.

3. Encryption of message digest: The sender encrypts this message digest by using his/her private key.

4. Attachment of digital signature: The sender typically attaches or appends its digital signature to the message.

5. Sending of digital signature and encrypted message: After encryption of message, the sender sends the digital signature and encrypted or unencrypted message to the recipient by electronic device.

6. Verification: The recipient uses the sender’s public key for verification of sender’s digital signature. The recipient also computes the hash result by using the same hash function as was used for creation of digital signature. The recipient then decrypts the digital signature by using sender’s public key. If this ‘hash result’ is the same as the ‘hash result’ received from the sender, receiver can be sure that no tempering has been made in the original message. Any tempering with the contents of electronic records invalidates the digital signature immediately.

Figure 4: Digital Signature Process

Utility of Digital Signature’s Verification: Without proper verification of the digital signature business transactions through ecommerce will not be accepted as authentic and relied upon as proper business transaction. Verification of digital signature is a method of checking the digital signature with reference to the original message and a given set of public keys so that it can be determined whether the digital signature was created for the relevant public key or not.

The receiver of the message verifies the digital signature by computing a new has result of the original message by means of the same hash function which was used to create the digital signature and then by using the public key and the new hash result, the verifier checks whether the digital signature was created by using the corresponding private key.

Thus the verification of digital signature indicates that the digital signature was created using the signer’s private key, because only the signer’s public key will verify a digital signature created with the signer’s private key and that the message was not altered since it was signed. This is because the hash result computed in verification matches the hash result from the digital signature, which was computed when the message was digitally signed.