Keysigning and digital message signatures: are they the same thing?

Question

I was reading this wikipedia article on Keysigning: https://en.wikipedia.org/wiki/Keysigning and I then came across this discussion Stack overflow about message signing with RSA: https://stackoverflow.com/questions/454048/what-is-the-difference-between-encrypting-and-signing-in-asymmetric-encryption

In reading them it seems they are slightly different things but I wanted to double check I'm not misunderstanding what I've read. Could someone please clarify if they are the same or different things?

From what I am understanding, key signing is using a Certificate that proves you are the owner of a private key to sign someone else's Certificate, proving to a 3rd party that you trust that the presenter of the certificate owns their private key. This is normally done in PGP systems.

Message signing is using your private key to generate a message signature that can be read by anyone with access to your public key. So, if I took today's date and a nonce and signed them with my private key I'd produce a hash that anyone with my public key could retranslate back into todays date and read. This can be incorporated into a message to prove to the receiver that you are the sender.

Both the digital signature and the key signature have the common ground that you can use the signers public key to verify that they are the one who signed it, but they server different purposes.

Is my understanding of both correct?

Thanks

Answer 1

Digitally signing some "message" is a generic concept. Digitally signing a PGP key is part of this broader concept, with the "message" being the signed key.

A digital signature proves only that somebody has signed the message. It is up to the specific use case on what it means if a message is signed. I.e. the technology of signing is the same, but the meaning (semantics) can be different for different use cases.

In case of signing a PGP key it means that the signer has somehow verified that the key belongs to the one claimed in the key. Similar in case of signing a X.509 certificate (like used in HTTPS) it means that the certificate authority (the "issuer" of the certificate) has somehow verified that the claimed subject of the key (like a domain name) actually belongs to the owner of the certificate. In case of a digitally signed mail it means that the mail is actually created by the one who signed it.