2

I'm new to the world of digital signatures and encryption and I'm trying to learn more.

I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital signature or not.

I've thought of a scenario in which:

  1. A user creates login credentials (username, password and PIN code). The password and PIN are used to create a private key.

  2. The user tries to login via username & password. The password is compared to the one stored in the database and used to generate a key, which is also to be compared. If both match, then the user can login.

Does make any sense or should a public key be used?

1
  • I think you are confusing password hashing with digital certificates. They are related but different. The private key is normally as random as possible, but accessed using the password hash comparison. I would suggest Wikipedia which may help you frame your question better. Try "Digital Certificates" to start, but you may need to read a few articles.
    – Stone True
    Nov 21 '15 at 15:23
3

Client: I wanna login!

Server: Okay. Here's a piece of data. Do something to it that only you could do!

Client: Okay. Here 's your data back. I've added a signature with my secret key.

Server: Lemme just check ... Okay, welcome in!

This is a less than formal description of a challenge-and-response authentication protocol that uses signature. ;)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.