I'm trying to understand the process of digital signature verification, however I don't quite get the explanation in my book.
If A wants to send a message to B with a digital signature, the process is apparently as follows:
- The message being sent has a public hashing algorithm applied to it to create a hash
- The hash is encrypted using A’s private key, and is then appended to the message which will also be encrypted. This encrypted hash is the digital signature
- B will then decrypt the hash using A’s public key
- The original message is then decrypted and put through the same hashing algorithm to produce a hash
- If the two hashes are the same, the message is authenticated, otherwise it cannot be authenticated
First off, is this explanation correct?
Second, how can B decrypt the hash using A's public key? The purpose of a public key is so data can be encrypted.
Why would A encrypt something with their private key? If sending a message to B, would A not use B's public key?
How can the original message be put through the same hashing algorithm to produce the same hash if A initially used their private key to produce the 1st hash (the private key of A won't be known to B)?
If this explanation isn't correct, where does it go wrong?