4

Recently I have been working on Digital Signature. Some common reasons for applying a Digital signature to communications are Authentication, Integrity and Non-repudiation. Does Digital Signature also provide confidentiality?

17

No it does not. You can reference Wikipedia:

https://en.wikipedia.org/wiki/Digital_signature

"A digital signature is a mathematical scheme for demonstrating the authenticity of a digital message or document. A valid digital signature gives a recipient reason to believe that the message was created by a known sender, that the sender cannot deny having sent the message (authentication and non-repudiation), and that the message was not altered in transit (integrity)."

A digital signature alone does not provide confidentiality since it does not prevent disclosure of information you would want to keep secret. Encryption would be an example of a mechanism to provide confidentiality.

  • 1
    MUCH better answer. – schroeder Jun 30 '15 at 4:49
  • 1
    Yeah, it's a signature. Like a traditional signature (except much better) it verifies who it's from, that's all. – Robert Grant Jun 30 '15 at 12:41
  • @RobertGrant It does more than attribute - like VirtualJJ explained, it also determines if the message was altered in transit. – schroeder Jun 30 '15 at 20:08
-2

If you were using Asymmetric encryption at your digital signature

Asymmetric encryption offers a means of encrypting and decrypting information by using a pair of keys (as opposed to symmetric encryption which only uses one key). In asymmetric encryption, a message encrypted with one key in the pair can only be decrypted by the other key in the pair.

For example, let's create a pair of keys (called a keypair) and name the keys A and B. Any message encrypted with key A can only be decrypted by key B (not even key A can be used to decrypt the message). Likewise, any message encrypted with key B can only be decrypted by someone with key A. Either key can be used to encrypt a message, but to decrypt you need the other key in the pair.

In practice, the keys in a keypair are named the private key and the public key. A public key may be freely distributed, but the private key must be closely guarded by the owner.

Asymmetric encryption can provide confidentiality or signer verification, but not both at the same time. To demonstrate this,let me provide one example.

Alice encrypts a message with her private key and sends it to Bob. Anyone with Alice's public key can decrypt and read the message (her public key is widely distributed). Since anyone can read the message, it is not confidential. However, since Bob can decrypt the message with Alice's public key, he knows it must have been encrypted with Alice's private key. Since Alice is the only one with the private key, Bob can be assured Alice is the originator of the message. Encrypting a message with a private key provides signer verification, but not confidentiality.

Bob encrypts a response using Alice's public key and sends it to Alice. Only Alice can read Bob's message, because only the private key can be used to decrypt the message (and Alice is the only one with the private key). Since the message that Bob encrypted can only be read by Alice, it is a confidential message. However, anyone can encrypt a message to Alice (using her public key) and claim to be Bob. Encrypting a message with a public key provides confidentiality, but not signer verification.

  • This is a very confused answer. You describe how encryption can be used to provide confidentiality, but you do not describe how digital signatures fit into the picture. You also seem to state at the top that it is possible for signatures to provide confidentiality, but then go on to explain a parallel process. – schroeder Jun 30 '15 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.