2008/01/15

Processes of Using XML Digital Signature

Digital signatures using involves two processes, that are performed by the signer and the receiver of the digital signature.
To sign any digital asset, the signer first delimits precisely the borders of what is to be signed.
For the delimited XML Digital Signature information for signing term the "message" is used in current article.

For Digital signature or the XML Digital Signature creation a hash value and a given private key that are both unique to the signed message are used. To provide security for the hash value, probability that the same XML Digital Signature could be generated by the combination of any other message or private key must be very slight.

The XML Digital Signature verification is the process of

  1. verifying the digital signature and signature software by reference to the original message and a given public key,
  2. defining whether the digital signature was generated for that namely message using the private key that matches to the referenced public key.
Then the signer's software calculates a hash result value, unique to the message. Then the signer's software transforms the hash value into a digital signature using the signer's private key. As a result, digital signature is unique to both the message and the private key, that were used to generate it.
Usually, a digital signature is attached to its message and saved or transmitted with the message. It might also be sent or saved as a separate data element. A digital signature is unique to its message, that's why it is useless if it's disassociated from its message.