We've seen how hashes ensure integrity and HMACs ensure authenticity between two parties who share a key. But how do we trust a stranger's identity on the open internet? Digital signatures provide a way for a sender to prove their identity to anyone, without sharing a secret key beforehand.
A digital signature is essentially a hash of a message that has been encrypted with the sender's *private key*. The receiver uses the sender's *public key* to decrypt the hash and compares it to a hash they generate themselves from the received message. If they match, the signature is valid.
Key Concept: Non-Repudiation. Because only the holder of the private key could have created the signature, they cannot later deny having sent the message.
The command above creates a signature. To verify it, the recipient would use the public key. However, this raises a new problem: How do I know the public key I'm using actually belongs to the person I think it does?
X.509 is the standard format for public key certificates. It binds a public key to an identity (e.g., a domain name) and is signed by a Trusted Third Party called a Certificate Authority (CA). This creates a 'Chain of Trust' from the end-entity certificate up to a Root CA trusted by the OS or browser.
💡 A typical X.509 certificate contains: Version, Serial Number, Issuer Name, Validity Period, Subject Name, and the Subject's Public Key.
# View the details of a remote website's certificate
openssl s_client -connect google.com:443 | openssl x509 -text -noout| Component | Role | Analogy |
|---|---|---|
| Public Key | Encryption/Verification | The Lock |
| Private Key | Decryption/Signing | The Physical Key |
| CA | Identity Verification | The DMV / Passport Office |
| Root Cert | Anchor of Trust | The Government's Seal |
The entire system collapses if a CA is compromised. If an attacker can force a CA to issue a fake certificate for `google.com`, they can perform a perfect Man-in-the-Middle (MitM) attack. This is why modern browsers use Certificate Transparency (CT) logs to publicly record all issued certificates.
Never trust 'Self-Signed' certificates in a production environment, as they are prone to impersonation attacks.
Verify exercises to earn ★ 140 XP and unlock next lab level.