Digital signatures in Cybersecurity - Mini Project: Build & Apply

Understanding Digital Signatures

📖 Scenario: You work in a company that needs to ensure the authenticity and integrity of important documents shared via email. Your task is to understand how digital signatures work to protect these documents from tampering and impersonation.

🎯 Goal: Build a simple conceptual model of a digital signature process using clear steps and explanations. This will help you grasp how digital signatures verify the sender's identity and ensure the document has not been changed.

📋 What You'll Learn

Create a dictionary called document with keys content and sender and their exact values

Add a variable called private_key with the exact string value representing the sender's private key

Create a function called sign_document that takes document and private_key and returns a signature string

Add a final step to simulate attaching the signature to the document in a dictionary called signed_document

💡 Why This Matters

🌍 Real World

Digital signatures are used to ensure that electronic documents are authentic and have not been altered, which is essential in legal, financial, and communication fields.

💼 Career

Understanding digital signatures is important for cybersecurity professionals, software developers, and anyone involved in secure digital communications.

1

Create the document data

Create a dictionary called document with the keys content set to 'Confidential report data' and sender set to 'Alice'.

Cybersecurity

# Create the document dictionary with content and sender
# Your code here

Hint

Use curly braces to create a dictionary with the exact keys and values.

2

Add the sender's private key

Add a variable called private_key and set it to the string 'AlicePrivateKey123'.

Cybersecurity

document = {'content': 'Confidential report data', 'sender': 'Alice'}
# Add the private_key variable with the exact string value
# Your code here

Hint

Assign the exact string to the variable private_key.

3

Create the signing function

Define a function called sign_document that takes two parameters: document and private_key. Inside the function, create a signature string by combining the document's content and the private key separated by a dash, and return this signature string.

Cybersecurity

document = {'content': 'Confidential report data', 'sender': 'Alice'}
private_key = 'AlicePrivateKey123'
# Define the sign_document function below
# Your code here

Hint

Use string concatenation with a dash between content and private_key, then return the result.

4

Attach the signature to the document

Create a dictionary called signed_document that contains all keys and values from document and add a new key signature with the value returned by calling sign_document(document, private_key).

Cybersecurity

document = {'content': 'Confidential report data', 'sender': 'Alice'}
private_key = 'AlicePrivateKey123'

def sign_document(document, private_key):
    signature = document['content'] + '-' + private_key
    return signature

# Create signed_document dictionary with document data and signature
# Your code here

Hint

Use document.copy() to copy the dictionary and add the signature key with the function call result.

Practice

1. What is the main purpose of a digital signature in cybersecurity?

easy

A. To encrypt the entire message content for privacy

B. To speed up the transmission of data over the internet

C. To create a backup of the message on a secure server

D. To verify the sender's identity and ensure the message was not altered

Solution

1. Step 1: Understand the role of digital signatures

   Digital signatures are used to confirm who sent a message and that it has not been changed.

2. Step 2: Differentiate from encryption and other functions

   Encryption protects privacy, but digital signatures focus on authenticity and integrity.

3. Final Answer:

   To verify the sender's identity and ensure the message was not altered -> Option D

4. Quick Check:

   Digital signature = sender identity + message integrity [OK]

Hint: Digital signatures prove identity and message unchanged [OK]

Common Mistakes:

• Confusing digital signatures with encryption
• Thinking digital signatures speed up data transfer
• Believing digital signatures create message backups

2. Which of the following correctly describes the process of creating a digital signature?

easy

A. Hash the message, then encrypt the hash with the sender's private key

B. Encrypt the entire message with the sender's public key

C. Hash the message and send the hash without encryption

D. Encrypt the message with the receiver's private key

Solution

1. Step 1: Identify the digital signature creation steps

   The message is hashed to create a fixed-size summary, then this hash is encrypted with the sender's private key.

2. Step 2: Eliminate incorrect options

   Encrypting the entire message or using the receiver's private key is incorrect for digital signatures.

3. Final Answer:

   Hash the message, then encrypt the hash with the sender's private key -> Option A

4. Quick Check:

   Digital signature = hash + sender's private key encryption [OK]

Hint: Hash first, then encrypt with private key for signature [OK]

Common Mistakes:

• Encrypting the whole message instead of the hash
• Using the receiver's key instead of sender's private key
• Skipping encryption of the hash

3. Consider this simplified Python code for verifying a digital signature:

def verify_signature(message, signature, public_key):
    hashed = hash_function(message)
    decrypted_hash = decrypt(signature, public_key)
    return hashed == decrypted_hash

message = "Hello"
signature = encrypt(hash_function(message), private_key)
result = verify_signature(message, signature, public_key)
print(result)

What will be the output of this code?

medium

A. RuntimeError

B. False

C. True

D. SyntaxError

Solution

1. Step 1: Understand the verification process

   The signature is decrypted with the public key to get the original hash. The message is hashed again and compared.

2. Step 2: Check if hashes match

   Since the signature was created by encrypting the hash with the private key, decrypting with the public key returns the same hash, so the comparison is True.

3. Final Answer:

   True -> Option C

4. Quick Check:

   Verification returns True if hashes match [OK]

Hint: Decrypted signature hash matches message hash means True [OK]

Common Mistakes:

• Confusing encryption and decryption keys
• Assuming the output is False without checking hash equality
• Expecting syntax or runtime errors from correct code

4. A developer wrote this code snippet to create a digital signature:

def create_signature(message, private_key):
    encrypted_message = encrypt(message, private_key)
    return encrypted_message

What is the main problem with this approach?

medium

A. Using the private key instead of the public key for encryption

B. Encrypting the whole message instead of hashing it first

C. Not decrypting the message before signing

D. Hashing the message twice before encryption

Solution

1. Step 1: Identify correct digital signature steps

   Digital signatures require hashing the message first, then encrypting the hash with the private key.

2. Step 2: Analyze the code's mistake

   The code encrypts the entire message directly, which is inefficient and incorrect for digital signatures.

3. Final Answer:

   Encrypting the whole message instead of hashing it first -> Option B

4. Quick Check:

   Signature = encrypt(hash(message)) not encrypt(message) [OK]

Hint: Sign hash, not whole message, to create digital signature [OK]

Common Mistakes:

• Thinking encrypting whole message is correct for signature
• Confusing private and public key roles
• Ignoring the need to hash before encryption

5. A company wants to ensure that their legal documents are authentic and unchanged after signing digitally. Which combination of technologies should they use to achieve this?

hard

A. Hashing the document and encrypting the hash with the sender's private key

B. Encrypting the entire document with the sender's public key

C. Hashing the document and sending the hash without encryption

D. Encrypting the document with the receiver's private key

Solution

1. Step 1: Understand the goal of authenticity and integrity

   The document must be proven to come from the sender and remain unchanged.

2. Step 2: Apply digital signature method

   Hashing the document creates a unique summary, and encrypting this hash with the sender's private key creates a digital signature.

3. Step 3: Eliminate incorrect options

   Encrypting the whole document or using the receiver's private key does not provide signature authenticity.

4. Final Answer:

   Hashing the document and encrypting the hash with the sender's private key -> Option A

5. Quick Check:

   Digital signature = hash + sender's private key encryption [OK]

Hint: Sign hash with private key for legal document authenticity [OK]

Common Mistakes:

• Encrypting whole document instead of signing hash
• Using receiver's key for signing
• Sending hash without encryption