Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As far as I understand DKIM works like this:

  • DKIM is not used to encrypt anything, the only purpose is to mark mails that are not really sent from the claimed domain as spam.
  • the DKIM-enabled sending server uses a stored private key to generate a digital signature of the message, which is inserted in the message as a header, and the email is sent as normal
  • The DKIM-enabled receiving email receiving server extracts the signature and claimed From: domain from the email headers.
  • The public key is retrieved from the DNS system for the claimed From: domain.
  • The public key is used by the receiving mail system to verify that the signature was generated by the matching private key. A match effectively proves that the email was truly sent from, and with the permission of, the claimed domain and that the message headers and content have not been altered during transit.
  • The receiving email system applies local policies based on the results of the signature test. For example, the message might be deleted if the signature does not match.

This is all understandable, the only magic seems to me, how you can check if the signature really was generated with the private key (which the receiving server doesn't know)

Is there an intuitive way to explain how you can check if the signature was generated by the matching private key?

share|improve this question
Have you tried looking up digital signatures? $\;$ – Ricky Demer Aug 15 '14 at 6:57

You need the private key (which mainly consists out of two large prime numbers) to create a signature, The public key is not enough to recreate the signature. It is sufficient to verify a signature that you're given, but it is not sufficient to generate new ones (or so we hope; if that's not true, the signature scheme is broken).

The signature verification process is checking whether this fits:

$S^e = f( M )\ \ (\bmod \ N)$

where $S$ is the signature, $M$ is the message,  $f$ is a commonly known function (to truncate the size) and $e$ and $N$ are parameters from the public key

Now, if we were trying to forge a signature for a received message $M'$ with only the public key, we could certainly compute $P' = f(M')$; however, then we'd need to find a value $S'$ that fits to the
known $e$ and $N$:

$S'^e = P' \ (\bmod\ N)$

and, if $N$ is an RSA modulus, we don't know how to do that.

Source: this is an exerpt from How does RSA signature verification work?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.