4
$\begingroup$

Which of the security services can be provided by digital signature?

  1. data integrity
  2. non-repudiation
  3. sender authentication
  4. receiver authentication

I think it can provide non-repudiation. Because receiver cannot deny the message as it was assigned by the sender. Am I right? Are the other services provided by the digital signature?

Improve this question
$\endgroup$

3 Answers 3

Reset to default
3
$\begingroup$

Which of the security services can be provided by digital signature?

Data integrity

Yes. Digital signature can provide data / message integrity. Generally digital signatures include a hashing algorithm. The verification includes proof that the correct hash over the data was signed by the sender.

The cryptographic message syntax or XML digsig are examples.

Non-repudation

Yes, it can. And non-repudiation also more or less implies data integrity. Because to make sure that an entity cannot deny signing the data, you need to know which exact data was being signed in the first place.

X509 certificates usually have a non-repudiation bit to indicate that the private key can be used to generate signatures for non-repudiation. Look at XAdES for an example (government regulated non-repudiation).

Sender authentication

Yes, most certainly. The sender can be authenticated by signing a challenge in a transport protocol, for instance.

Think of smart card logins onto web sites for an example, using client side authentication within the TLS protocol.

Receiver authentication

No. Generally the receiver in a protocol is holding a trusted public key of the sender. You need to have access to the private key to be able to authenticate. If we assume that the receiver - i.e. the receiver of signed messages - only has access to the public key he can only authenticate the sender.

Obviously receivers can also assume the role of sender in most protocols, in which case the entity also holds his own private key.

Others

As only data integrity is mentioned, you could mention data authentication. Signatures do not just provide data integrity but also authenticity, i.e. proof that the message originated (or at least was signed by) the entity controlling the private key.

That's a slightly different notion than data integrity, which doesn't provide this proof necessarily. Both properties are however achieved by a single signature.

Improve this answer
$\endgroup$
3
  • $\begingroup$ It could be argued that integrity + non-repudiation = data authentication. Non-repudiation already includes that only the sender (if the private key is kept private) can sign messages, and integrity implies that the signature matches just the original message and no other (with overwhielming probability at least). $\endgroup$
    – tylo
    Commented Mar 22, 2017 at 14:02
  • $\begingroup$ Certainly. But non-repudiation is not always present if just because non-repudiation isn't defined in the protocol (e.g. a third party offering a signing service). So data authentication can at least be considered a different property, even if the signature generation scheme is completely identical. But yes, they are all pretty closely linked to each other. $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 22, 2017 at 15:07
  • $\begingroup$ I do not understand what you have in mind with "You need to have access to the private key to be able to authenticate". Update: got it, a final "yourself" is implied. $\endgroup$
    – fgrieu ♦
    Commented Mar 22, 2017 at 18:27
3
$\begingroup$

The Digital signature provides following services :
1. Non forgeable : No one else other than signer can sign it
2. Sender Authentication : Signer deliberately signed the document as it uses private key
3. Data integrity : The algorithm uses hashing functionality
4. Non repudiation : Signer cannot claim he/she didn’t sign it
5. Tamperproof : Document cannot be altered after signature
6. Non malleable : Signature cannot be cut /paste to another document
7. Receiver Authentic : No as it uses only receiver public key

Hope this helps

Improve this answer
$\endgroup$
0
$\begingroup$

Data integrity is provided by hash functions. So if your digital signature algorithm has hashing functionality included in it - like most standard signature algorithms do - then yes, digital signatures provide data integrity.

For non repudiation only the signer cannot deny his signature. The receiver can, so there has to other functionality included for it separately. Well known DS algorithms do not provide receiver side non repudiation.

A sender is authenticated by his signature so YES it provides sender authentication.

And as stated above receiver is not authenticated by the digital signature algorithm. So there must be some other functionality to verify receiver that is not part of the digital signature algorithm.

Improve this answer
$\endgroup$
3
  • 1
    $\begingroup$ What does this part of hte answer mean? "but well known DS algorithms do not provide receiver size non repudiation." $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 22, 2017 at 12:59
  • $\begingroup$ @MaartenBodewes I can only guess, but maybe that the receiver cannot deny having received a message? This could be an equivalent to the return receipt in non-digital postal services. But in that case you would require some proper infrastructure for authentication of all participiants. $\endgroup$
    – tylo
    Commented Mar 22, 2017 at 14:09
  • 1
    $\begingroup$ it was side. now corrected $\endgroup$
    – Ashwin Bande
    Commented Mar 22, 2017 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.