I'm trying to understand how certificate signing and verification works conceptually. I know the classic example with asymmetric cryptography- the sender encrypts data with public key of receiver, data goes over unsecure channel, receiver decrypts with private key.

When it comes to certificate verification that's where I start to get confused.

According to Wikipedia in the picture they show, the hash of the certificate is decrypted with signer's public key. So which is it?

I thought that maybe upon receipt, the contents of the certificate are hashed and encrypted with the public key and the result is compared with the provided "digital signature". But then I realized an attacker would be able to reproduce this process as well without knowledge of the private key.


Signature generation and encryption are two different concepts. The fact that both can use the same one way function does not change that fact. In the case of RSA, both signature generation and encryption (as well as verification and decryption) uses modular exponentiation. These are called the RSA primitives. They have however different inputs: one uses the private key, the other the public key.

Signature generation and encryption may relate differently for other one way functions. This is for instance the case for the primitives used for elliptic curve cryptography (ECC). In ECC the primitives used for ECDSA signature generation cannot directly be used for encryption/decryption.

The idea that signature generation and encryption should be seen as different concepts is actually made pretty clear in the PKCS#1 standard (of RSA laboratories): the signature generation primitive is called RSASP1 and the encryption primitive is called RSAEP. They do represent the same algorithm internally.

RSAVP1, the RSA verification primitive is indeed performed with the public key. But it doesn't really decrypt any confidential information. Instead it produces a padded hash. This padded hash is free for anyone to see - anybody may verify the message (in this case the certificate). If you require confidentiality you should encrypt the message and the signature value using a key or keyset where the secret key is known by the receiver.

The padding is validated and the hash is compared with the one computed over the (signed parts of the) certificate. If both the padding and hash are correct then the signature must have been created using the private key belonging to the public/private key pair. This is what establishes the trust.

As long as the private key is managed (held) by the signing party then the signing party must have been involved in generating the signature. This is called non-repubility; the signing party cannot claim that somebody else created the signature.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.