Public-key cryptography and digital signatures
Separate the key that proves identity from the key that verifies it, and see why signing is not encryption.
Symmetric encryption needs both parties to share a key. Public-key cryptography breaks that requirement with a mathematically linked pair: a private key you keep, and a public key you hand out freely.
- Encrypt with the public key, decrypt with the private key; that gives confidentiality to the holder.
- Sign with the private key, verify with the public key; that gives authenticity and integrity to everyone.
Signing is not encryption. A signature does not hide the message; it proves who produced it and that it has not changed. People conflate these constantly, and the confusion leads to real design errors.
A signature is computed over a hash of the message, not the message itself. That is why a signature is a fixed small size regardless of what it signs, and why the hash function's collision resistance matters as much as the signing algorithm.
- secp256k1 (ECDSA): the curve used by Ethereum and Bitcoin.
- Ed25519 (EdDSA): faster, with fewer implementation traps; used by Solana, XRP, Cardano, and SSH.
- RSA: older and larger, still ubiquitous in enterprise and OIDC because everything can verify it.
This is why blind signing is dangerous. If you sign a 32-byte hash without seeing what produced it, you are vouching for a message you cannot read. It appears again in the agent threat model track.
Two properties follow that matter enormously later. Non-repudiation: a valid signature means the private key was used, so the holder cannot plausibly deny it. And verification needs no secret at all: anyone with the public key can check, which is what makes federated trust possible without shared credentials.
Check your understanding
3 questionsWhat does a digital signature provide that encryption does not?
Why is a signature computed over a hash rather than the whole message?
Why is blind signing a 32-byte digest risky?