Digital signatures, certificates and hash digests

Hash digests

A cryptographic hash function turns any amount of data into a short fixed-length value, the hash digest (message digest).

• The same input always gives the same digest.
• A tiny change to the input gives a completely different digest.
• It is one-way: you cannot work back from the digest to the data.
• It is very hard to find two inputs with the same digest.

Uses: checking file integrity, storing passwords (store the hash, not the password), digital signatures, blockchain.

Public and private keys recap

In asymmetric cryptography each person has a key pair:

• Encrypt with someone's public key: only their private key decrypts it. This gives confidentiality.
• Encrypt with your own private key: anyone can decrypt it with your public key, but only you could have produced it. This gives authentication: the basis of a signature.

Digital signatures

Signing (sender):

1. Hash the message to produce a digest.

2. Encrypt the digest with the sender's private key: this is the digital signature.

3. Send the message with the signature attached.

Verifying (receiver):

1. Decrypt the signature with the sender's public key to recover the digest.

2. Hash the received message.

3. If the two digests match, the message is authentic (it came from the holder of the private key) and has integrity (it was not altered). The sender cannot later deny sending it (non-repudiation).

A signature does not hide the message; encrypt it as well if it must be secret.

Digital certificates

How do you know a public key really belongs to your bank? A digital certificate is an electronic document, issued and signed by a trusted certificate authority (CA), that binds a public key to an identity. It contains the owner's name or domain, their public key, the CA's name, a serial number, validity dates and the CA's digital signature. Browsers trust a built-in list of CAs and check certificates in the TLS handshake.

Benefits: authentication, integrity, non-repudiation, secure key distribution. Drawbacks: relies on CAs being trustworthy and secure; certificates expire and must be managed; a stolen private key lets an attacker sign as you until the certificate is revoked; slower than symmetric methods.

Worked example

Bilal receives a signed contract. His software decrypts the signature with the sender's public key and gets a digest that does not match the hash of the contract he received. What does this show?

1. A mismatch means either the contract was altered after signing, or it was not signed with the matching private key.
2. So the contract fails the integrity or authenticity check and should not be trusted.

Answer: The contract has been tampered with or did not come from the claimed sender.

Check yourself

1. Which key is used to create a digital signature?
   • The sender's private key
   • The sender's public key
   • The receiver's public key
   • The receiver's private key
   Show answer

   The sender's private key. Only the sender holds it, so only the sender can sign.

2. Which key does a receiver use to verify a digital signature?
   • The receiver's private key
   • The sender's private key
   • The sender's public key
   • A shared session key
   Show answer

   The sender's public key. Anyone can verify using the public key.

3. What is the correct order for creating a digital signature?
   • Hash the message, then encrypt the digest with the sender's private key
   • Encrypt the message with the receiver's public key, then hash it
   • Encrypt the digest with the sender's public key, then hash the message
   • Hash the private key, then attach it to the message
   Show answer

   Hash the message, then encrypt the digest with the sender's private key. Hash first; sign the digest.

4. Which is a property of a cryptographic hash function?
   • The original data can be recovered from the digest
   • The digest is always longer than the data
   • The digest changes each time the same data is hashed
   • A small change to the input produces a completely different digest
   Show answer

   A small change to the input produces a completely different digest. This is what makes tampering obvious.

5. What does a digital certificate do?
   • Stores the owner's private key
   • Binds a public key to the identity of its owner, signed by a certificate authority
   • Encrypts the whole website
   • Replaces the need for hashing
   Show answer

   Binds a public key to the identity of its owner, signed by a certificate authority. It lets you trust that a public key is genuine.

6. Why must a certificate authority be trusted?
   • The CA holds every user's private key
   • The CA encrypts all internet traffic
   • The CA chooses users' passwords
   • Browsers accept certificates the CA has signed, so a compromised CA could vouch for fake sites
   Show answer

   Browsers accept certificates the CA has signed, so a compromised CA could vouch for fake sites. The whole chain of trust depends on the CA.

7. What does non-repudiation mean for a digitally signed message?
   • The message cannot be read by anyone else
   • The sender cannot credibly deny having signed it
   • The message will always be delivered
   • The message has been compressed
   Show answer

   The sender cannot credibly deny having signed it. Only the private key holder could have produced the signature.

Practise with instant feedback Print this lesson

Sources

• Pearson Edexcel International Advanced Subsidiary and Advanced Level in Computer Science specification (2026), Issue 1
• Pearson Edexcel IAL Computer Science sample assessment materials (Unit 3 paper, resource booklet and mark scheme)

Last updated 8 November 2026. Spotted a mistake? Tell us.