Public key encryption using Hash digest

In public key cryptography, some elements of security are missing. Although we can be quite sure the message was not understood or read by a third party (message confidentiality), there is no guarantee the sender really is the sender; that is, there is no authentication of the sender. This means the sender could deny ever sending the message (repudiation). And there is no assurance the message was not altered somehow in transit — for example, 'Buy Cisco @ $16' could be altered to 'Sell Cisco @ $16,' suggesting a potential lack of integrity.

A more sophisticated use of public key cryptography can achieve authentication, nonrepudiation, and integrity. To check the integrity of a message and ensure it has not been altered in transit, a hash function is used first to create a digest of the message. A hash function is an algorithm that produces a fixed-length number called a hash or message digest. A hash function can be simple (counting the number of 1s in a message) or more complex (producing a 128-bit number that reflects the number of 0s and 1s, the number of 00s and 11s, and so on). Standard hash functions include MD4 and MD5, which produce 128- and 160-bit hashes.

The sender encrypts both the hash result and the original message using the recipient's public key, producing a single block of cipher text. Then, to ensure the authenticity of the message and to ensure nonrepudiation, the sender encrypts the entire block of cipher text one more time using the sender's private key. This produces a digital signature (also called an e-signature) or 'signed' cipher text that can be sent over the Internet.

A digital signature is a close parallel to a handwritten signature. Like a handwritten signature, a digital signature is unique — only one person presumably possesses the private key. When used with a hash function, the digital signature is even more unique than a handwritten signature: in addition to being exclusive to a particular individual, the digital signature is also unique to the document, and changes for every document. The recipient first uses the sender's public key to authenticate the message, then uses his or her own private key to obtain the hash result and original message, and finally re-applies the hash function to verify the message has not been changed.