RightSignal · Saturday, October 17

Concept of the day1 / 3

Digital signatures

The concept

How your phone knows an app update wasn't tampered with

A digital signature is a seal that only the sender can make but anyone can check. It proves who sent something and that not a single letter changed on the way.

When an app maker ships an update, it signs it with a secret key it never shares. Your phone checks the seal with a matching public key that everyone is allowed to have.

Concept of the day2 / 3

Digital signatures

Real-life use case

The padlock in your browser checks your bank's signed ID card

When you open your bank's website, it shows your browser a certificate, like an ID card, signed by a trusted issuer. Your browser checks that signature before showing the padlock.

The same trick protects software updates, signed emails and bots that sign their web requests to prove who runs them.

Concept of the day3 / 3

Digital signatures

How it helps

A seal only you can press, but anyone can inspect

First the sender squeezes the message into a short fingerprint, called a hash, which changes completely if even one letter changes. Then they lock that fingerprint with their secret key. That locked fingerprint is the signature.

Your phone unlocks it with the public key and compares it with its own fingerprint of the file it received. If they match, the file is genuine. A forger without the secret key cannot make a seal that passes.

Your RightSignal

Topics in News

How your phone knows an app update wasn't tampered with

The padlock in your browser checks your bank's signed ID card

A seal only you can press, but anyone can inspect

Got it?