Digital Signatures
A cryptographic mechanism that proves a message was created by a specific private key holder and has not been altered — providing authentication, integrity, and non-repudiation without sharing a secret.
Post-quantum threat: ECDSA and RSA are both broken by Shor's algorithm on a sufficiently powerful quantum computer. NIST has standardized ML-DSA (CRYSTALS-Dilithium) as a post-quantum signature scheme. TLS 1.3, SSH, and code-signing infrastructure will need to migrate to these lattice-based schemes.
graph LR
Center["Digital Signatures"]:::main
Rel_digital_asset_security["digital-asset-security"]:::related -.-> Center
click Rel_digital_asset_security "/terms/digital-asset-security"
Rel_digital_forensics["digital-forensics"]:::related -.-> Center
click Rel_digital_forensics "/terms/digital-forensics"
Rel_digital_certificate_management["digital-certificate-management"]:::related -.-> Center
click Rel_digital_certificate_management "/terms/digital-certificate-management"
classDef main fill:#7c3aed,stroke:#8b5cf6,stroke-width:2px,color:white,font-weight:bold,rx:5,ry:5;
classDef pre fill:#0f172a,stroke:#3b82f6,color:#94a3b8,rx:5,ry:5;
classDef child fill:#0f172a,stroke:#10b981,color:#94a3b8,rx:5,ry:5;
classDef related fill:#0f172a,stroke:#8b5cf6,stroke-dasharray: 5 5,color:#94a3b8,rx:5,ry:5;
linkStyle default stroke:#4b5563,stroke-width:2px;
🧠 Knowledge Check
🧒 Explain Like I'm 5
Imagine you write a letter and seal it with a unique wax stamp that only you own. When someone receives the letter, they can check your stamp to confirm: (1) it really came from you, and (2) nobody broke the seal and changed the letter. A [digital signature](/en/terms/digital-signature) works the same way — your [private key](/en/terms/private-key) is the unique stamp, and your [public key](/en/terms/public-key) is the reference book that everyone uses to verify your stamp is genuine.
🤓 Expert Deep Dive
ECDSA and the Catastrophic Nonce Reuse Vulnerability
ECDSA requires generating a random secret nonce k for each signature. The signature is computed as (r, s) where r = (k·G).x and s = k⁻¹(hash(msg) + r·privKey) mod n. If the same k is ever used for two different messages, both private keys can be algebraically recovered. This is exactly how the PlayStation 3 master key was extracted in 2010 — Sony's firmware used a constant k for all code-signing operations.
EdDSA (Ed25519) — The Deterministic Fix
Standardized in RFC 8032, EdDSA eliminates the random nonce entirely. The nonce is derived deterministically as k = H(privKey_b || msg) (the second half of the SHA-512 hash of the private key concatenated with the message). Since k is deterministic, nonce reuse is impossible by construction. Ed25519 is also significantly faster than ECDSA and produces constant-time signatures that resist side-channel attacks.
Blockchain Applications
Bitcoin and Ethereum both use ECDSA over the secp256k1 curve (Koblitz curve, y² = x³ + 7). A [wallet address](/en/terms/wallet-address) is derived from the ECDSA public key via a hash chain: Address = RIPEMD160(SHA256(pubKey)) (Bitcoin) or keccak256(pubKey)[12:] (Ethereum). Ethereum's consensus layer (post-Merge) uses BLS12-381 signatures for validator aggregation, enabling efficient aggregation of thousands of validator signatures into a single compact proof.
❓ Frequently Asked Questions
What three properties does a digital signature guarantee?
Authentication (proves identity of the signer), Integrity (proves the message was not altered after signing), and Non-repudiation (the signer cannot later deny having signed).
Why is ECDSA dangerous if you reuse the nonce?
The ECDSA math allows anyone who observes two signatures with the same nonce to algebraically compute the private key. This exact flaw was used to extract the Sony PlayStation 3 master signing key.
Why does Ethereum use ECDSA secp256k1 instead of Ed25519?
Bitcoin chose secp256k1 when Ed25519 did not yet exist as a standard. Ethereum inherited Bitcoin's choice. Ed25519 is widely considered the superior modern algorithm and is used for Ethereum's consensus layer validator signing.