![](https://csdnimg.cn/release/download_crawler_static/19389892/bg13.jpg)
private key must remain secret. The approved digital signature algorithms are designed to
prevent an adversary who does not know the signatory’s private key from generating the same
signature as the signatory on a different message. In other words, signatures are designed so that
they cannot be forged. A number of alternative terms are used in this Standard to refer to the
signatory or key pair owner. An entity that intends to generate digital signatures in the future
may be referred to as the intended signatory. Prior to the verification of a signed message, the
signatory is referred to as the claimed signatory until such time as adequate assurance can be
obtained of the actual identity of the signatory.
The public key is used in the signature verification process (see Figure 1). The public key need
not be kept secret, but its integrity must be maintained. Anyone can verify a correctly signed
message using the public key.
For both the signature generation and verification processes, the message (i.e., the signed data) is
converted to a fixed-length representation of the message by means of an approved hash
function. Both the original message and the digital signature are made available to a verifier.
A verifier requires assurance that the public key to be used to verify a signature belongs to the
entity that claims to have generated a digital signature (i.e., the claimed signatory). That is, a
verifier requires assurance that the signatory is the actual owner of the public/private key pair
used to generate and verify a digital signature. A binding of an owner’s identity and the owner’s
public key shall be effected in order to provide this assurance.
A verifier also requires assurance that the key pair owner actually possesses the private key
associated with the public key, and that the public key is a mathematically correct key.
By obtaining these assurances, the verifier has assurance that if the digital signature can be
correctly verified using the public key, the digital signature is valid (i.e., the key pair owner
really signed the message). Digital signature validation includes both the (mathematical)
verification of the digital signature and obtaining the appropriate assurances. The following are
reasons why such assurances are required.
1. If a verifier does not obtain assurance that a signatory is the actual owner of the key pair
whose public component is used to verify a signature, the problem of forging a signature
is reduced to the problem of falsely claiming an identity. For example, anyone in
possession of a mathematically consistent key pair can sign a message and claim that the
signatory was the President of the United States. If a verifier does not require assurance
that the President is actually the owner of the public key that is used to mathematically
verify the message’s signature, then successful signature verification provides assurance
that the message has not been altered since it was signed, but does not provide assurance
that the message came from the President (i.e., the verifier has assurance of the data’s
integrity, but source authentication is lacking).
2. If the public key used to verify a signature is not mathematically valid, the arguments
used to establish the cryptographic strength of the signature algorithm may not apply.