The Equivalent of a Written Signature - Burdens of Proof - page 64

electronic environment lay in providing messages verifiable by third parties:
“Current electronic authentication systems cannot meet the need for a
purely digital unforgeable message-dependent signature. They provide pro-
tection against third-parties forgeries, but do not protect against disputes
between transmitter and receiver.” 7
In these two short sentences, Diffie and Hellman laid out the essential
design of cryptographic signatures, a design that has remained largely
untouched to this day: a digital signature is (a) purely digital ; (b) unforgeable ,
in the sense of being uniquely linked to its author; (c) message-dependent ,
that is, uniquely linked to each message; and (d) providing protection
against disputes between the contracting parties.
Public-key cryptography fulfilled just such properties, if one inversed
the procedure required for encryption: to produce a signature, Alice must
use her private key , and to verify Alice's signature, Bob must use Alice's
public key (see figures 4.1 and 4.2). That is, Alice encrypts her message using
her private key and sends the resulting ciphertext to Bob . Note that the
procedure does not provide for confidential communication: because Alice's
Figure 4.1
Public-key cryptography, authentication mode. By reversing the order of the keys
used to encrypt and decrypt, one obtains an entirely different set of security proper-
ties. Image courtesy of Dr. Warwick Ford.