A digital signature ensures the identity of the message originator. It shows how a message recipient would use an originator’s digital signature to authenticate that originator.

On the Web, authentication could work as follows:

•  The originator creates a message and the software performs a hash on the document.

•  The originator’s software then signs the message by encrypting it with the originator’s private key.

•  The originator sends the message to the server attaching his or her public key and certificate to the message, if necessary.

•  The server either requests the originator’s public key from a certificate/key repository or extracts the certification from the originator’s message.

With this service, the authentication authority could either attach an authentication message verifying the digital signature’s authenticity to the originator’s message or provide that authentication to the recipient via a publicly accessible database. Upon receipt, the recipient would either acknowledge the originator’s authenticity via the attached authentication message or access the public key and certificate from the publicly accessible database to read the signature.

To provide such levels of assurance, the certification authority must establish proofing stations where individuals and organizations can present themselves with appropriate identification and apply for certificates. The authority must also maintain or be part of a legal framework of protection and be in a position to mount an enforcement process to protect customers against fraud.