Public-key cryptography
Sign and verify data
Use digital signatures to bind exact bytes to a private-key holder and verify identity, context, format, and freshness before trusting the result.
8 minute lesson
A digital signature is created with a private key and verified with the public key. It proves more than a checksum, but less than “this action is safe.”
Define a canonical or exact byte representation, include purpose and version, and verify with the expected public key. A valid signature from an unexpected signer or for an old message should still be rejected by policy.
A deployment manifest has a valid signature but names an old artifact with a known vulnerability. The signature proves who signed those bytes, not that the release is current or approved now.
Sign an exact, versioned representation that includes purpose and context. Verification must also enforce the expected signer, project, freshness, and authorization policy.
Define and save the exact signed bytes for a release manifest containing project, version, artifact digest, purpose, and timestamp. Verify a valid current manifest with the expected public key. Then replay an old valid manifest and prove a freshness or release-policy check rejects it.
Lesson completed