How a digital signature works
Signing takes two inputs, the message and the private key, and produces a short string of numbers. Verifying takes the message, the signature and the public key, and answers yes or no. The private key is never revealed.
A signature fits one message only: change a single character of a transaction, such as the amount or the destination, and verification fails.
The US standard for digital signatures, FIPS 186-5 of 3 February 2023, names what that gives: detection of unauthorised changes to the data, authentication of the signatory, and non-repudiation, since the signatory cannot easily deny the signature later.
Digital signatures in crypto and payments
A wallet signs each transaction and every node verifies it before passing it on, so no bank has to vouch for the sender. Multisig requires several signatures, and MPC lets several parties produce one signature together.
The same mathematics runs through card payments and banking: chip cards sign transaction data, apps sign API requests, and passkeys sign login challenges.
A signature proves that a key was used, not who used it or whether the signer was deceived. Key protection and clear confirmation screens therefore matter as much as the cryptography.
Digital signature, electronic signature or encryption?
- Electronic signature
- A legal concept. The eIDAS Regulation, (EU) No 910/2014, defines it as data in electronic form attached to or logically associated with other data and used by the signatory to sign. A digital signature is one technique for making one.
- Encryption
- Hides a message from everyone but the key holder. A signature hides nothing: it proves origin and integrity.
- Hash
- A fingerprint of data that anyone can compute. A signature is a fingerprint that only the key holder can produce.
Where a digital signature shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Custody & walletsWallets on every major chain, with MPC custody from leading providers or your own keys.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- NIST, FIPS 186-5, Digital Signature Standard (DSS), 3 February 2023
- Regulation (EU) No 910/2014 (eIDAS), Article 3 (legislation.gov.uk)
General information, not legal advice: what applies to you depends on your services and your market.