Knowlegde Through Fun Welcome To Mady's Site.

Suppose there is a XYZ company, which is a client of ABC consultancy.
XYZ seeks advice from ABC in the company matters. They used to
communicate with each other through letters for many years. Now, with
the computerization of XYZ, they decide to use electronic media for
information exchange. Since the information exchanged by the two
parties is of professional importance, they decide to use some
authentication protocol, so that reliable communication is possible.
The representatives from ABC and XYZ conduct a meeting and decide the
use of digital signature, as a means of authentic message transport.
To establish the digital signature system they perform the following
actions,

1. Each party contacts the authority responsible for allocating the
private and public key. By paying the required amount, each of them
gets a unique key pair.

2. Then each of them makes an application to the Certifying Authority
for getting the Digital Signature Certificate for the public key of
other party.

3. The Certifying authority asks the applicants to produce the private
key corresponding to the public key, to be listed in the digital
signature certificate, i.e. for ABC to obtain certificate for the
public key of XYZ, it should ask XYZ to produce its private key and
public key before the concerned Certifying Authority.

4. The Certifying Authority verifies the functioning of the key pair
i.e. they are capable of generation and verification of digital
signature.

5. On confirming the working of key pair, it issues a Digital
Signature Certificate to the applicant.

6. Now the company XYZ has the Certificate, which lists the public key
of ABC. While ABC has the Certificate, which lists the public key of
XYZ.

7. They install the software necessary for generation and verification
of each other's digital signature. This software must be same for both
the parties, so that they use the same hashing algorithm.

8. With this set-up they are ready to use the digital signature with
their messages. Each party can sign the messages by using the private
key and the recipient party can verify these messages using the
corresponding public key, listed on the digital signature certificate.

To understand how this system behaves in different circumstances we
consider number of cases of usage of this system.
CASE 1:
Company XYZ needs an advice from ABC consultancy regarding the
financial strategy of the company. So, it creates a message addressed
to ABC and attaches the digital signature to the message using the
correct private key. ABC receives the message from XYZ, and it applies
the public key of XYZ to the message. Suppose the message gets
verified.

Conclusion: Since the message got verified, ABC is assured that the
message was sent by XYZ and the content of that message is intact
since it was sent by XYZ.

CASE 2:
On receiving the above message, ABC decides to send an advice to XYZ.
So, ABC writes a message addressed to XYZ and uses its private key to
generate the digital signature. On receiving this message XYZ applies
the corresponding public key and verifies the message. It finds that
the signature gets verified.

Conclusion: Verification of the message is an indication of the
authenticity of the sender and integrity of the data. Thus XYZ can
safely assume that it has an unmodified message from ABC only, and no
one else.

CASE 3:
Suppose company XYZ takes action according the advice given by ABC
consultancy and XYZ has to suffer a major financial loss due this
action. XYZ holds ABC responsible for the loss and wants to take legal
action against ABC. Thus XYZ files a case in the court, accusing ABC
for giving wrong advice and demands compensation for the loss
suffered. The consultancy ABC denies giving such advice to XYZ. The
court asks XYZ to prove their claim against ABC.

Then XYZ produces the copy of message received from ABC and the
Digital signature certificate, which lists the public key of ABC. It
shows that the signature on the message gets verified by ABC's public
key, so that message was indeed sent by ABC. The court accepts the
claim of XYZ and orders ABC to give compensation to XYZ.

Conclusion: A digital signature can be used to prove the identity of
the sender to a third party.

CASE 4:
A company LMN is a business rival of XYZ and it knows about the
communication of XYZ with consultancy ABC. So LMN sends a fake
message, containing a false advice, to XYZ pretending to be ABC. On
receiving this message, XYZ verifies it with the public key of ABC. It
finds that the signature doesn't get verified. So, it rejects the
message considering it as invalid. Thus it is saved from getting wrong
advice.

Conclusion: Any message not signed by the proper private key will not
get verified by the public key corresponding to the correct private
key.
CASE 5:
Failing to mislead XYZ, LMN now decides to use some different method.
By some means LMN manages to modify the content of a message send by
ABC to XYZ. When XYZ receives the message and verifies it with the
public key, it finds that message is invalid. Thus it rejects the
advice. So again XYZ is safeguarded from the attempt to intrude into
the communication. XYZ immediately informs ABC about the rejection of
the message and asks them to resend the message.

Conclusion: Although the proper private key is used to generate
message, if the message content gets modified, then the message digest
generated at the receiver end is different, due to which the
signature will never get verified.

CASE 6:
With the failure of one more attempt to misinform the company XYZ,
LMN decides to steal the private key from ABC and somehow it succeeds
in obtaining it. LMN writes a message to XYZ in the disguise of ABC
and digitally signs the message using the stolen key. On receiving the
message, XYZ verifies the digital signature and finds it to be a valid
one. Thus it accepts the advice and acts accordingly. Following the
wrong advice it suffers loss and XYZ accuses ABC for the loss. The
court finding the valid signature accepts the claim of XYZ and ABC is
asked to give compensation.

Conclusion: Security of the private key is responsibility of the key
holder. If the key is lost, then the key owner will be responsible for
the damage made using the key.

On the Basis of all the above cases we can conclude that a Digital
Signature can protect the subscribers from any attempts of forgery,
provided that the private key is kept in a secure manner. Also this
system is considered valid in the legal matters. So using digital
signature is definitely an excellent option for preserving the
integrity of data and authenticity of the user identity.