How Digital Signatures Work (Step-by-Step Explanation)

Digital signatures are used to securely sign documents in applications such as income tax filing, GST returns, MCA filings, Legal documents and government documents. But how exactly does a digital signature work?

A digital signature works using cryptography, hash functions, and Public Key Infrastructure (PKI) to ensure that a document is authentic and has not been modified after signing.

---

Quick Answer

A digital signature works by creating a hash of the document, encrypting it using the signer’s private key, and verifying it using the public key. This ensures authenticity, integrity, and non-repudiation.

---

Step-by-Step Process of Digital Signature

The working of a digital signature involves the following steps:

Step 1: Document Hashing

The document is processed using a hash algorithm such as SHA-256. This generates a unique value called a hash or digital fingerprint.

Even a small change in the document will produce a completely different hash.

Step 2: Signing Using Private Key

The generated hash is encrypted using the private key of the signer. This encrypted hash becomes the digital signature.

The private key is securely stored, often inside a USB token or Hardware Security Module (HSM).

Step 3: Attaching Digital Signature

The digital signature is attached to the document along with the Digital Signature Certificate (DSC), which contains the signer’s identity and public key.

Step 4: Signature Verification

When the document is opened, the PDF reader or system performs verification:

• Recalculates the hash of the document
• Decrypts the digital signature using the public key
• Compares both hash values

If both hashes match, the document is verified as authentic.

---

Digital Signature Working (Simple Flow Diagram)

Signing Process:
Document → Hash (SHA-256) → Encrypt with Private Key → Digital Signature

Verification Process:
Digital Signature → Decrypt with Public Key → Compare Hash → Valid / Invalid

---

Role of Public Key Infrastructure (PKI)

Digital signatures work within a framework called Public Key Infrastructure (PKI).

PKI ensures that public keys belong to the correct person and are issued by trusted authorities.

Key components of PKI include:

• Digital Signature Certificate (DSC)
• Certifying Authority (CA)
• Root and Intermediate Certificates
• Certificate Revocation mechanisms (CRL / OCSP)

In India, Certifying Authorities are regulated by the Controller of Certifying Authorities (CCA) under the Information Technology Act, 2000.

---

Why Hashing is Important

Hashing ensures that the document has not been modified after signing.

If even one character is changed, the hash will change, and the signature will become invalid.

---

Why Private Key Security is Critical

The private key is the most sensitive part of a digital signature.

If someone gets access to your private key, they can sign documents on your behalf.

This is why private keys are stored securely in:

• USB tokens
• Hardware Security Modules (HSMs)

---

Where This Process is Used

• Income Tax Filing
• GST Returns
• MCA Filings
• Government eOffice systems
• Aadhaar eSign services

---

Conclusion

Digital signatures work using a combination of hashing, encryption, and PKI to ensure document security.

They provide authenticity, integrity, and non-repudiation, making them essential for secure digital transactions.

Understanding how digital signatures work helps users trust digitally signed documents in real-world applications.