What best describes a digital signature and how it verifies authenticity?

• A. A hash encrypted with a private key; verifies origin and integrity when decrypted with public key.
• B. A symmetric key used for confidentiality.
• C. A password hashed with bcrypt.
• D. A certificate revocation list.

Answer: (A)

Digital signatures rely on asymmetric cryptography to prove who sent a message and that it hasn’t been altered. The basic idea is to create a short, fixed representation of the data, called a hash, and then encrypt that hash with the signer’s private key. This encrypted hash is the signature. When someone receives the data and the signature, they use the signer’s public key to decrypt the signature back into the hash and independently compute the hash of the received data. If the two hashes match, it shows that the data came from the holder of the private key (authenticity) and that the data hasn’t changed in transit (integrity). Because only the owner of the private key could have produced that signature, the signer cannot later deny having signed it—non-repudiation.

It’s important to note that digital signatures don’t by themselves hide the content. They provide authenticity and integrity, not confidentiality. Also, signing typically signs a hash rather than the entire message for efficiency, and common algorithms involve signing with a private key and verifying with a corresponding public key. The other concepts listed—using a symmetric key for secrecy, hashing a password for storage, or managing a certificate revocation list—address different security goals and don’t describe the signing process used to verify origin and integrity.