Digital signature
electronic signature · qualified electronic signature · eIDAS · code signing · ECDSA · signature numérique
A cryptographic mechanism that proves who signed a document or piece of software and guarantees it has not been altered since.
In practice
The signer computes the document’s hash and then signs it with their private key; anyone can verify the signature with the matching public key, usually contained in a certificate. The mechanism protects software updates (code signing), emails (S/MIME), TLS connections and contracts. The EU eIDAS Regulation defines three levels of electronic signature (simple, advanced, qualified): only the qualified signature has a legal effect equivalent to a handwritten one. Post-quantum signatures such as ML-DSA will gradually take over from RSA and ECDSA.
Fictional case: a software vendor signs every release. When an attacker spreads a fake update on a mirror site, client machines reject it: the signature does not match the vendor’s key.
How to protect yourself
- Sign the code and updates you ship, and verify those you install.
- Keep signing keys in an HSM or a dedicated service, never on a developer’s laptop.
- Use an eIDAS qualified trust service provider for documents with high legal stakes.
