Digital Signature

Digital signature

Digital signature algorithm is the one that makes the receiver believe that the message was sent by the claimed sender, and trust the message.

There are different types of signing techniques for Example Text signer, Xml signer etc.. We used the XML Signer. First I will explain the signing process how it will take place.

User will pass the Data along with the certificate and signing process will sign the Data using the certificate and pass the data with signature and certificate. We are calling this data as digitally signed Data. Receiver will separate the data and signature form the digitally signed data. And make another signature from that data and compare the both signature.

CAPICOM is a discontinued ActiveX control created by Microsoft to help expose a select set of Microsoft Cryptographic Application Programming Interface (CryptoAPI) functions through Microsoft Component Object Model (COM). CAPICOM can be used to digitally sign data, inspect, verify and display their digital signature and/or digital certificate. CAPICOM Version 2.1.0.2, the latest and last version of CAPICOM, is officially supported on Windows Vista. We are using CAPICOM Version 2.1.0.2

Signing Process

• We are passing Data for signing and the certificate information.
• CAPICOM will take the certificate details like Hash algorithm and apply that algorithm to data and get the Hash called it as Message Digest (MD).
• Using this MD and primary key which is present in certificate, it will create the signature
• It will integrate signature certificate and Data. This data is called digitally signed data.

Verify Process

• We are passing the digitally signed data for verification
• It will separate the Data signature and certificate.
• Using data it will create once again the hash (message Digest) let’s say MD1, using certificate primary key and hash algorithm.
• It will get another MD using signature which is passed though digitally signed data, using local key of certificate. Let’s say this MD as MD2
• For verifying the signing it will check the MD1 is equal to MD2 or not.