Hashes, Signatures and Certificates
A cryptographic hash gives a short fingerprint that is impractical to forge a match for, which makes tampering detectable. Signing a hash with a private key proves who produced it, and a certificate is that signature applied to the claim that a key belongs to a name.
What a learner can do afterwards
- Say what property of a hash makes it usable for detecting tampering
- Explain what a signature proves and what it does not
- Follow a certificate chain up to a root and say what trust is being placed where
1 · Read
A hash is a short fingerprint of some data. Change one letter and the fingerprint comes out completely different. It is impractical to craft a different input with the same fingerprint, so when you recompute it, tampering stands out.
You download a file plus its posted fingerprint. You hash the download and the two match, so nothing changed on the way. If one byte had flipped, your fingerprint would differ and you would know.
A signature is that fingerprint locked with someone's private key, which proves who produced the statement. It does not prove the statement is true or the site is safe. A certificate applies that signature to the claim that a key belongs to a name.
Your browser climbs the chain link by link: each signature, the requested name, and the dates. Trust lands on the root stored in your computer, not on the website alone.
Hashes expose change, signatures name the author, and the chain moves your trust up to a root you already hold.
2 · Watch
Take it off screen
Where it sits
8 questions wait behind this lesson, each with its answer explained. Every answer feeds the sky: stars light as they are learned, and dim when it is time to come back.