A digital signature is a cryptographic mechanism used to verify that data was signed with a particular private key and has not been altered in a way that invalidates the signature. It is different from merely typing a name or pasting an image of a handwritten signature into a document. Digital signatures can support authenticity and integrity, but the meaning of a signature still depends on who controls the key and the surrounding process.
Private and public keys
A digital signature system uses a private key to create a signature and a corresponding public key to verify it. The private key should be protected; the public key can be distributed for verification.
What a cryptographic hash does
A hash function produces a compact digest of a document’s contents. Signature algorithms use the data or its digest in a cryptographic process. Changing the document normally causes verification against the original signature to fail.
How a document is signed
A signing application prepares the document, applies the signing key and embeds or associates signature information. The exact workflow depends on the file format and service.
How verification works
The verifier uses the relevant public key and algorithm to check the signature. Successful verification supports a conclusion about the signed bytes and key, not automatically about the signer’s intentions.
Why certificates matter
A digital certificate can bind a public key to an identity or organisation under a certification authority’s procedures. A verifier may check the certificate chain, validity period and revocation information.
What a trusted certificate authority does
A certification authority issues certificates after specified validation procedures. Trust depends on the authority, its policies and the verifier’s trusted certificate list.
Signature validity versus document meaning
A valid cryptographic signature does not prove that the document’s claims are true or that the signer understood every clause. It shows a defined technical relationship between the signed content and a key.
Electronic signatures versus digital signatures
Electronic signature is a broad category covering electronic indications of agreement. A digital signature is a specific cryptographic technique. Not every electronic signature service uses the same cryptographic controls.
What timestamps add
A trusted timestamp can help establish that certain signed data existed at a particular time. Long-term validation may also require preserving certificates, revocation evidence and supported algorithms.
What happens after editing
Editing signed content can invalidate the signature, depending on format and permitted changes. Some document systems support multiple signatures or controlled updates with explicit rules.
How to verify a signed PDF
Use a trustworthy PDF reader or verification service, inspect the signature status, certificate identity and document-change warnings. Do not rely solely on a visible signature image.
Singapore legal context
Singapore’s Electronic Transactions Act provides a legal framework for electronic transactions and signatures. Whether a method meets a particular legal requirement depends on the transaction and applicable rules. Seek professional advice for high-stakes agreements.
Security and key compromise
If a private key is stolen, an attacker may be able to create signatures that appear to originate from the key holder. Key protection, revocation and incident response therefore matter.
Frequently asked questions
Is a scanned signature a digital signature? Not by itself. Can a valid signature prove every statement is correct? No. Does editing invalidate a signature? It often does, depending on the format and change. Can a certificate expire? Yes.
Practical takeaway
Follow document → cryptographic signing key → signature → certificate or identity context → verification. Treat technical validity, legal effect and factual truth as separate questions.
Sources and further reading
NIST Digital Signature Standard