In one sentence
A digital signature is a short piece of data, made with a private key, that proves the key holder approved one specific message and that the message has not been altered since.
How it works
Every signature scheme has two operations. Signing takes a message — in practice, a hash of it — and a private key, and produces a signature. Verifying takes the message, the signature and the public key, and gives one of two answers: valid or not valid.
Unlike a handwritten signature, a digital one is different for every message. It is bound to the exact content, so it cannot be cut from one document and pasted onto another. Change one character of the message and verification fails.
Bitcoin has used ECDSA over the secp256k1 curve since 2009, and since the Taproot upgrade activated in November 2021 it also supports Schnorr signatures, specified in BIP-340. Ethereum transactions use ECDSA on the same curve, while Ethereum validators sign their votes with BLS signatures, which can be combined into one compact aggregate.
ECDSA has a sharp edge: each signature uses a fresh secret random value. If the same value is ever used twice with one key, the private key can be calculated from the two signatures. This has caused real losses, which is why RFC 6979 describes a way to derive that value deterministically instead of relying on a random-number generator.
A simple example
A transaction says: move units from address A to address B, with this fee. The owner of A signs it and broadcasts it. Somewhere on the way, a malicious relay replaces B with its own address. Every node that receives the altered version runs verification against A's public key — and gets "not valid". The altered transaction is dropped; the attacker gains nothing.
Common misconception
Misconception: Signing a transaction encrypts it so that nobody else can read it.
In fact: Both the transaction and its signature are public. A signature proves who approved a message; it does nothing to hide the message.
Where you meet it
- Every blockchain transaction and every validator vote.
- Multisignature arrangements that require several keys to approve one action.
- Outside crypto: software updates, HTTPS, and electronic signatures under the EU eIDAS Regulation.
Related cards
Sources
This card explains a technical concept for general education. It is not a recommendation to acquire, sell or hold any crypto-asset, and it is not financial advice.