====== Digital Signature ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go to Terms and Definitions]]

===== Discussion =====

A Digital Signature is a cryptographic value generated for an identified digital representation using a signing key.

A corresponding verification process evaluates the Digital Signature using the applicable verification key and verification conditions.

A Digital Signature may be generated for:

  * An [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]]
  * An [[dido:99_annexes:annex-b-terms-and-definitions:i:image|Image]]
  * A content digest
  * A document
  * A message
  * A data set
  * A software package
  * A metadata record

A Digital Signature may contribute to evaluation of:

  * Whether the signed representation changed after signing
  * Whether the signature corresponds to the signed representation
  * Whether the signature was generated using the signing key associated with an identified signing identity

A Digital Signature differs from a content digest:

  * A content digest represents content through the output of a digest algorithm
  * A Digital Signature applies a cryptographic signing operation to an identified representation, which may include a content digest

A Digital Signature differs from an electronic signature:

  * A Digital Signature uses cryptographic operations to associate a signed representation with a signing key
  * An electronic signature is a broader concept that may use cryptographic or noncryptographic mechanisms

===== Definition =====

//cryptographic value generated for an identified digital representation using a signing key and evaluable using a corresponding verification key//

===== Source =====

Dido Solutions, Inc. and Jackrabbit Consulting, Inc.

===== Note =====

A valid Digital Signature does not by itself establish that the signed subject is:

  * Approved
  * Correct
  * Compliant
  * Free from vulnerabilities
  * Authorized for deployment
  * Suitable for a specified purpose

A Digital Signature also does not establish the trustworthiness of the signing identity unless the applicable trust conditions establish that relationship.

The term does not prescribe a particular cryptographic algorithm, certificate mechanism, key-management system, signature format, or trust model.

===== Example =====

Crucible generates a Digital Signature for the content digest of an Image and associates the Digital Signature with the Image identifier and signing identity.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>