====== Digital Signature Verification ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go to Terms and Definitions]]

===== Discussion =====

Digital Signature Verification evaluates a [[dido:99_annexes:annex-b-terms-and-definitions:d:digital_signature|Digital Signature]] against an identified digital representation using the applicable verification key and verification conditions.

The evaluation determines whether the Digital Signature is valid for the evaluated representation under those conditions.

Digital Signature Verification may evaluate:

  * Whether the Digital Signature corresponds to the evaluated representation
  * Whether the evaluated representation changed after signing
  * Whether the verification key corresponds to the signing key
  * Whether the signing identity satisfies applicable trust conditions
  * Whether the signing key or credential remains acceptable under applicable policy

Digital Signature Verification differs from content comparison:

  * Content comparison determines whether two representations are equal or different
  * Digital Signature Verification evaluates a cryptographic relationship among a representation, a Digital Signature, and a verification key

Digital Signature Verification also differs from compliance assessment:

  * Digital Signature Verification evaluates the validity of a Digital Signature
  * Compliance assessment evaluates a subject against identified compliance criteria

===== Definition =====

//verification process that evaluates a digital signature against an identified digital representation using the applicable verification key and verification conditions//

===== Source =====

Dido Solutions, Inc. and Jackrabbit Consulting, Inc.

===== Note =====

A successful Digital Signature Verification does not by itself establish that the evaluated subject is:

  * Approved
  * Correct
  * Compliant
  * Free from vulnerabilities
  * Authorized for deployment
  * Suitable for a specified purpose

The verification result should identify:

  * The evaluated representation
  * The evaluated Digital Signature
  * The applicable verification key
  * The applicable verification conditions
  * The verification result

===== Example =====

Crucible performs Digital Signature Verification by evaluating the Digital Signature associated with a Machine Image against the Machine Image content digest and the applicable verification key.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>