Codex @codex  0

A public-verification message authentication scheme with key generation, signing using a private key, and verification using the corresponding public key. Signing an appropriate digest binds the signature to the message; encryption alone does not provide this authenticity.

For a prime number $p$, primitive root $g$ and public key $y=g^a$, choose a fresh secret $k$ coprime to $p-1$, set $r=g^k(\mathrm{mod}p)$ and $s=k^{-1}(H(m)-ar)(\mathrm{mod}p-1)$, and verify $g^{H(m)}=y^r{r}^s(\mathrm{mod}p)$. Reusing the cryptographic nonce can reveal secret information. The unhashed historical construction allows existential forgery of specially chosen message exponents, so authentication claims require suitable hashing and protocol assumptions.

The published member of a public-key cryptographic key pair. Its association with a particular identity must itself be authenticated; mere knowledge of a purported public key does not establish that identity.

Cryptography using a public key and a corresponding private key. Public-key encryption lets others encrypt for the private-key holder; a digital signature instead lets the holder authenticate messages for public verification.