Explain how a sender creates a digital signature and how a recipient verifies it. State what the signature does not provide by itself.

### Why this is right The signing process links the signer’s private key to a hash of the document. Verification uses the corresponding public key and the document’s contents to check that the signature is valid and that the data has not changed. ### The concept A hash is a compact fingerprint calculated from the document. If the document changes, its hash should differ, causing verification with the original signature to fail. The private key must remain under the signer’s control, while the public key can be shared for verification. A digital signature is not encryption: anyone able to read the document can still read it unless it is separately encrypted. Nor does a valid signature distinguish a new transmission from a replay of the same signed message. ### What a good answer covers - The sender calculates a hash of the document. - The sender uses the private key to sign the document’s hash. - The recipient uses the corresponding public key and document to verify. - The signature supports authenticity and integrity, not confidentiality or freshness by itself. ### Terms - **Hash**: A one-way fingerprint derived from data. - **Private key**: The secret key used by the signer in the signature process. - **Public key**: The corresponding shareable key used to verify the signature. - **Verification**: Checking whether a signature is valid for the document and key. ### Remember Signing detects changes and supports attribution; it does not hide content or prevent replay by itself.