What Is a Digital Signature?

If you are new to digital signing, this page is the gentle starting point. No prior crypto knowledge is assumed — we define every term the first time it appears and keep code to a minimum.

A picture of a signature is not a signature

Scanning your handwritten autograph and pasting the image onto a PDF looks signed, but it proves nothing:

• Anyone can copy that image and drop it onto a different document.
• If someone edits the page afterwards, the image happily sits there unchanged — it never notices.

A digital signature is not a picture. It is a small piece of mathematics, computed from two things at once: the exact bytes of the document, and a secret key that only the signer holds. Change one byte of the document, and the maths no longer adds up. That is the whole idea.

Why it matters: integrity, authenticity, non-repudiation

A good digital signature gives you three guarantees at once. It helps to learn the jargon words, because you will see them everywhere:

• Integrity — the document has not been altered since it was signed. If even a single byte changes, verification fails.
• Authenticity — you can tell who signed it, because the signature is tied to a certificate that names them.
• Non-repudiation — the signer cannot later credibly claim "that wasn't me", because only they held the secret key that produced the signature.

A plain analogy: a wax seal on a tamper-evident envelope

Think of an old letter closed with a wax seal pressed from a signet ring, sent inside a tamper-evident envelope:

• The unique seal shows who closed it (authenticity) and that only the ring's owner could have (non-repudiation).
• The tamper-evident envelope shows whether anyone opened or altered the letter in transit (integrity).

A digital signature is both of those, done with maths instead of wax — and, unlike wax, it can also carry a trusted timestamp proving when it was sealed.

The cast of characters

A signature involves a small ensemble of parts. Here is each one, in plain language.

• Private key / DSC — the secret half of a key pair, known only to the signer. It is what actually produces the signature. In India (and many places) the private key plus its certificate is called a DSC (Digital Signature Certificate) and usually lives on a USB token you plug in.
• Public key — the shareable half. Anyone can use it to check a signature the private key made, but it can never be used to forge one.
• Certificate — a small file that says "this public key belongs to this person / organisation", and is itself signed by a trusted authority so it can't be faked.
• Certificate Authority (CA) & trust — the authority that issues certificates and vouches for the identity inside them. Trust flows in a chain: your certificate is signed by an intermediate CA, which is signed by a root CA. If a viewer already trusts that root, it trusts your signature — otherwise it shows "validity unknown" (more on that in Troubleshooting).
• CMS / PKCS#7 — the standard "envelope" format that packages the signature bytes together with your certificate(s), so a viewer has everything it needs in one place. Mudrit builds this for you.
• Timestamp (TSA) — a Timestamp Authority is a trusted third party that stamps your signature with "this existed no later than time T", per the RFC-3161 standard. It answers when, from a source nobody can backdate.
• Long-term validation (LTV) — extra proof (the certificate chain plus revocation info) bundled into the document itself, so the signature still validates years later, even after the certificate has expired or the CA's servers have gone offline.

How Mudrit fits in

Mudrit is the tool that produces the signed PDF. You give it two things:

1. A key source — an object that implements the Signer trait. It knows your certificate and can produce the signature bytes. Mudrit ships three ready-made signers (a .pfx/.p12 file, a PKCS#11 token, and the Windows certificate store), and you can write your own for an HSM or cloud service. See Signing backends.
2. A SignConfig — a description of how to sign: where the visible box goes, whether to add a timestamp or LTV, and so on. The builder starts minimal — you set only what you need.

Mudrit takes those, hashes the document, asks the Signer for a signature, wraps it in CMS, writes the visible appearance, and hands back the signed PDF:

use mudrit::prelude::*;

let signer = PfxSigner::from_file("cert.pfx", "password")?;   // 1. a key source
let cfg    = SignConfig::builder()                            // 2. how to sign
    .place("L", [350, 60, 560, 160])?                         //    a box on the last page
    .reason("Approved")
    .build();

let signed = sign_pdf(std::fs::read("in.pdf")?, &signer, &cfg)?;
std::fs::write("out.pdf", &signed)?;

That is the entire model: key source + config in, signed PDF out. Everything else in these docs is a variation on those two inputs.

Next