Search code examples
c#encryptionverificationsign

In sign and verification data why should have original data to verification?

I was reading this article, there are two byte array, one for signed data and one for the original data.

 byte[] originalData = ByteConverter.GetBytes(dataString);
 byte[] signedData;

We sign the data, this part is ok but I can not understand to verification why should we use original data?

// Hash and sign the data.
   signedData = HashAndSignBytes(originalData, Key);

// Verify the data and display the result to the
// console.
   VerifySignedHash(originalData, signedData, Key);

As an example we sign a data in the server and send it to the client, Clients want to find I sent that data or not, why should I send original data until the client can verifying it?

There is some post who did it in the same way:

Solution

  • When passing the signedData the other part doesn't know what the originalData is, just by that.
    To verify, you need both the signedData and the [ originalData and public-key ].

    The VerifySignedHash function in the code mentioned above, calls to RSACryptoServiceProvider.VerifyData.


    From the docs:

    Verifies that a digital signature is valid by determining the hash value in the signature using the provided public key and comparing it to the hash value of the provided data.