Understand what a signature does not prove
By the end, explain the diagram in your own words, solve the case and justify the correction.
Prerequisites : What is a blockchain?
Level 1 · Beginner →Reading path · 2 / 12 · Beginner
A hash checks a fingerprint; a signature proves authority over a message. Neither proves that the message is true or safe.
The essentials
A cryptographic hash maps data to a fixed-length fingerprint. The same input produces the same output; even a small change produces a different-looking result. Suitable hash functions make finding a matching input or two colliding inputs computationally impractical.
How it works
Hashing is not encryption. Encryption conceals a message until it is decrypted; a hash helps check integrity. Matching a fingerprint establishes consistency with particular data, not that the underlying statement is true. Hashing a false invoice does not make it genuine.
What to watch
A private key authorises a signature on a specific message. Its public key permits verification without revealing that secret. A wallet manages keys or signing arrangements; coins are recorded on the network. A valid signature can still authorise a harmful action if the signer misunderstood the destination or permissions.
Understand the details
A private key authorizes signatures; a public key lets others verify them. The signed message must include the intended context. Otherwise a valid authorization may be replayed somewhere it was not intended. Wallets can display transfers, contract calls or structured messages, and these are not interchangeable. A readable website description is not itself the message being signed.
Boundaries and common mistakes
A recovery phrase can derive many keys. It is not a password that customer support can reset. A hash is not encryption: there is normally no decryption key that recovers the input. For predictable inputs, an attacker can try guesses and compare hashes. This is why hashing personal information does not automatically make it anonymous.
The mechanism at a glance
- Message + context
- Private-key signature
- Public-key verification
- Authorization, not truth
Apply the lesson to a case
A page says “sign in”, but the wallet displays permission for another address to transfer tokens. Write down the website claim, the actual authorization and the party receiving it. The signature may be cryptographically correct while the requested action is harmful.
Before signing, inspect the network, destination, amount, spender and expiry when present. Verification afterwards establishes that the signature matches the message and key, not that the human understood it. Never use a real recovery phrase for this exercise; a fictional message is sufficient.
Three operations, three questions
Imagine receiving a file and a fingerprint from its publisher. Recomputing the fingerprint helps detect a changed file, provided the expected fingerprint came through a trustworthy channel. If an attacker replaces both the file and its fingerprint, matching them does not establish authenticity.
Encryption answers a different question: who can read the data? A digital signature instead lets a verifier check that a message was signed under a particular key. In a wallet, changing the recipient after signing normally invalidates the signature for that transaction. However, signing a malicious recipient in the first place still produces a valid signature.
A useful reading order is message → hash → signature verification → transaction rules. The network checks these rules, not whether the human signer understood the screen. Use the Merkle demonstration in Explore to change a message and compare its fingerprints without entering any secret.
Check your understanding
No. The expected fingerprint needs an authenticated source. A matching hash alone establishes consistency.
Terms in this lesson
- Hash
- A fixed-length fingerprint computed from data by a hash function. It checks consistency, not truth.
- Private key
- A cryptographic secret used to authorise signatures under a signing scheme.
- Public key
- A value that permits signature verification without revealing the private key.
Prepare a correction note
Describe the passage and the proposed correction. This creates a local note for you to share; it sends nothing. Do not include personal or confidential information.