Scenario: Alice wants to send a signed, authenticated email to Bob. You will walk through the complete PKI workflow — from key generation and certificate issuance to signing, transmitting, and verifying the message. Complete each step in order. No cryptographic knowledge is required — the lab simulates the math for you.
STEP 1
Generate RSA Key Pairs for Alice & Bob
In RSA, a key pair consists of a public key (shared freely) and a private key (kept secret). The keys are mathematically linked: data encrypted with one can only be decrypted with the other.
A
Alice
📧 Sender — will sign the email
🔓 Alice's Public Key
—
🔒 Alice's Private Key SECRET
—
B
Bob
📥 Recipient — will verify the signature
🔓 Bob's Public Key
—
🔒 Bob's Private Key SECRET
—
Key concept: Alice's private key never leaves her system. She will use it to sign messages. Bob — and the world — can have Alice's public key to verify those signatures. Bob's key pair works the same way in reverse for any reply he sends.
A Certificate Authority (CA) is a trusted third party that vouches for the binding between a public key and an identity. The CA signs a certificate with its own private key. Anyone who trusts the CA can verify the certificate.
Why this matters: When Bob receives an email from Alice, he doesn't just trust her public key in isolation — he trusts the CA's signature on her certificate, which proves the key genuinely belongs to her.
STEP 3
Alice Composes, Hashes, and Signs the Email
How Digital Signing Works
✉️
Compose Message
#
Hash (SHA-256)
🔒
Encrypt Hash with Private Key
📎
Attach Signature
📤
Send to Bob
A
Alice's Email Compose
📝 Message
# SHA-256
🔒 Encrypt
📜 Cert
The signature is the hash encrypted with Alice's private key. Attaching her certificate lets Bob independently verify her public key is legitimate.
SENT
Email Arrives in Bob's Inbox
From:—
To:—
Subject:—
Signed:✅ S/MIME Signature Present
—
📎 Attached to S/MIME Header
Signature:—
Certificate:—
STEP 4
Bob Verifies the Digital Signature
To verify Alice's signature, Bob: (1) extracts Alice's public key from her certificate, (2) verifies the certificate was signed by a trusted CA, (3) decrypts the signature with Alice's public key to recover the original hash, then (4) re-computes the hash of the received message and compares. If they match — the message is authentic and unaltered.
Bob's Verification Pipeline
📜
Check Certificate
🔓
Decrypt Sig w/ Public Key
#
Re-hash Message
⚖️
Compare Hashes
✅
Accept or Reject
B
Bob's Verification
📜 CA Sig
—
🔓 Decrypt
—
# Re-hash
—
⚖️ Match?
—
STEP 5
Attack Scenarios — What Happens When Things Go Wrong?
Select an attack scenario and run the verification to see how digital signatures detect tampering and impersonation.
Choose an Attack Scenario
The message content is altered in transit (e.g., amount changed from $124,500 to $999,500). The signature was created over the original message.
An attacker attempts to create a valid signature using a different (unknown) key and attach it to an otherwise legitimate message.
Attacker creates a certificate with Alice's name but their own public key — and does NOT have it signed by the trusted CA.
The original email and signature are valid, but the email was sent months ago. Bob receives it again with the same valid signature.