Cryptographic signature

How it works

A signature uses a key pair. The signer keeps the private key secret. The verifier gets the public key.

1. Hash. The signer makes a short digest of the data with a hash function.
2. Sign. The signer applies the private key to the digest. NIST describes the result as two functions, a hash and then a signature function.
3. Send. The data goes out with the signature.
4. Verify. The verifier makes the digest again and checks it against the signature with the public key.

If one bit of the data changes, the check fails. If a different key signed, the check also fails.

Why it matters

NIST FIPS 186-5 (February 2023) gives three tasks to a signature:

Task	What it shows
Integrity	The data did not change after signing
Authentication	The holder of the private key signed it
Non-repudiation	The signer cannot easily deny it after

NIST SP 800-63B-4 (July 2025) also says what a signature does not give: confidentiality or replay protection. A signed message can be read by anyone. An attacker can also send a copy of a used signed message again.

In practice

Four uses of signatures in AI systems, as of October 2026:

Where	What is signed	Source
Model files	A manifest of hashes of each model file	OpenSSF model signing v1.0, April 2025
Agent descriptions	The A2A Agent Card, with JSON Web Signature	A2A specification 1.0.0, section 8.4
Agent payments	The Intent Mandate and Cart Mandate of the user	Google, AP2 announcement, September 2025
Media	The C2PA manifest of how content was made	C2PA explainer 2.2

Model files. The OpenSSF model signing tool hashes each file of a model and signs the list. At verify AI artifacts time, it computes the hashes again. A changed file gives a mismatch, and the tool reports that “the model integrity was compromised”. This is one control against AI supply chain compromise.

Agents. The Agent2Agent protocol (A2A) lets an agent sign its Agent Card. Clients “SHOULD” verify one or more signatures before they trust the card. Expired or revoked keys “MUST NOT” be used.

Transactions. Google calls AP2 Mandates “cryptographically-signed digital contracts” that give verifiable proof of the instructions of a user. The approval of the user signs a Cart Mandate with the items and price. This is a vendor claim from the protocol author.

Limits of a signature

• Trust in the key is a different problem. A signature only connects data to a key. A certificate, a trusted key store or the Sigstore identity check connects the key to a person or company.
• Signed does not mean correct. C2PA says Content Credentials “do not provide value judgments” on provenance data. A signed model can contain poisoned data. A signed instruction can be a bad instruction.
• Quantum risk. NIST published FIPS 204 (ML-DSA) in August 2024. NIST believes ML-DSA is secure “even against adversaries in possession of a large-scale quantum computer”.
• Bytes. An Ed25519 signature is 64 bytes, and its keys are 32 bytes (RFC 8032, January 2017).

Questions and answers

Is a cryptographic signature the same as encryption?

No. A signature shows who signed data and that the data did not change. It does not hide the data. NIST says digital signatures give authenticity, integrity and non-repudiation support, "but not confidentiality or replay attack protection".

Does a valid signature on an AI model mean the model is safe?

No. A valid signature shows that a key holder signed the files. It also shows that the files did not change after. It does not check what the files do. A stolen key also makes valid signatures, as MITRE ATT&CK records for code signing. Check who signed, then check the model.

Which signature algorithms are approved by NIST?

FIPS 186-5, from 3 February 2023, approves RSA, ECDSA and EdDSA. DSA is kept only to verify signatures made before. FIPS 204, from August 2024, adds ML-DSA, which NIST believes is secure against a large-scale quantum computer.