數位簽名
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
數位簽章原始碼可讓您驗證資料是否遭到竄改。它可確保已簽署資料的真實性和完整性，但不保證其機密性。這項功能是非對稱的，也就是說，它會使用一組金鑰 (公開金鑰和私密金鑰)。
數位簽名基本元素具有下列屬性：
- 真實性：除非您擁有私密金鑰，否則無法建立
PublicKeyVerify.Verify(signature, message) 驗證的簽名。
- 非對稱：建立簽名時使用的金鑰與驗證簽名時使用的金鑰不同。這樣一來，您就能將公開金鑰發送給無法自行建立簽名的對象，以便驗證簽名。
如果您不需要不對稱性，建議改用更簡單、更有效率的 MAC 基本元素。
數位簽章的功能在 Tink 中以一組基本元素表示：
- 用於簽署資料的 PublicKeySign
- PublicKeyVerify：用於驗證簽名
選擇金鑰類型
我們建議您在多數用途中使用 ECDSA_P256，但也有其他選項。一般來說，下列情況成立：
- ECDSA_P256 是最常用的選項，也是合理的預設值。不過請注意，ECDSA 簽章是可變形的。
- ED25519 可建立確定性簽章，且效能優於 ECDSA_P256。
- RSA_SSA_PKCS1_3072_SHA256_F4 會建立確定性簽名，並提供最佳驗證效能 (但簽署速度比 ECDSA_P256 或 ED25519 慢得多)。
最低安全性保證
- 要簽署的資料長度可任意設定
- 針對橢圓曲線型態的方案，提供 128 位元安全性等級，以防範自適應選定訊息攻擊
- 112 位元安全性等級，可防範以 RSA 為基礎的企圖攻擊 (允許 2048 位元金鑰)
可塑性
如果攻擊者可以為已簽署的訊息建立不同的有效簽名，則簽名架構就會變得易變。雖然這對大多數情況而言並非問題，但在某些情況下，程式設計師會隱含假設有效的簽名是唯一的，這可能會導致意外的結果。
用途範例
請參閱「我想為資料加上數位簽章」。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-25 (世界標準時間)。
[null,null,["上次更新時間：2025-07-25 (世界標準時間)。"],[[["\u003cp\u003eDigital signatures ensure data integrity and authenticity by verifying that data hasn't been tampered with.\u003c/p\u003e\n"],["\u003cp\u003eThey use a pair of keys (public and private) for asymmetric signing and verification, allowing for secure distribution of the public key.\u003c/p\u003e\n"],["\u003cp\u003eTink provides two primitives for digital signatures: \u003ccode\u003ePublicKeySign\u003c/code\u003e for signing and \u003ccode\u003ePublicKeyVerify\u003c/code\u003e for verifying.\u003c/p\u003e\n"],["\u003cp\u003eECDSA_P256 is generally recommended, with ED25519 offering better performance and RSA_SSA_PKCS1_3072_SHA256_F4 providing the fastest verification.\u003c/p\u003e\n"],["\u003cp\u003eDigital signatures in Tink guarantee a minimum of 112-bit security and support data of any length.\u003c/p\u003e\n"]]],["Digital signatures ensure data authenticity and integrity using asymmetric key pairs (public and private). `PublicKeySign` signs data, while `PublicKeyVerify` checks signatures. Key options include the widely used ECDSA_P256, faster ED25519, and high-verification-performance RSA_SSA_PKCS1_3072_SHA256_F4. Signatures offer 128-bit security (elliptic curves) or 112-bit security (RSA). ECDSA signatures are malleable, allowing attackers to forge valid signatures. If asymmetry is not needed consider using MAC.\n"],null,["# Digital Signature\n\nThe Digital Signature primitive lets you verify that no one has tampered with\nyour data. It provides authenticity and integrity, but not secrecy, of the\nsigned data. It is asymmetric, meaning it uses a pair of keys (public key and\nprivate key).\n\nThe Digital Signature primitive has the following properties:\n\n- **Authenticity** : It is impossible to create a signature for which `PublicKeyVerify.Verify(signature, message)` validates, unless you have the private key.\n- **Asymmetric**: Creating the signature uses a different key than verifying it. This lets you distribute the public key to verify signatures to parties that can't create signatures themselves.\n\nIf you don't need asymmetry, consider using the simpler and more efficient\n[MAC](/tink/mac) primitive instead.\n\nThe functionality of digital signatures is represented in Tink as a pair of\nprimitives:\n\n- *PublicKeySign* for signing data\n- *PublicKeyVerify* for verifying the signature\n\n### Choose a key type\n\nWe recommend using **ECDSA_P256** for most use cases, but there are a variety of\noptions. In general, the following holds true:\n\n- ECDSA_P256 is the most widely used option and a reasonable default. Note though that ECDSA signatures are [malleable](#malleable).\n- ED25519 creates deterministic signatures and provides better performance than ECDSA_P256.\n- RSA_SSA_PKCS1_3072_SHA256_F4 creates deterministic signatures and provides the best verification performance (but signing is much slower than ECDSA_P256 or ED25519).\n\n### Minimal security guarantees\n\n- Data to be signed can have arbitrary length\n- 128-bit security level against adaptive chosen-message attacks for elliptic curve based schemes\n- 112-bit security level against adaptive chosen-message attacks for RSA based schemes (allows 2048-bit keys)\n\n### Malleability\n\nA signature scheme is malleable if an attacker can create a different valid\nsignature for an already signed message. While this is not a problem for most\nscenarios, in some cases programmers implicitly assume that valid signatures are\nunique, and this can lead to unexpected results.\n\n### Example use case\n\nSee I want to [digitally sign data](/tink/digitally-sign-data)."]]
