[plug] PGP Sign messages

[Cameron Patrick]

Steve Baker wrote:

> More correctly, the hash is *encrypted by* the private key of the 
> keypair.

No, it's /decrypted/.

In public key encryption, /anyone/ can encrypt, even without knowing
the private key.  You need the key to decrypt.  This makes sense,
because you want anyone to be able to send a secret message to you
(encryption) but only you should be able to read that secret message
(decryption).

Encryption and decryption are mathematical functions, such that one
is the reverse of the other; i.e. D(E(M)) = M and E(D(M)) = M, where D
is decrypt, E is encrypt and M is your message.

Hence, to compute the signature, you decrypt the hash with your key
(which only you can do, because you need the private key).  To verify
it, you encrypt it with the key that's been used to create the hash
(which anyone can do because you only need the public key to encrypt)
and compare it to a hash of the message.

Cameron.