The Digital Signature primitive lets you verify that no one has tampered with
your data. It provides authenticity and integrity, but not secrecy, of the
signed data. It is asymmetric, meaning it uses a pair of keys (public key and
private key).

The Digital Signature primitive has the following properties:

- **Authenticity** : It is impossible to create a signature for which `PublicKeyVerify.Verify(signature, message)` validates, unless you have the private key.
- **Asymmetric**: Creating the signature uses a different key than verifying it. This lets you distribute the public key to verify signatures to parties that can't create signatures themselves.

If you don't need asymmetry, consider using the simpler and more efficient
[MAC](https://developers.google.com/tink/mac) primitive instead.

The functionality of digital signatures is represented in Tink as a pair of
primitives:

- *PublicKeySign* for signing data
- *PublicKeyVerify* for verifying the signature

If the private key lives somewhere that the message can't easily be sent to,
such as an HSM or a KMS, see
[Prehash and SignPrehash](https://developers.google.com/tink/prehash-signing), which splits signing into a
public-key-only hashing step and a private-key-only signing step.

### Choose a key type

We recommend using **ML_DSA_44** or **ECDSA_P256** for most use cases, but there
are a variety of options. In general, the following holds true:

- ML-DSA-44 is quantum safe. We're actively implementing it and it is now recommended for [programming languages where it's
  available](https://developers.google.com/tink/supported-key-types#signature).

For the following non-post-quantum algorithms, you can expect that you will have
to change the key type in the near future.

- ECDSA_P256 is the most widely used option and a reasonable default. Note though that ECDSA signatures are [malleable](https://developers.google.com/tink/digital-signature#malleable).
- ED25519 creates deterministic signatures and provides better performance than ECDSA_P256.
- RSA_SSA_PKCS1_3072_SHA256_F4 creates deterministic signatures and provides the best verification performance (but signing is much slower than ECDSA_P256 or ED25519).

### Minimal security guarantees

- Data to be signed can have arbitrary length
- 128-bit security level against adaptive chosen-message attacks for elliptic curve based schemes
- 112-bit security level against adaptive chosen-message attacks for RSA based schemes (allows 2048-bit keys)

### Malleability

A signature scheme is malleable if an attacker can create a different valid
signature for an already signed message. While this is not a problem for most
scenarios, in some cases programmers implicitly assume that valid signatures are
unique, and this can lead to unexpected results.

### Example use case

See I want to [digitally sign data](https://developers.google.com/tink/digitally-sign-data).