9.1 General considerations
Assume Alice has generated herself a key pair (PKAlice,SKAlice) within some asymmetric cryptosystem. If Alice uses her private key SKAlice to compute some output s = sigAlice(x) based on an input x, this is an operation that can, at least in principle, only be performed by Alice because she is the only one to know SKAlice. This is fundamentally different from the situation when symmetric cryptosystems are used because here, at least two parties know the key K and can perform the same operations.
The fact that only Alice can compute s for some given input x motivates us to interpret sigAlice as a digital signature. However, for this to work in practice, some important points need to be clarified:
There must be some way to verify that Alice has produced the signature and that the signed document has not been changed since it has been signed. As this should be possible for any party, the verification step should not involve any secret information, but must be...
