What is RSA Signing

This page explains RSA signature concepts and the signing flow. Developers who are new to asymmetric signatures should read the full page.

RSA Overview

RSA is an asymmetric algorithm. Encryption and decryption use a key pair: a public key and a private key. The keys are mathematically related. Security relies on the difficulty of factoring large integers. Typically the private key is kept secret by the owner, while the public key can be shared.

RSA Signing Flow

1. Party A generates a key pair (public key + private key). A keeps the private key and publishes the public key.
2. A signs a message with A's private key and sends both the message and the signature to B.
3. B verifies the signature with A's public key. If verification succeeds, B can trust that the message came from A and was not tampered with.

Even if an attacker intercepts the message and signature, the attacker cannot forge a valid signature without A's private key.

In Transafe Integrations

• Merchants sign API requests with the merchant private key.
• Merchants verify platform callbacks with the platform public key.
• Signature algorithm: OPENSSL_ALGO_SHA256.

Continue with Signature & Verification.