On this page
A digital signature is a value computed from data with a private key, which anyone holding the matching public key can check, showing that the data was signed with that key and has not changed since.
What signatures give you
NIST's Digital Signature Standard, FIPS 186-5, names two core uses: detecting unauthorized changes to data, and authenticating the identity of the signer. A third follows from them: because only the private key could have produced the signature, the signer cannot easily deny it later.
Signing is not encryption. A signed document can be readable by everyone. Encryption hides content; a signature proves origin and integrity. Systems that handle sensitive data usually need both.
Why encrypted systems still need signatures
Picture a server that stores only ciphertext. It cannot read the secrets, but if nothing is signed it can still:
- add its own public key to the list of recipients, so that future versions are sealed to it;
- serve an old version of the data as if it were current;
- replace one member's data with another's.
Signatures on access lists and versions close those doors. Clients check them before trusting anything the server sends, so a compromised server can refuse service, but it cannot quietly rewrite who has access.
How Crunu uses signatures
Crunu signs with Ed25519:
- the access list of each environment is signed by an admin;
- every version is signed by its author;
- access profiles, invitations and the organization's revocation list are signed;
- share link contents are signed with the link's own key;
- agent and web client releases are signed.
Trust starts from the organization's signing key, which each member's devices pin after joining. That is why the server cannot present a different organization to a member. When an admin leaves, the organization moves to a new generation of keys, and certificates are reissued under it.
The crunu agent checks signatures on environment heads, versions, file copies, certificates and the revocation list. Combined with rollback protection, this lets clients notice when the server sends altered or outdated data. See how encryption works.
Sources
- NIST FIPS 186-5: Digital Signature Standard (DSS), checked October 27, 2026.
From the blog
Security
Why a vault vendor can’t reset your password
With a password and a Secret Key, nobody at the vendor can open your account, or reset it. How the Emergency Kit works, and what to do when something is lost.
Security
What “the server can’t read it” actually means
A blind server is a precise claim with precise limits. What Crunu's server stores, what it cannot do even if compromised, and what it still sees.
Security
Audit logs you can verify: how hash chains work
An audit log is only evidence if nobody can quietly edit it. How hash chains make tampering visible, what they miss, and how to check an export yourself.