Signingonly

Signingonly refers to a mode or policy in which data is digitally signed to provide integrity and authenticity, but not encrypted to provide confidentiality. In this approach, a private key is used to generate a signature that can be verified with a corresponding public key, allowing recipients to confirm origin and integrity without hiding the content from observers.

In practice, signingonly can be implemented by configuring cryptographic libraries, hardware security modules, or key policies to permit signing operations while disallowing decryption. Some systems designate keys or identities as signingOnly to limit their use and reduce risk.

Common applications include email signing (such as S/MIME or PGP) where messages are signed to prove authorship and integrity without encrypting the body; code signing, which attests to the author and integrity of software; and document signing, used to verify that a document remains unaltered after signing. API and web services also employ signing to verify the origin and integrity of requests or tokens without encrypting the payload.

Security considerations include the fact that signingonly does not provide confidentiality; anyone with access to the data can read it. The security of signatures relies on protecting the private key and the trust framework (certificates, PKI, or web of trust). Key management, proper revocation, and protections against replay attacks (timestamps, nonces) are important.

See also digital signature, code signing, S/MIME, PGP, JSON Web Signatures, PKI, HMAC, and API signing.