ECDSA

A digital signature algorithm that uses a private key to sign a message and the matching public key to verify it.

Part of: VCE Applied Computing - U2O2 - Cyber Security — Module 52, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 72, WA Computer Science ATAR Year 11 — Cyber Security — Module 84

Understanding ECDSA in VCE Cyber Security

What it does: This code generates the linked private and public keys used for signing and verification. Only the private key can create a valid signature for a message. Only the public key should be shared; the private key must remain secret. Verification uses the sender's public key, which anyone can access without compromising security. If the message changes after signing, verification against the original signature will fail. Anyone with the private key can create signatures that will pass verification as genuine. verify() expects the message first and the signature second; swapping them breaks the check.

Common mistakes: Line 1 calls verify() to create the signature, but sign() should be used with the private key to create it. Line 1 passes the public key pub as the message, but sign() should take the actual message being signed.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add ECDSA to a class →

This module's key terms are also in a printable crossword (Modules 51–60) and word search (Modules 41–74).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

ECDSA uses the private key to create a signature and the public key to verify it.

TrueFalse

Matches

share_publicly(priv)

↓

The mistake: exposing the private key, which must stay secret

Applying

Meanings

Term

ECDSA

Meaning

A digital signature algorithm that uses a private key to sign a message and the matching public key to verify it.

Practice

priv, pub = gen_keys()

Testing

Gaps

= sign(message, priv)

Check Answer

Spots

1sig = verify(msg, priv)

2valid = verify(msg, sig, pub)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. ECDSA uses the private key to create a signature and the public key to verify it.

A. True ✓

B. False

Signing uses the private key, while verification uses the matching public key.

2. Which key should be used to create a signature: the private key, or the public key?

A. Private key ✓

B. Public key

Only the private key can create a valid signature for a message.

3. It's safe to share your private key so others can verify your signature.

A. True

B. False ✓

Only the public key should be shared; the private key must remain secret.

4. Which is used to check a signature's authenticity: the sender's public key, or their private key?

A. The sender's public key ✓

B. The sender's private key

Verification uses the sender's public key, which anyone can access without compromising security.

5. A valid ECDSA signature confirms that a message hasn't been altered since it was signed.

A. False

B. True ✓

If the message changes after signing, verification against the original signature will fail.

Match the Pairs

signature = sign(message, priv) → Creating a signature for a message using the private key

valid = verify(message, signature, pub) → Checking a signature's authenticity using the public key

ECDSA uses a private key to sign and a public key to verify → priv, pub = gen_keys()

A valid signature proves the message came from the claimed signer → if valid == True:

share_publicly(priv) → The mistake: exposing the private key, which must stay secret

valid = verify(sig, msg, pub) → The mistake: swapping the order of the message and signature arguments

Key Term

ECDSA

A digital signature algorithm that uses a private key to sign a message and the matching public key to verify it.

Fill in the Blanks

1. signature = sign(message, priv)

Hint: Type the name of the variable storing the signature created for the message.

2. signature = sign(message, priv)

Hint: Type the name of the function that creates a signature using the private key.

3. valid = verify(message, signature, pub)

Hint: Type the name of the function that checks a signature using the public key.

4. priv, pub = gen_keys()

Hint: Type the name of the function that generates the private and public key pair.

5. if valid == True:

Hint: Type the comparison operator that checks if valid equals True.

Spot the Error

Question 1

A sig = verify(msg, priv)

B valid = verify(msg, sig, pub)

C print(valid)

Line A — Line 1 calls verify() to create the signature, but sign() should be used with the private key to create it.

Question 2

A sig = sign(pub, priv)

B valid = verify(msg, sig, pub)

C print(valid)

Line A — Line 1 passes the public key pub as the message, but sign() should take the actual message being signed.

Question 3

A sig = sign(msg, priv)

B priv = pub

C valid = verify(msg, sig, pub)

Line B — Line 2 overwrites priv with pub, but the private key must stay distinct and secret for signing.

Question 4

A sig = sign(msg, priv)

B valid = sign(msg, sig)

C print(valid)

Line B — Line 2 calls sign() again instead of verify(), so the signature is never actually checked.

Question 5

A sig = sign(msg, priv)

B valid = verify(msg, sig, pub)

C pub = None

Line C — Line 3 discards the public key after verifying, but it may be needed again to verify future signatures.

Student with a class code? Join your class →