How does a public key verify a signature? -

trying better grapple on how public/private keys work. understand sender may add digital signature document using his/her private key obtain hash of document, not understand how public key can used verify signature. understanding public keys encrypt, private keys decrypt... can me understand?

your understanding of "public keys encrypt, private keys decrypt" correct... data/message encryption. digital signatures, reverse. digital signature, trying prove document signed came you. that, need use have: private key.

a digital signature in simplest description hash (sha1, md5, etc.) of data (file, message, etc.) subsequently encrypted signer's private key. since signer has (or should have) trust comes from. has (or should have) access signer's public key. so, validate digital signature, recipient (1) calculates hash of same data (file, message, etc.), (2) decrypts digital signature using sender's public key, , (3) compares 2 hash values. if match, signature considered valid. if don't match, either means different key used sign it, or data has been altered (either intentionally or unintentionally).

hope helps!