The Difference between Electronic Signature and Digital Signature Posted on January 8, 2023 - 2:27 pm by John Webster In today’s digital age, the way we sign documents has evolved significantly. Traditional wet ink signatures have been replaced with electronic and digital signatures, offering convenience and efficiency for both individuals and businesses. In this blog, we’ll explore the key differences between electronic signatures and digital signatures, shedding light on their advantages and use cases. We will also highlight the importance of security and authenticity, emphasizing why Secured Signing’s digital platform, utilizing digital signatures and Remote Online Notarization (RON), stands out as a top security provider. What is an Electronic Signature? An electronic signature, also known as an e-signature, is a digital representation of a person’s signature, used to sign electronic documents and legally binding in most countries. These signatures can take various forms, including scanned images of handwritten signatures or typed names. Electronic signatures are created using various methods, such as typing a name, drawing a signature on a touchscreen, or using a digital signature pad. If you’re in a highly regulated industry dealing with personal or confidential information, such as finance, accounting, HR, legal, or healthcare, you might need to consider a more secure option. Advantages of Electronic Signatures Convenience: Electronic signatures can be created and signed from anywhere, at any time, if there is an internet connection. Time-saving: Electronic signatures eliminate the need for printing, signing, and scanning documents, saving time and resources. Cost-effective: With electronic signatures, there is no need for paper, ink, or postage, making it a cost-effective option for businesses. Legally binding: In most countries, electronic signatures are legally binding and hold the same weight as a handwritten signature. What is a Digital Signature? A digital signature, a specialized type of electronic signature, employs the robust encryption method known as Public Key Infrastructure (PKI). Digital signatures are generated through a digital certificate, provided by a Certificate Authority (CA). They offer the compelling advantage of demonstrating that the original document remains unaltered and free from forgery. Essentially, a digital signature acts as a unique fingerprint exclusive to a specific document, making it impossible for any other document to possess the same digital signature, ensuring the document’s integrity and authenticity. Advantages of Digital Signatures High level of security: Digital signatures use a two-key system, making them more secure than electronic signatures. Non-repudiation: Digital signatures provide non-repudiation, meaning that the signer cannot deny having signed the document. Tamper-proof: Digital signatures are difficult to forge or tamper with, providing an extra layer of security for important documents. Compliance: Digital signatures are compliant with various regulations and standards. Signer’s Identify is part of the signature. Signature’s Intent, the reason for signing Differences between Electronic Signatures and Digital Signatures Electronic and digital signatures serve the same purpose of signing electronic documents but diverge significantly in their technology, security, compliance, and importance in document security. Technology: – Electronic signatures employ diverse methods like typing or drawing a signature. – Digital signatures use PKI (Public Key Infrastructure) encryption and include signature’s graphical image. Security: – Digital signatures are more secure, offering non-repudiation and resistance to forgery or tampering due to PKI. Compliance: – Digital signatures comply with regulations like the eIDAS Regulation (EU), FDA (Food and Drug Administration) CFR 21 Part 11, ESIGN, UETA, and more.– Electronic signatures may not meet certain regulations and can vary in legal weight. Document Security: – Digital signatures provide even higher security through the robust two-key PKI system, guaranteeing authenticity and integrity. – Detect any changes that might be made to the content of the document after it is first signed – If the document is modified, signatures will immediately become invalid – Independent signatures verification. Electronic signatures and digital signatures are two distinct methods for signing electronic documents. While electronic signatures are basic solutions, digital signatures offer a higher level of security and assurance that the signature is genuine and unaltered. Understanding the differences between these two methods is crucial for businesses and individuals seeking secure and legally enforceable electronic signatures. At Secured Signing, we take your security and authenticity seriously. Our digital platform, incorporating digital signatures and Remote Online Notarization (RON), ensures your documents are protected, legally recognized, and tamper-proof. So, when it comes to securing your electronic signatures, choose the best—choose Secured Signing as your number one security provider.
Introduction to Digital Signatures Posted on October 28, 2022 - 3:28 pm by John Webster The Process & Validity behind Digital Signature Technology. What is Public Key Infrastructure – PKI A cryptographic system that uses two keys, a public key known to everyone and a private key, the private key has full control to the key owner, and has to keep in secured environment. A unique element to the public key system is that the public and private keys are related in such a way that only the public key can be used to encrypt messages and only the corresponding private key can be used to decrypt them. Moreover, it is virtually impossible to deduce the private key if you know the public key. When David wants to send a secure message to Donna, he uses Donna’s public key to encrypt the message. Donna then uses her private key to decrypt it. Public key cryptography was invented in 1976 by Whitfield Diffie and Martin Hellman. It is also called asymmetric encryption because it uses two keys instead of one key (symmetric encryption). Digital Signatures Process: An Explanation We can use David and Donna to demonstrate how digital signatures work. From David’s perspective, the process of digitally signing a document seems simple. However, several important steps happen behind the scenes. Generating a Private and Public Key Before David can digitally sign any documents, he must first obtain a Private Key and a corresponding Public Key. This is a one-time setup that is typically done by the Secured Signing Service when David first registers. The Private Key is kept secret and is used only by David to sign documents. It is never shared. The Public Key is made available to everyone (including Donna). It is used to validate the signer’s (David’s) digital signature. Digitally Signing Document This section details the steps David takes to sign a document and what happens when he sends it to Donna. Create a Digital Signature First, a unique cryptographic code called a hash is generated for the document using a mathematical algorithm. This hash is a short string of characters that represents the entire document. Even a tiny change to the document will result in a completely different hash. Add the Digital Signature to the Document To create the final digital signature, the following elements are combined: The document’s hash (from step 1). David’s Digital Certificate (which contains his Public Key). This is done by using David’s Private Key to encrypt the document’s hash. The resulting digital signature is unique to both the document and David. Finally, this digital signature is embedded into the document. David then sends the signed document to Donna. Donna’s Validation Process Donna uses David’s Public Key (included in the Digital Certificate) to decrypt the digital signature. This action reveals the original document hash that David created when he signed the document. Donna compares the original hash (extracted from the signature) with the new hash (she just calculated). Determine Validity: If the hashes match: The signature is valid, and the document has not been altered since David signed it. If the hashes do not match: The document has been changed after signing, or the signature is invalid. What is a Certificate Authority (CA) A Certificate Authority (CA) is a trusted third party that issues digital certificates. Digital Certificates act like a digital ID card, confirming the identity of a signatory (user). The CA issues a certificate after verifying the user’s information. In a digital signature system (PKI), the CA uses its own authority to authenticate the user’s certificate, assuring others that the signatory is genuinely who they claim to be.
Digital Signatures & Secured Signing Security Posted on October 27, 2021 - 7:58 am by John Webster Secure trusted service with PKI Technology Secured Signing web service uses Digital Signatures PKI technology for digitally signing documents. Public Key Infrastructure (PKI) technology has been proven to be the ONLY technology available today that ensures non-forgeable signatures. In a PKI system, you will get as a user, two keys: a public key and a private key. These keys are used for encrypting and decrypting information, digitally signing electronic information and verifying the authenticity of their owner. While the public key is distributed widely, the corresponding private key is held and encrypted in Secured Signing hardware (HSM) device and only the private key’s owner able to access and use it. The EU Directive 1999/93/EC for Digital Signatures recognised and defined a stronger type of electronic signature, the Advanced Electronic Signature. Only Public Key Infrastructure (PKI) digital signatures meet the requirements for such signatures. Communication All communications with Secured signing are encrypted with SSL technology. Users authenticate with encrypted login and password. Data Center Located in one of the most peaceful places on the planet (New Zealand) with: 3 high-speed, high-capacity internet feedsPower protection2MVA mains supplyDual AC mains power supply system serviced by two independent suppliersBinary Uninteruptable Power Supplies with redundant re-routing (500kVA)One of the most advanced and reliable IDC power systems availableDiesel generatorsHumidity controlled Heat Ventilation and Air Conditioning (HVAC) cooling unitsHigh Availability – 99.99% uptime SLA24/7 armguard on-site securityBiometric access controlSecurity Cameras Payment gateway The Payment Gateway we are using is fully certified as Visa AIS and MasterCard SDP (PCI-DSS) compliant at processor level; using an approved QSA for quarterly scans on systems and full on-site audits, annually. All sensitive information is encrypted with the 3DES protocol, with Hardware Security Module as Network Security Processors. Compliance Certifications and Regulations The privacy and protection of your data is something we take very seriously – which is why our security and privacy program is based on and aligned with industry-standard frameworks, and we maintain a comprehensive suite of certifications and attestations to further demonstrate our commitment to security and privacy. ISO 27001 Certification IS 747283 Secured Signing is ISO/IEC 27001 certified and manages information security within a framework based on related standards such as ISO/IEC 27017 (Code of Practice for Information Security Controls Based on ISO/IEC 27001 for Cloud Services) and ISO/IEC 27018 (Protection of Personally Identifiable Information). “Internationally recognized ISO/IEC 27001 is an excellent framework which helps organizations manage and protect their information assets so that they remain safe and secure. It helps you to continually review and refine the way you do this, not only for today, but also for the future.” – Learn more about ISO 27001 with BSI. Secured Signing – ISO 27001 Control Structure Information security policies: A policy framework is in place to provide management direction and support for information security in accordance with business requirements and relevant laws and regulations. Organisation of information security: Secured Signing have established a management framework to initiate and control the implementation and operation of information security within the organisation. This framework considers and ensures the security of teleworking and use of mobile devices as per the Mobile Device and Teleworking Policy. The framework will also assess risks to projects and review of the types and confidentiality levels of information the project will utilise and manage. Human Resource Security: Secured Signing have established processes and responsibilities relating to information security during the recruitment process, employment and separation. All employees receive security awareness training upon induction, and at least annually thereafter. Asset Management: Information assets, including hardware, software and data have been identified and classified and an inventory of assets is maintained. Secured Signing classify and handle all information assets in accordance with the Information Classification Policy. Secured Signing and dispose of information in accordance with the Acceptable Use Policy. Access Control: Methods and controls have been implemented to manage logical access to sensitive data to protect the confidentiality of information as well as integrity and availability requirements. Access requirements are assessed against Access Control Policy and Information Classification Policy. Access to Secured Signing information and systems must be: attributable to a uniquely identifiable individual who is responsible for actionsperformed with their system accountbased on the requirements of the individual’s rolemanaged by passwords or other accepted authentication mechanisms and formally authorised by asset ownersroutinely revalidated and removed if no longer required Cryptography: Methods and controls for ensuring data are secured during transmission or storage through appropriate encryption processes. Includes methods and processes for managing keys, software and other artefacts. Physical and environmental security: Appropriate physical controls protect information assets against loss, physical abuse, unauthorised access and environmental hazards. These include perimeter security controls, physical access controls, intruder detection controls, fire, and flood and power protection controls. Operations security: Methods and controls are implemented that balance the need for IT Operations professionals to have privileged access to systems and networks with the requirement to maintain secure access and confidentiality of data. Management and operation of computers and networks shall be, commensurate with the business risk and value of the information assets. Access into networks will be granted on an individual user and application basis using authorised devices and secured pathways. Communications security: Methods and controls are implemented to manage the secure transmission of information to ensure confidentiality of sensitive data and to minimise the risk of data loss or leakage. Systems and networks are segregated according to their respective information security risks and use appropriate control mechanisms such as firewalls/gateways, physical isolation and encryption. System acquisition, development and maintenance: Information security controls for system acquisition, development and maintenance are specified in the Secure Development Policy and included as an integral part of the software development and implementation process. Security requirements are identified prior to the development or procurement of new information systems, documented in business requirements, validated and tested prior to implementation, and regularly throughout the systems lifecycle. Supplier relationships: Secured Signing have implemented security controls and processes to manage supplier access to information assets. Suppliers and vendors are be given access privileges only at the level required to deliver contracted services and contracts must comply with information security policies. Information security incident management: Secured Signing apply a consistent and effective approach to the management of information security incidents. Procedures that define the course of action when a security incident is identified are documented and made available to all employees. Information security aspects of business continuity management: The application of business continuity management minimises disruption to Secured Signing operations, defining the approach to resilience, disaster recovery and general contingency controls. Secured Signing have developed and periodically review and test Business Continuity Plans that support information security continuity. Compliance: Secured Signing ensure compliance with all applicable legal and contractual obligations related to information security including taking reasonable steps are taken to monitor, review and audit information security effectiveness. This includes the assignment of security roles, maintenance of policies and processes and reporting of non-compliance. Secured Signing maintains formal processes in place to manage a data breach and the mandatory notifications that are required under relevant laws and specific customer contracts.
Is a digital signature legally binding? Posted on October 27, 2021 - 7:52 am by John Webster Introduction: The Global Acceptance of Digital Signatures In today’s fast-paced, paperless world, the transition to electronic signatures is widely accepted and encouraged by governments globally. The question remains: Is a digital signature legally binding? The answer is a resounding yes, but with a critical caveat: not all electronic signing methods meet the stringent legal requirements. Countries including New Zealand, Australia (all states), the United States, Canada, South Africa, the United Kingdom, and the European Union have established clear laws governing the use of electronic documents and signatures. Digital Signature vs. Electronic Signature While “electronic signature” is a broad term for signing a document digitally, ONLY Digital Signature technology that utilizes industry-based standards of cryptography is generally recognized as satisfying these stringent legal requirements for authenticity and integrity. Secured Signing provides a trusted digital signatures online service that complies with and often exceeds these global legal standards. Key Legal Requirements for a Binding Electronic Signature For an electronic signature to be considered legally binding under most international laws (like the U.S. ESIGN Act and UETA, and various Electronic Transactions Acts), it must satisfy three core criteria: Identification: The signature must adequately identify the signatory (who is signing). Intent: It must adequately indicate the signatory’s approval of the information (the signer’s intent to be bound). Reliability & Integrity: The means of creating the signature must be as reliable as is appropriate given the circumstances. Defining “Sufficiently Reliable” An electronic signature is typically deemed sufficiently reliable if: The means of creating the signature is uniquely linked to the person signing and no one else. The means of creating the signature was under the sole control of the person signing. Any changes to the signature are detectable. Any changes to the document are detectable (ensuring data integrity).