How to configure

Use Interface

Overview

Electronic signatures and digital signatures are two terms that are commonly used to mean the same thing. Even within the security industry often marketing people tend to use the two terms interchangeably. However this is incorrect as within the technical and legal communities the two terms have very different meanings. When choosing a signing solution it’s very important to know exactly what is being offered.

Here we try to clear up the confusion by explaining the main differences between electronic signatures and digital signatures and describe their relative pros/cons. We also link the theory to what is actually implemented in practise in SigningHub. Read on and you are bound to be impressed with all the different types of signatures supported by SigningHub!

Understanding e-signatures and digital signatures:

Firstly let’s clarify what are the generally accepted meaning of the terms e-signatures and digital signatures:

• Electronic signature: This is any signature that is in electronic form, i.e. as opposed to paper-based ink signatures. Examples of electronic signatures include: a scanned image of the person ink signature, a mouse squiggle on a screen or a hand-signature created on a tablet using your finger or stylus, a signature at the bottom of your email, a typed name, a biometric hand-signature signed on a specialist signing hardware device, a video signature, a voice signature, a click in an “I Agree” checkbox, etc. The list is actually endless. The main point is that an e-sign is any “mark” made by the person to confirm their approval of the document or transaction.
• Digital Signatures: These are actually a subset of electronic signatures because they are also in electronic form. However digital signatures go much further in terms of providing security and trust services:
  • Signer authentication: i.e. proof of who actually signed the document. i.e. digital signatures linking the user’s signature to an actual identifiable entity.
  • Data integrity: i.e. proof that the document has not been changed since signing. The digital signature depends on every binary bit of the document and therefore can’t be re-attached to any other document.
  • Non-repudiation: i.e. the signer should not be able to falsely deny having signed their signature. That is, it should be possible to prove in a court that the signer in fact created the signature.

Digital signatures are created using cryptographic techniques, normally based on PKI systems, where the private signing key is only accessible to the owner. There are many different ways of implementing digital signatures, each offering different levels of security and trust for the above services. Some of these different approaches for implementing digital signatures are described later.

This leads to some interesting points:

1. A digital signature can also be considered an e-signature, but the reverse is not true i.e., not all e-sign offer the same security services as digital signatures .g. consider a basic e-signature like a scanned signature image inserted into a document – this can be easily copied from one document to another by anyone. Also the document can be easily edited after inserting the signature image.
2. Any mark on a document can capture the intent of the signer to “approve” the contents, i.e. this mark doesn’t necessarily need to look like the person’s hand-signature. Even a simple “X” is sufficient to show the signer’s intent. The issue is in terms of proving who could have made this mark.
3. To avoid later claims by the person that didn’t know what they were signing, it’s important to be able to show a legal notice to the user which they must confirm so that their signing action can be considered a wilful act.

The following table summarises the main pros/cons of each type of signature:

Although digital signatures have most of the benefits in terms of security and trust, to create the best user experience it’s necessary to merge the concept of electronic signatures with digital signatures – and that’s exactly what we have done in SigningHub!

Find out which signature types are implemented in SigningHub

Overview

In an earlier blog article, we explained the differences between e-signatures and digital signatures. Click here to read this article. In the current blog we cover the different ways of creating e-signatures and digital signatures in Signinghub

SigningHub is a very powerful and flexible solution that caters for many different business scenarios, each with different trade-offs between security, ease of use, ease of management and costs. The following list shows the different types of signatures supported by SigningHub with increasing levels of security:

1. E-Signature only SigningHub supports for creating your e-signature. Note most cloud signature service providers only offer e-signing. Here is an example of an e-signed document:
2. E-Signature + a notary digital signature, i.e. the user just creates their electronic signature mark, but then a server-side digital signature is applied to lock the document from further edits. Some of our competitors have reach this level. Here is an example such a signature:
3. E-Signature + user’s own digital signature. This the best solution from a trust perspective because each user’s digital signature is created with a unique PKI keys owned by the user. No company can compete with SigningHub at this level. Here is an example document signed with the users own e-sign and digital signature:

What is unique about SigningHub is that it can manage each user’s digital signing key securely at various levels of security and trustworthiness:

1. Each user’s key is stored in encrypted form in the SigningHub server database. The user is authenticated before signing using:
   1. Simple passwords, and/or
   2. Using One-Time-Password (OTP) sent to the user’s registered mobile phone. Other OTP techniques like grid systems can also be supported.
2. As above, but each user’s signing key is stored in a secure tamper-resistant FIPS-compliant HSM rather than encrypted database. The user’s key never leaves the HSM, i.e. the user’s signature is created inside the HSM.
3. User’s signing key is held on a secure smartcard or USB token. These hardware tokens are generally compliant with FIPS or Common Criteria or other Secure Signature Creation Device (SSCD) requirements. An example is the Adobe® CDS tokens available from a number of our CA partners, like GlobalSign, Entrust, LawTrust and QuoVadis
4. User’s signing key is held on their mobile device. The key can be held within the mobile app, or on a secure microSD card, SIM, or via an attached smartcard.

The “e-signature only” option as explained above is not recommended because it offers no security, however it can be useful for quickly getting a person’s signature without them having to register with SigningHub – hence it does have practical uses. However this should only be done when a second signer will be adding a digital signature afterwards (i.e. using one of the other methods mentioned above), this will lock the first user’s e-signature so that any subsequent modifications are easily detected.

Options for creating an electronic signature

As explained, SigningHub allows users to either create an electronic signature on its own or as part of a digital signature. In both cases users can e-sign using any of the following means:

e-signing using finger /stylus on a mobile device:

e-signing using mouse drawing:

e-signing by just typing your name:

e-signing by uploading scanned signature image:

e-signing using a specialist signature device:

Note: We support Signotec and Wacom signature tablets

Some countries do store the user’s hand-signature image on their eID cards, as such SigningHub can be taught to use this image as the e-sign.

Options for creating a digital signature

As explained above user’s can create their digital signature using keys held centrally on the server (encrypted database or HSM), or keys held locally on a smartcard or secure USB token, or keys held inside their mobile device. Further to this, SigningHub supports the following different types of signatures:

• Basic digital signatures: This is the simplest form of a digital signature and is generally not recommended by us as they can’t be verified in the long-term.
• Long-term digital signature: These are signatures with embedded timestamps to prove the time of signing and also embedded signer’s certificate status information to prove that the signer’s keys/certificates were valid at the time of signing. Such signatures can then be verified many years into the future (e.g. at least 10+ years). We support the following type of long-term signatures in SigningHub:
  • PAdES Part 2 (ISO 32000-1)
  • PAdES Part 4 (both LTV and PAdES-A signatures)
  Native support for Microsoft Office 2013 documents (i.e. XAdES signature format) is coming soon.
• Adobe CDS and AATL signatures: In order to get your signatures automatically trusted in Adobe Reader, it’s important to use a signing key/certificate which has been issued by Certificate Authority (CA) authorised by Adobe through its CDS or AATL programs. SigningHub supports this by allowing the use of certificates from such trusted external CAs.
• EU Qualified signatures: In order to create an EU qualified signature certain prerequisites must be met, e.g. the signer’s certificate must follow a particular certificate profile and be issued by a qualified CA, furthermore the signature must be created inside a compliant secure signature creation device (SSCD). SigningHub supports the use of qualified certificates issued by Qualified CAs and the use of trusted SSCDs, therefore SigningHub can create EU qualified signatures. Such signatures have automatic equivalence to hand-written signatures in a court of law.

Conclusions

We have all the bases covered in SigningHub. We support e-signatures only option but recommend using these together with digital signatures. We allow multiple ways of e-signing on multiple devices. In terms of digital signatures we allow multiple options for user’s signing key security, i.e. server, smartcard, secure USB token, mobile. We also support long-term signatures which can be verified in the future. We support Adobe CDS signatures and also EU qualified signatures. In addition to this the SigningHub core document workflow, tracking and notifications help to ensure your approval workflows are efficient and easy to manage.

Overview

The SigningHub “in-person signing” feature is a new capability that enables a person to electronically sign documents without requiring them:

• To have an account on SigningHub
• To have an email address
• To have their own computer

In-person signing suits many business environments where members of the public need to electronically sign a document or form in front of a member of staff that witnesses this by signing with their digital signature.

The in-person signer creates a basic e-signature, i.e. a hand-signature image, on the document that records their intent or approval of the document content. The document and the e-signature is then locked to prevent further changes by the witness digital signature that is applied by the host of this face-to-face meeting.

This brief note describes the process.

Step 1: Preparing for In-Person Signing

First login and upload a document as normal. Add yourself as signer and then proceed to the document prepare window. Position your digital signature field in the required location as normal.

From within the advanced settings area select the “In-person signing” option:

This will show a pop-up window, where you can select the number of e-signature fields you want to add per host signer, an optional identifier for these fields and the page number on which they should be located:

When you click the “Add” button the in-person signing field is created on the document. The field is clearly marked to show that it is an in-person signing field:

Also the right-hand navigation panel shows the in-person signing field:

The document is now prepared. To save a template of all these settings click the “save template” button in the above screen. This enables you to automate the process the next time you need to create in-person field(s) on a similar document.

Step 2: In-person Signing Step

To start the workflow approval process you need to simply send the document. To initiate the in-person signing process sometime later, simply login to SigningHub and select the document to be signed in the pending folder OR click the hyperlink in the email notification.

The easy to use navigation tab immediately identifies the next action that needs to be completed before you can digitally sign and witness the e-signature:

At this stage simply pass your laptop, notebook, iPad or Android tablet to the customer (the in-person signer). If this was a PDF form, then the navigation tabs would guide the person to fill in the mandatory form fields in the prescribed order before proceeding to their e-signature field.

To e-sign they should click on their in-person field and the following window will be displayed:

This looks like the normal SigningHub digital signature window, except there is no requirement to enter an account password (since the in-person signer does not have an account on SigningHub).

Once the e-signature has been created, the e-signature image is inserted into the document and the digital signature field now becomes active waiting for the host’s digital signature:

As the witnessing host, you can then digitally sign in the normal way (e.g. using server-side signing, local smartcard/USB token signing or a mobile signature).

The completed document will look as follows:

A signed copy of the document can be provided to the in-person signer at this stage.

Summary

In-person signing provides a simple way for customers, citizens or anyone else to sign documents during face-to-face meetings, without requiring an account on SigningHub. The document and the person’s e-signature is witnessed and protected from unauthorised change by the digital signature applied by the host to complete the process.

The process discussed above is just one example. A document or form can have:

• Multiple in-person signing fields all e-signed by the same person
• Multiple in-person signing fields, e-signed by different people during the same session
• Multiple in-person signing fields which are hosted and witnessed by different people (digital signers) during the workflow process

This flexibility ensures that the in-person signing functionality is useful for almost any business scenario.