Home › Blogs › Bruno Lowagie's blog

The difference between an esignature and a digital signature — for dummies!

Sat, 08/18/2012 - 16:00 — Bruno Lowagie

After yesterday's blog post explaining how to forge an esignature, some people contacted me, saying: We're not technical people, we don't understand your examples, but are you saying that somebody can abuse our signature if we apply an esignature? And also: Don't you have a short demo for dummies?

That's why I made this short video:

I hope this video helps people who aren't tech-savvy to distinguish a fake digital signature from a real one. All the technical people are still welcome to register for our newsletter and we'll send you a draft of the first 90 pages of our white paper about digital signatures by the end of next week.

(Update: for a more nuanced legal point of view, see Legal aspects of e-signatures / digital signatures.)

Comments

Fri, 08/31/2012 - 20:45 — Joy Griffin

The document your were able to change

Hi Bruno,
I am trying to understand something… the document that was signed, had it been signed using one of the application vendors you referenced?
Joy

Sat, 09/01/2012 - 09:58 — Bruno Lowagie

Hello Joy,

I used the 'Sign' button in Adobe Reader. People who aren't tech-savvy could assume that they are indeed digitally signing a document this way.
That's not true. In order for the document to be digitally signed by one of the vendors that are mentioned, it needs to be uploaded to a server where different vendors use different techniques.

As I'm explaining in my whitepaper, many of these techniques are flawed because:
- there's no WYSIWYS. Sure, people can 'view' the document they're signing, but the actual bytes that are signed reside on the server. What You See Is A Copy Of What You Sign, instead of What You See Is What You Sign. Although this is acceptable by some states, many countries won't accept this as a legally binding signature. The document needs to be signed on the client side (which automatically excludes Cloud signing services).
- it's even worse: the digital signature that is applied uses a private keystore that isn't private! A key store contains a private key that has to be private to the signer. For instance: in Belgium, every citizen owns an identity card in the form of a smart card. We call it an eID. There are several key stores on the chip of the smart card. One of these key stores is meant for authentication. You could use it to sign a document if you want to preserve the document's integrity, but the signature isn't legally binding. Only documents that are signed using the key store with the non-repudiation key have the same legal value in court as a handwritten signature.

I realize that the situation is very different in the US where the concept of the eID is unknown. Many states accept eSignatures as legally binding because it's a pragmatic solution. If there's ever a dispute in court to contest the legal value of such a signature, you'll find several arguments in my white paper that will help you win a case proving that there's reasonable doubt that the person who is alleged to have signed the document isn't the actual signer.

Please read this article for more info about signing with an eID and the legal implications: http://www.cosic.esat.kuleuven.be/publications/article-1160.pdf

Sat, 08/18/2012 - 23:26 — Bruno Lowagie

Finally, some reaction!

Finally somebody has replied with a reaction that makes sense:

You didn't sign this with EchoSign. You just created a PDF with an image of a signature inside it, then changed the PDF, which is fine. But you need to sign it using EchoSign before it's locked down. The whole point of EchoSign, based on our original ideas in this area, is that most end users don't have digital certificates (and related key pairs), so the service provides that when you use it. If you can change it after signing through EchoSign, that will be interesting to see.

This allows me to go to the core reasons why I made the video.

The videos promoting eSignatures and the interface in Adobe Reader is confusing, one might even say misleading. It's true: I clicked on a button that said 'Sign', but all I did was play around with an image of a signature. People who aren't tech-savvy don't know that. They think they are actually signing, but they don't.

Most end users don't have digital certificates (and related key pairs) so the service provides that when you use it, but does that make the signature legally binding?

It depends.

It depends on where you live: laws differ from state to state, from country to country, but the general idea is that three major requirements need to be met: integrity (can't change the document without breaking the signature), authenticity (you should be able to verify the identity of the signer), and non-repudiation (the signer may not be able to deny that he has signed the document).

So it depends on nature of the signature. As most of the signing services apply the signature on the server-side, the signer can never be sure which document he's actually signing. That's a dangerous situation: it's like signing a blank cheque.
If I sign a document online, and the complete document as well as my private key are on a remote server, I can never know what happens remotely, so I can't be held responsible for that signature.

I'll explain all of this in my white paper.

By the way: did you read the FAQ on the DocuSign site?

Is a DocuSign Signature a “Digital Signature”?

No. DocuSign lets you create an electronic signature, which is not the same as a digital signature.

An electronic signature, as defined by the Federal ESIGN Act, is an “electronic sound, symbol or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record” (ESIGN). All 50 states have laws that define electronic signatures in substantially the same way.

Whereas, a digital signature or digital signature scheme is a mathematical scheme for determining the source of a digital message or document. A digital signature by definition is a technology, a method of authenticating. It does not by itself meet the standards of what constitutes a valid electronic signature, nor does it mean that the signer’s identity has been verified. Digital signatures are most often used to apply a digital "seal" to an electronic document in order to make it tamper-evident. In fact, DocuSign uses digital signatures in this way; DocuSign customers and signers have the option to apply a digital signature to a DocuSigned document when the transaction is complete.

So when you need to get a legally-binding signature, make sure you’re using a complete electronic signature solution.

I don't know how you read this, by I read this as a confession: DocuSign uses digital signatures to seal a document, but they do it in a way that doesn't ensure the identity of the signer; they only use it to protect the document from what I did in the video.

That's NOT sufficient. THAT is the whole point!

Tue, 08/21/2012 - 21:18 — JoanRoss

Feedback from DocuSign's Cheif of Security Officer

Hi Bruno. I’m DocuSign’s Chief of Security Officer, Joan Ross, and I’d like to help clarify a few things in your blog post on electronic signature and DocuSign.

In your review, it appears you used the Adobe Reader signing capability as the example and including DocuSign as a similar solution. Please note that the two are not similar. DocuSign is a completely different product and takes a very different approach to electronic signature, which avoids many of the issues you point out with Adobe’s product. The following are some of the security safeguards available with DocuSign:

1. DocuSign is a cloud service, not desktop software. All of our documents are secured in the user’s account in the cloud where they are encrypted and hashed to protect them from unauthorized changes.
2. DocuSign’s service does not distribute documents for signature, but rather invites signers to authenticate to the service in the cloud in order to review and sign documents. Signers do not have access to the document to make changes; they can only view and sign.
3. DocuSign allows the sender to configure several different authentication options that the signer must pass at the time of signing to ensure that the documents and access to them is controlled by the sender within DocuSign's secure SaaS platform.
4. DocuSign writes the results of the authentication, and many other elements about the transaction such as IP address, time stamps, email address, etc. into the signature data to ensure there is a great deal of evidence around the signing. This information creates a legally-binding audit trail.
5. The DocuSign signature is linked to the identity profile of the signer within the DocuSign service. Clicking the signature brings up that link to the signer so that sender can verify the identity of the signer.
6. If a document is exported from the DocuSign service, it is digitally sealed with a CDS Certificate, and any attempt at tampering after signing (such as changing $1,500 to $15,000 in your example) would be easily detected.

Finally, DocuSign delivers much more than just capturing signatures. Our customers use our service to route documents to signers in any order orworkflow they need. Customers use our forms capabilities to deliver and collect data from signers during the process, and they use our authentication services to make sure they know who is signing. Customers use our business intelligence and reporting capabilities to keep track of the status of transactions in real time. Our customers are transforming outmoded signature processes requiring printing, scanning, faxing, overnighting, and data rekeying with the DocuSign eSignature Transaction Platform - which is delivering 'Straight Through Processing' and keeping everything electronic.

I'd be happy to talk further with you about electronic signature generally and DocuSign specifically. Please let me know if you have time to connect over the phone, as it would be great to give you an overview briefing of DocuSign. Thanks.

Thu, 08/23/2012 - 19:41 — Bruno Lowagie

Feedback

Hello, thank you for the feedback. I've sent you a mail with a link to the second draft of the white paper on digital signatures. I'd like to integrate your comment in Appendix B of the paper.