Digital Signature

Digital signatures have more practical uses than just signing a contract. They can authenticate a signed PDF, a government filing, a software release, or another electronic record. When a contract or official record is shared online, recipients need a way to check where it came from and whether its contents have changed. Digital signatures help people and businesses perform these checks when exchanging electronic documents.

What is a digital signature?

A digital signature means using a cryptographic method, which is a way of protecting information with mathematical rules, to create signature data linked to the content being signed. You can call it a security feature that helps verify the source of an electronic document or message and detect changes to its signed content.

This data can be stored inside the file or supplied alongside it. Signing software creates the signature, and the recipient’s software checks it. A digital signature may appear with a name or signature image, but the security comes from the data that software can verify.

A simple example of a digital signature

Imagine a supplier digitally signs a PDF quotation and sends it to a customer. The customer opens the PDF in software that can check its digital signature.

The software checks whether the signed content still matches the signature. If someone changes a price in that content after signing, the check will fail. This helps the customer detect that the quotation has changed.

The software can also check a digital certificate linking the signing key to the supplier. Together, these checks help the customer assess whether the quotation came from the expected source and whether the signed version remains intact.

Digital Signature vs Electronic Signature?

An electronic signature is how you show that someone had an intention to sign a record electronically. A simple name type, a hand-drawn signature for example using a stylus or touch pad, or checking an “I agree” box can serve this purpose when connected to the record and used with intent to sign.

Whereas, on the other hand, a digital signature is the cryptographic technology used to check the source and integrity of signed information. It can support an electronic signature on a contract, but it can also protect other data, such as a software download.

For example, typing your name into a contract can show your intention to sign. Adding a digital signature provides a separate check that can confirm subsequently whether signed content is the same or has since changed, and the key used to sign it.

How does a digital signature work?

Digital signatures use two mathematically connected cryptographic keys. A private key that belongs to the signer creates the signature and is kept secret. A matching public key lets others verify the content of the document by comparing it against the signature. That public key usually already arrives embedded with a signed document. Signing software automatically handles these operations for the user.

1. Content processing with software: In a typical document-signing process, it calculates a hash: a compact digital fingerprint of the information being signed.
2. Signature creation with private key: The software uses that private key and the processed content (hash) to generate signature data, which is stored with or alongside the document.
3. Signature checking with software of the recipient: It uses the public key to check the signature against the received content. If the content of the PDF gets changed after the signature was already added, the check will fail. If the check passes, it proves the integrity of the signed content.
4. Link establishment to the signer: Where digital certificates are used, the software also checks whether the certificate linking the public key to the claimed signer (person or organization) can be trusted.

Why is a digital signature important for the security of a document?

A digital signature can help in securing digital information, including proving where it came from:

• Integrity: you can establish whether the content has changed or is the same
• Source verification: evidence that the matching private key was used, supported by checks linking that key to the claimed signer
• Evidence for disputes: a record of the signed content and signing key that can support an investigation into who signed what

The protection depends on secure keys and reliable identity checks. If someone steals a private key, they may create signatures without the owner’s permission. A valid signature check alone cannot establish that a particular person knowingly approved an agreement.

A digital signature also does not make the document private. Encryption is a separate protection that controls who can read its contents.

Where are digital signatures used?

Digital signatures have many professional use cases, which are broadly categorized as follows:

• Business documents: contracts, purchase orders, pricing quotes, and approval records
• Official records: electronic forms, filings, and certificates
• Software distribution: checking a software publisher’s identity and detecting changes to a signed download

Are digital signatures legally valid?

Digital signatures can be used in legally valid signing processes. In the US, the ESIGN Act generally prevents covered signatures and contracts from being denied legal effect solely because they are electronic.

In the EU, the eIDAS Regulation sets three tiers of electronic signature: the simple electronic signature, the advanced electronic signature, and the qualified electronic signature, which has the same legal effect as a handwritten signature. Digital signature technology is what the two higher tiers rely on.

That said, a digital signature does not automatically make a contract legally enforceable. The signer’s intent, applicable consent and record-retention requirements, and rules for the document and jurisdiction still matter to prove its legal weight. Moreover, legal requirements vary between countries and types of transactions.