What is a Digital Signature?

Think about a digital signature like an “electronic fingerprint”. Using a securely coded message, the digital signature associates the signer with a document in a recorded and secure transaction. The standard accepted format for digital signatures is called a Public Key Infrastructure (PKI). This provides the highest level of security and is universally accepted as a specific type of electronic signature (eSignature).

Digital Signature vs. Electronic Signature

eSignatures covers a fairly broad category encompassing many types of electronic signatures. This category includes digital signatures which is one specific type of eSignature. Both digital signatures and other solutions in the eSignature category allows you to authenticate and sign documents. What the difference is though is in the acceptance of a digital signature versus all other types of eSignatures due to technical implementation, legal, cultural, and even geographical use.

This means that specifically, eSignatures varies greatly between countries that may use more open technology-neutral laws – Canada, United States, United Kingdom and Australia – to those countries using technology based on local standards – European Union, South America, Asia. Additionally, certain industries will support standards that a specific digital signature technology will be based on.

So How does a Digital Signature Work?

Imagine digital signatures as similar to a handwritten signature. They are each unique to the signer.

As an example, here at Interfacing, we follow a specific protocol called PKI. This allows for us to use FDA 21 CFR part 11, which uses the highest global standards in place (more about that later on). PKI requires the document provider to generate two keys. These keys are mathematical algorithms (long numbers) in which one will be a private key and the other is a public key.

Now when a document is electronically signed, the signature is created by using the signers private key, which if course is kept securely in place by the signer. This is now where the mathematical algorithm comes in. It will act as a cypher and create data to match the signed document. This process is known as a “hash” and will encrypt the data. The result is that the encrypted data is now the digital signature. This signature will also show the time the document was electronically signed. At this point, if for whatever reason the document is changed, the digital signature will become automatically invalidated.

Let’s look at an example. Amanda has just signed an electronic agreement to sell her home using her private key. The buyer, Nicholas now receives the document. Nicholas also received the public key that came with the document. If this public key cannot validate the signature (using the cypher created by the keys) it means that this signature is either not Amanda’s, or that the document was changed since it was signed. Her signature is now considered invalid.

When we talk about the integrity of a digital eSignature, we need to discuss how PKI’s requirement is that the keys need to be created, used, and saved all in a secure form. This manner of security normally requires the use of a reliable Certificate Authority (CA). RSA is one company for example that provides secure certification.

Enterprise Process Center Suite – Digital Signature Process Explained

Did You Know?

Digital Signature FAQ

Why is a digital signature important?

Digital signatures that use PKI technology, utilize an internationally recognized standard that helps to prevent forgery or document changes after signing.

An important feature offered by Enterprise Process Center Suite is that it will assign a digital signature not only the document, but to all the data attached to the document. Security is found in the data of the document, thereby providing an industry leading innovative measure of trust in document encryption.

Can you explain what a Certificate Authority (CA) is?

Public and Private keys for digital signatures need to be protected. This is the only way they will ensure safety and prevent malicious use or forgery. You need assurance every time you sign a document and that both the document and keys associated with it are valid as one. CA’s are a type of trust service provider. These are third-party organizations that have been accepted globally as a reliable resource to ensure security and provide the appropriate digital certificates.