Digital Signatures

How Do Digital Signatures Work?

Slowly, as e-business has caught on, digital signatures have evolved to serve the legal purposes of authenticating documents and indicating assent to contracts even when the documents "signed" exist only as patterns of bits on a disk. There are several components to a digital signature.

First, there's authentication of a document file. A digital signature must provide a means to verify that the document file to which it is affixed has not been altered since the digital signature was affixed; presumably, since the signatory read, agreed to, and "signed" the document. So digital signature methods encrypt document files at the time of signing.

A relatively short string of bits is generated by digital signature software based upon the pattern of bits in a document file at the time of signing. This bit pattern is stored as part of the digital signature. To verify the authenticity of a received document, the document is run through the same encryption algorithm again. The new bit pattern is compared to the one stored in the digital signature. If the two patterns match, then the document file has not been altered since it was signed.

Encryption can also be used to control what a user can do with a document file. Digital signatures can prevent unauthorized viewing, copying, printing, or transmission over a network of a signed document file. If a password has been provided separately to authorized users, it can unlock all or selected restrictions imposed by the digital signature.

Can Digital Signatures Be Forged?

Second, a digital signature must authenticate the signatory. Your handwritten signature proves that you signed a paper document; a digital signature must prove the same on a digital document. Like handwritten signatures, digital signatures must be highly resistant to forgery. Digital signature methods accomplish this by issuing digital signature certificates to individual users.

Digital certificates work much like the signature card kept on file at your bank, which can be compared to the signature on any check supposedly written by you. A digital signature certificate is a string of encrypted bits generated by a generally accepted certificate authority. The authority keeps a database of all certificates it issues and the identities of their recipients. When a digital signature must be authenticated, the certificate embedded in it is compared to those stored by the authority.

Finally, a digital signature can include a graphic image of your handwritten signature, simply scanned as you would scan any other written matter. You can embed encrypted digital signature patterns and digital certificates in the graphic image, where they remain invisible. Now someone can fax, print, and store in a paper filing cabinet a copy of the document with your visible signature on it.

Laws and jurisprudence governing digital signatures are still evolving. Different jurisdictions have different standards for what makes a digital signature legally binding. It is wise to consult an attorney expert in e-commerce before entering into regular business that relies upon digital signatures.

Standard office productivity software such as Microsoft Office and Adobe Acrobat include features for adding digital signatures to documents. Microsoft provides its own Authenticode digital certificate authority free of charge, and a selection of paid third-party certificate authorities is available through Microsoft Office programs. Adobe Acrobat will refer you to a third-party certificate authority.

iSafePDF is one free software utility that simplifies the addition of digital signatures, images, and certificates to PDF files.