Digital signature - There is no such thing as THE digital signature

In the current digital world, we are continuously digitally transacting with companies all over the world. Each transaction leaves a digital trace, allowing the company (in case of litigation) to prove you, as the user, have explicitly accepted the transaction.

However, as you have probably noticed while surfing on the internet, confirming a transaction can go from a single mouse-click up to a lengthy process flow, requiring actions like a complex authentication, delivery of one or more proof documents, one or more physical (non-digital) steps…​ This difference is almost always resulting from a conscious decision in a compromise between usability and operational risk (i.e. risk for litigations, fraud risk, reputation risk…​). Ideally a company would like to achieve the best possible user experience, combined with the lowest possible operational risk, but that is unfortunately not possible.

An electronic signature, which is accepted by law as a binding contract, ensures non-repudiation, which means a user cannot deny (repudiate) having performed the transaction. This is ensured via the combination of authentication and integrity:

• Authentication: authentication ensures that the transaction is performed by a known user, i.e. the platform has authenticated the user performing the transaction.
• Integrity: integrity ensures that the message (i.e. the content being signed) was not altered in transit

For both aspects, various methods exist, each setting a different compromise between usability and operational risk.

When looking at "Authentication", we need to make a distinction between "authentication", "identification" and "ensuring the capability to sign":

• Authentication: authentication only tries to ensure that the person signing the transaction is the same as the person who registered the user. If the identity was not verified during the registration process, there is no guarantee on the identity of the user.
  A user can be digitally authenticated in 5 different ways. Typically, a 1-factor authentication is not enough to properly and securely authenticate someone. Instead 2 or multiple factors are applied (often with risk-based authentication requiring extra authentication methods, when the authentication risk exceeds a threshold).
  • Something you know: the user needs to provide information, only he can know (usually provided to the platform at moment of user registration). The most common method is username/password.
  • Something you have: authentication is done by something the user has in his possession, e.g. receive a code via SMS on user’s phone (user needs to have the phone) or access to a building via a smart card (user needs to have the card). This can also be achieved via address-based authentication (MAC address) or via an authentication cookie, as they identify your PC.
  • Something you are: typically, a biometric characteristic (e.g. fingerprint, iris, voice, face…​) allowing to authenticate the user.
  • Somewhere you are: the user’s location (e.g. IP address or GPS coordinate). As user’s location is usually not very distinctive, it is normally not used as a single authentication method, but in combination with another authentication method.
  • Something you do: authenticate a user through his user’s behavior (e.g. the way a person holds his phone, key stroke gesture, mouse movements…​)
• Identification: as indicated above, it’s not because you are authenticated, that you are who you say you are. If the user’s identity was not verified at the moment of registration, an authenticated user is not an identified user. E.g. Google or Facebook allow someone to create an account under a different name, without any problem. In order to ensure also the user’s identity, identification is needed. This can also be achieved in different ways, with different levels of security, e.g.
  • Uploading a copy of the user’s ID-card or passport (issue is that an ID-card/passport can be stolen, especially a digital image of it).
  • Uploading one or more copies of invoices of utilities companies or other documents containing a verified identity.
  • A real-time video feed in which the user holds his ID-card next to his face (often combined with the request to blink your eyes, to avoid counterfeit).
  • Usage of a digital identity provider (e.g. in Belgium usage of eID or Itsme).
  • Make a link with another company which has already verified the user’s identity. E.g. banks have a verified digital identity of their customers, as they are forced to do a KYC (= Know Your Customer) verification in the onboarding process.
  • Note: many systems (e.g. banks) require an identification at onboarding, but afterwards only require authentication. This means that if the authentication tokens get stolen/hacked or if someone shares his credentials (e.g. someone doing a transaction with the credentials of his partner), there is no guarantee of identity. This could be solved by enforcing that every transaction is signed with a biometric authentication, but it would not always be appreciated by many users. Usually the lack of an easy digital process to (temporarily) grant access (giving mandate/consent) to another person, to act on your behalf, results in the sharing of credentials, which should of course be avoided.
• Ensuring capability to sign: in order to get an electronic signature accepted before court, it is also important to proof that the user was in good health (i.e. good mental condition) to sign. As this is difficult to verify digitally, the law dictates that certain important legal documents still need a physical signature, in the presence of a sworn person (e.g. a notary or a public servant). With techniques for user behavior analysis improving (e.g. check if user behavior pattern is different from usual pattern), this might also become digitally possible soon.

The second aspect, namely the verification of "Integrity", also encompasses multiple aspects, like ensuring the user has read the content, the actual signing technique and the storage of the signature as future proof.

• User has read the content: notaries in Belgium are obliged to read out loud the key points of the deed. This to ensure that user has at least heard all important elements of the deed. Regulators try to enforce digitally also that the user reads what he is signing. In many websites this is handled by:
  • A checkbox, stating you have read and understood the content, which you need to check in order to continue the process
  • A mechanism to enforce that the full documents needs to be scrolled-through, before user can continue
  • The need to type over a characteristic of what you are signing in the signature process. E.g. for certain banks when signing a payment, you need to input the amount as challenge on your Digipass, in order to sign the payment.
• Actual signing technique: the actual electronic signature, aims to digitally proof that a transaction was signed by a user. Also here multiple techniques exist, with
  • Different levels of security: a good measure for security of the "Integrity Security" is if any change in the signed transaction invalidates the signature.
    • A checkbox asking the user to confirm the transaction. The only proof at that moment are the audit log indicating that the user checked the box. Legally this type is quite poor.
    • Scan of a physical signature
    • An electronic signing, which is independent of the actual content. Even though this method ensures the authentication (signee can be authenticated and signatures is uniquely linked to user), the integrity can only be verified through a code audit.
    • An electronic signing based on some key characteristics of the transaction (e.g. a unique reference of the document, the amount…​). When a signature is made, the signing hash will include these characteristics. Any change to these characteristics afterwards, will invalidate the signature.
    • Digital signature: use a certificate-based digital ID issued by an accredited Certificate Authority (CA) or Trust Service Provider (TSP) so when you digitally sign a document, your identity is uniquely linked to you, the signature is bound to the document with encryption (i.e. the digital signature and the electronic document you sign are binded and encrypted together).
  • Signing orchestration: in many cases, the signing process can require a complex orchestration process. This is usually the case when multiple people need to sign. In this orchestration, several specifics need to be considered, like:
    • Automatic derival of which persons should be signed. This can be a fixed set of names, but can also be X persons from a group of persons (anyone in the group can sign) or even more complex configurations. For example, based on the risk of the transaction (determined by amount, counterpart…​), more people might need to sign or people higher up in the hierarchy might need to sign.
      It could even be that the derival needs to be dynamically adapted. E.g. a policy could be that 2 persons from different departments should sign. At that moment, once one person has signed, all people of same department as first signer, should not be allowed to sign anymore.
    • The order in which people should sign. In some processes, it is required that first the requestor signs, following by a manager/director. The manager/director can however only sign when requestor has already signed. In other setups all identified signers can sign all in parallel.
• Storing of signature: a third important aspect in the "Integrity" is the way the electronic signature, which is generated during the signature process is stored. This includes if only the signing key is stored or the full signed message and the way signing information is stored. If the signing information is stored in a standard database, it could still be possible to tamper with the signature after transaction was performed. Common techniques to avoid this type of fraud are storing the signing info in a non-repudiation store (i.e. a database, in which stored information can no longer be modified) or by replicating the signing info to the signing user(s) or to a trusted (by both parties), neutral third-party.
• Note: All the above methods are only as good as the code has implemented them. Therefore, in case of a litigation, it is possible that a software code audit is performed, ensuring that all claimed aspects are properly implemented. Proper logging of which version was in production at which time and a proper source code management system can help in retrieving the software code applicable at the moment of the signing, resulting in the litigation.

Hope to have showed in this blog that there is no such thing as THE digital signature. When implementing a digital signature, a firm can make dozens of choices, which vary in usability, cost of implementation and level of security and repudiation risk. While the choices in usability will remain, the other choices should normally evolve to the best level of security and repudiation risk, as the technologies become more commoditized and therefore less costly to implement.

But in order to once and for all solve this problem, a true global, digital identity, backed by all countries in the world, should become a reality. The UN has a mandate to create a global identity scheme by 2030 for everyone on earth, so maybe in 10 years time we will be there. This identity would allow to onboard at any website with a few clicks (providing consent to share certain data) and allow to authenticate and identify yourself in a secure and consistent way on every possible website. Concretely the identity would store the setup of different authentication methods and contain also your behavior profile. After authenticated yourself in the browser, you can automatically onboard on any website (by agreeing to share your credentials) and automatically login to websites (which you gave consent to) via SSO. The browser authentication system automatically requests additional authentication or logs me out, if it detects abnormal behavior (i.e. behavior not in line with my regular behavior). Thanks to this, all transactions can have perfect authentication/identification without hindering the user experience.
All technological components are available, it’s just a matter of governments and companies worldwide coming to an arrangement.