Signature, seal and digital-signature mechanism
An electronic signature is associated with a natural person’s act of signing. An electronic seal is associated with a legal person and can support origin and integrity. Both may use digital-signature technology, certificates and trust services, but their legal and business meanings are different.
The design must also capture authority and intent. A valid cryptographic value does not prove that the person was authorised to commit an organisation or that the transaction meets every contractual or sector requirement.
Formats and evidence levels
| Family | Typical container | Use |
|---|---|---|
| PAdES | Signatures incorporated into PDF documents. | |
| XAdES | XML | XML signatures with ETSI qualifying properties. |
| CAdES | CMS | CMS-based signatures with ETSI qualifying properties. |
| ASiC | Container | A container associating data objects with signatures or timestamps. |
Baseline profiles commonly describe B, T, LT and LTA levels. Broadly, these progress from the signature and signed attributes, through trusted time evidence, to inclusion of validation material and then archive-time evidence. The exact requirements belong to the relevant current standard.
Validation is a policy-driven assessment
Validation normally covers cryptographic integrity, certificate path, certificate status, signature attributes, timestamps, trusted-list status, algorithm constraints and format conformance. ETSI validation procedures distinguish a main indication from detailed sub-indications and reports.
A technical result still needs a business interpretation. A system may need to decide whether the signer was authorised, the document version is the expected one, the identity attributes are adequate, the jurisdiction is acceptable and the evidence meets retention policy.
Evidence changes over time
Certificates expire, algorithms weaken, services change status and online status sources may disappear. Long-term validation therefore depends on collecting and protecting relevant validation data and trusted time evidence, with a preservation or re-augmentation strategy appropriate to the retention period.
- Define the validation time and policy
- Capture certificate paths, status information and trusted-list evidence
- Use trusted timestamps where required
- Protect evidence integrity and provenance
- Monitor algorithm and standards change
- Test re-validation and migration procedures