What are qualified electronic signatures?

A signature serves to attribute a document to the signatory. Signatures as a sign of confirmation or agreement are an everyday part of business and private life and have been an integral part of our lives for hundreds of years. Only a few years ago, people were still arguing about whether a scan of a handwritten signature satisfies the requirement for written form. Since the eIDAS Regulation, this applies only to qualified electronic signatures. But what are qualified electronic signatures?

What are electronic signatures?

The electronic signature is, so to speak, the digital counterpart of the handwritten signature. It is regarded as a declaration of intent in digital form. Electronic signature procedures have existed since the early 2000s and have since become established in business. In the vast majority of countries, qualified electronic signatures have the same status as handwritten signatures. In Europe, the eIDAS Regulation is the central piece of legislation. There are various forms of electronic signature, but only qualified electronic signatures have the same status as handwritten signatures.

Types of electronic signature

According to the eIDAS Regulation, an electronic signature is defined as “data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign”. The eIDAS Regulation further distinguishes between three levels of electronic signature, each more secure than the last. Only qualified electronic signatures are equivalent to a handwritten signature on paper.

The simple electronic signature (SES)

The simplest form of electronic signature is the simple electronic signature (SES). Although the term is not used in the eIDAS Regulation itself, it has become established in practice. It is essentially an umbrella term covering all electronic signatures that do not reach the advanced or qualified level. Even a typed name (e.g. in an email signature) counts as an SES.

The advanced electronic signature (AES)

The requirements for an advanced electronic signature (AES) are much higher. An AES meets all of the following requirements:

• It is uniquely linked to the signatory (private key).
• It is capable of identifying the signatory.
• The signature creation data used is under the sole control of the signatory.
• It is linked to the signed data in such a way that any subsequent change to the data is detectable.

Technically, the electronic signature works using a private and a public key. First, a unique hash value is calculated from the document (the document’s “fingerprint”). The hash value is calculated from the entire text and is usually expressed as a 64-digit hexadecimal number. If the document is changed afterwards, the hash value changes, which makes the signature invalid. The hash value is encrypted with a private key and stored in the document’s metadata. Using the signatory’s public key, the hash value can be read from the metadata.

The hash value can then be calculated again from the document received. The signature is only valid if the hash value from the metadata matches the newly calculated hash value. In that case, it can be assumed that the sender’s identity and the integrity of the information received are guaranteed. If the hash values do not match, an error is reported, and the security of the process is not guaranteed.

The qualified electronic signature (QES)

The qualified electronic signature (QES) is the most secure type of electronic signature. It has all the properties of an AES and works in the same way technically. In addition to meeting the requirements for an AES, it is created by a qualified signature creation device and is based on a qualified certificate for electronic signatures. A qualified certificate may only be issued by a qualified trust service provider (QTSP). To become a QTSP, a provider must meet strict criteria set by the competent authorities.

Conclusion: what are the benefits of a qualified electronic signature?

A QES therefore essentially fulfils two functions. It guarantees that documents are not changed afterwards (“integrity”), and it attributes data to a specific person (“authenticity”), because only that person has the private key. The issuing of qualified certificates and supervision by the authorities also ensure that signature certificates work reliably.

More on the benefits of digital signatures coming soon on our blog.