4 ms·

I have been asked to e-sign pretty much every building/home leasing document involving myself in the past few years in the US. I am sure that this is also the c

I have been asked to e-sign pretty much every building/home leasing document involving myself in the past few years in the US. I am sure that this is also the case for thousands, if not millions, of other Americans.

loeg 3y ago
Sure, but do you have any indication cryptography is involved in this process? In my (limited) experience as a consumer, they just take some existing PDF and add marks on top of it.
- tialaramex 3y ago
  Usually the distinction made is between electronic signature (e.g. you scrawled your mark on a piece of paper, scanned it and now the software lets you paste that image on signature pages) and digital signature (cryptographic)
  - phrz 3y ago
    The ESIGN Act makes no distinction in the US between whether you cryptographically sign or digitally draw, etc., defining a signature as "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record."
    - kjetil 3y ago
      In the EU (and EEA), eIDAS distinguishes between - "electronic signatures", which can be any electronic data used to sign, like a drawn signature - "advanced electronic signature" (AdES), usually a type of digital signature (XML-DSig, PDF signature, etc.) - "qualified electronic signature (QES), which is a digital signature created by a certified signature device QES is legally equivalent to a "wet signature", but in my experience rarely used because of cost. AdES is much more common for high-trust scenarios like loan applications. For low-trust like package delivery, a signature (or smiley) drawn on a touch device will usually do.
      - dfox 3y ago
        AdES is mostly an technical standard that specifies how to use existing PKCS and IETF standards to produce eIDAS conforming signature, timestamp or “seal” (ie. timestamped signature) and how that should be mapped onto CMS (CAdES), XML-Signature (XAdES) and PDF (PAdES). How legally binding the result of that process is then depends on things like QSCTs, their LoA used in that and such things. And then there are various carveouts, for example in CZ, you can just generate CSR with ‘openssl req’ get that signed by right CA and produce QESs with that (and assume all the risks inherent in doing that)
        zajio1am 3y ago
        > for example in CZ, you can just generate CSR with ‘openssl req’ get that signed by right CA and produce QESs with that (and assume all the risks inherent in doing that) AFAIK that is not true. In CZ national law, there is also recognized electronic signature (RES, "uznávaný elektronický podpis"), which may be either QES (per eIDAS, "kvalifikovaný elektronický podpis"), or just AdES based on certificate from qualified CAs (per national law, "zaručený elektronický podpis, založený na kvalifikovaném certifikátu"). If you use QSCD to generate CSR and get it signed by right CA, you get QES, but if you use just 'openssl req' to generate CSR and get it signed by right CA, you get RES that is not QES.
        dfox 3y ago
        The point is that the CA has no way to determine that the CSR was generated by Qualified Device and will just sign it. My view of all the talk about Qualified Devices in eIDAS exists mostly to force QCAs to use normal enrollment process with CSRs instead of their random home-grown processes that result in PKCS#12 file containing private key generated who knows where and who knows how.
- magicalhippo 3y ago
  Here in Norway, I've had to use my banks 2-factor BankID[1] to sign my loan, house purchase contract etc. According to their documentation[2] it absolutely relies on cryptography, including SEID-SDO[3] [1]: https://www.bankid.no/bedrift/bankid-signering/ https://www.bankid.no/bedrift/bankid-signering/ [2]: https://confluence.bankidnorge.no/confluence/pdoidclc/technical-documentation/value-added-services/document-and-text-signing https://confluence.bankidnorge.no/confluence/pdoidclc/techni... [3]: https://www.nets.eu/developer/E-Signing/overview/Pages/Signeddocumentformat.aspx https://www.nets.eu/developer/E-Signing/overview/Pages/Signe...
  - loeg 3y ago
    That's interesting, thanks, but I am specifically interested in the US (like the thread I was responding to).
    - magicalhippo 3y ago
      Sure, I just like to bring an outside perspective when I can.

loeg 3y ago

Sure, but do you have any indication cryptography is involved in this process? In my (limited) experience as a consumer, they just take some existing PDF and add marks on top of it.

tialaramex 3y ago
Usually the distinction made is between electronic signature (e.g. you scrawled your mark on a piece of paper, scanned it and now the software lets you paste that image on signature pages) and digital signature (cryptographic)
- phrz 3y ago
  The ESIGN Act makes no distinction in the US between whether you cryptographically sign or digitally draw, etc., defining a signature as "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record."
  - kjetil 3y ago
    In the EU (and EEA), eIDAS distinguishes between - "electronic signatures", which can be any electronic data used to sign, like a drawn signature - "advanced electronic signature" (AdES), usually a type of digital signature (XML-DSig, PDF signature, etc.) - "qualified electronic signature (QES), which is a digital signature created by a certified signature device QES is legally equivalent to a "wet signature", but in my experience rarely used because of cost. AdES is much more common for high-trust scenarios like loan applications. For low-trust like package delivery, a signature (or smiley) drawn on a touch device will usually do.
    - dfox 3y ago
      AdES is mostly an technical standard that specifies how to use existing PKCS and IETF standards to produce eIDAS conforming signature, timestamp or “seal” (ie. timestamped signature) and how that should be mapped onto CMS (CAdES), XML-Signature (XAdES) and PDF (PAdES). How legally binding the result of that process is then depends on things like QSCTs, their LoA used in that and such things. And then there are various carveouts, for example in CZ, you can just generate CSR with ‘openssl req’ get that signed by right CA and produce QESs with that (and assume all the risks inherent in doing that)
      - zajio1am 3y ago
        > for example in CZ, you can just generate CSR with ‘openssl req’ get that signed by right CA and produce QESs with that (and assume all the risks inherent in doing that) AFAIK that is not true. In CZ national law, there is also recognized electronic signature (RES, "uznávaný elektronický podpis"), which may be either QES (per eIDAS, "kvalifikovaný elektronický podpis"), or just AdES based on certificate from qualified CAs (per national law, "zaručený elektronický podpis, založený na kvalifikovaném certifikátu"). If you use QSCD to generate CSR and get it signed by right CA, you get QES, but if you use just 'openssl req' to generate CSR and get it signed by right CA, you get RES that is not QES.
        dfox 3y ago
        The point is that the CA has no way to determine that the CSR was generated by Qualified Device and will just sign it. My view of all the talk about Qualified Devices in eIDAS exists mostly to force QCAs to use normal enrollment process with CSRs instead of their random home-grown processes that result in PKCS#12 file containing private key generated who knows where and who knows how.
magicalhippo 3y ago
Here in Norway, I've had to use my banks 2-factor BankID[1] to sign my loan, house purchase contract etc. According to their documentation[2] it absolutely relies on cryptography, including SEID-SDO[3] [1]: https://www.bankid.no/bedrift/bankid-signering/ https://www.bankid.no/bedrift/bankid-signering/ [2]: https://confluence.bankidnorge.no/confluence/pdoidclc/technical-documentation/value-added-services/document-and-text-signing https://confluence.bankidnorge.no/confluence/pdoidclc/techni... [3]: https://www.nets.eu/developer/E-Signing/overview/Pages/Signeddocumentformat.aspx https://www.nets.eu/developer/E-Signing/overview/Pages/Signe...
- loeg 3y ago
  That's interesting, thanks, but I am specifically interested in the US (like the thread I was responding to).
  - magicalhippo 3y ago
    Sure, I just like to bring an outside perspective when I can.