tegolySIGN makes trust digital! The eSignature for DATEV!

What is a digital signature?

In this article, you will learn how a digital signature works in principle, what the legal conditions are, and how the interplay between tegolySIGN and a Trusted Service Provider is structured.

What is a digital signature?

A digital signature, also known as an electronic signature, is a legally binding method by which digital documents, such as a PDF, can be signed, thereby providing your consent.

The legal framework for electronic signatures is set out in the European Union's eIDAS Regulation (European Regulation on electronic identification and trust services for electronic transactions). This also defines the requirements for the three different levels of electronic signatures:

• the simple electronic signature (SES)

• the advanced electronic signature (AES)

• the qualified electronic signature (QES)

The three types of eSignatures differ essentially in their level of security. Here, they differ in evidentiary value, i.e., in the degree of trust in the signer's identity and in proof that the signed document is indeed the one presented. You can find more information here.

Definition and function of the digital signature

The digital signature is an electronic fingerprint generated using cryptographic algorithms. It serves to guarantee the authenticity and integrity of a message or document and to confirm the identity of the signer.

Definition: A digital signature is a cryptographic mechanism used to verify whether a message or document comes unaltered from a specific sender. Technically speaking, a digital signature consists of a data set generated by cryptographic algorithms, typically based on the document to be signed or a hash representation of the document.

Function:

1. Authentication: It confirms that the document indeed originates from the person or entity claiming to have sent it.

2. Integrity: It ensures that the document has not been altered after signing. If even a single bit of the document is altered after signing, the digital signature becomes invalid.

3. Non-Repudiation: The sender cannot later deny having signed the document, as the digital signature is specific to both the sender and the document.

It is important to emphasise that digital signatures and electronic signatures are not always synonymous. An electronic signature can be any type of electronic confirmation, such as a scanned image of a handwritten signature. A digital signature, by contrast, always has the cryptographic background described above.

How does a digital signature work?

How it works:

1. A hash value (also called a "checksum") of the document is created. This hash value serves as a compact representation of the content.

2. Using the sender's private key, this hash value is signed. The result is the digital signature.

3. Both the document and the signature are sent to the recipient.

4. The recipient uses the sender's public key to verify the signature. If verification is successful, this confirms the authentication and integrity of the document.

It is important to emphasise that digital signatures and electronic signatures are not always synonymous. An electronic signature can be any type of electronic confirmation, such as a scanned image of a handwritten signature. A digital signature, by contrast, always has the cryptographic background described above.

Difference between a digital and an electronic signature

The terms "digital signature" and "electronic signature" are often used interchangeably, but they refer to different concepts. Here are the fundamental differences:

Digital Signature:

Technical Basis: The digital signature is based on cryptographic methods. A private key, known only to the signer, is used to sign a document, and a public key is used to verify the signature.
Authentication: It provides a strong assurance that the document indeed comes from the stated sender.
Integrity: It ensures that the document has not been altered after signing.
Non-Repudiation: A signer cannot later deny having signed a document.
Standardisation: Often governed by legal frameworks and technical standards.

Electronic Signature:

Technical Basis: Can be any form of electronic confirmation or consent to a document or record. This can be, for example, a scanned image of a handwritten signature, a tick in a checkbox, or typing a name into an online form.

Authentication: The security level varies and can be lower than that of a digital signature. Sometimes it can be difficult to establish with certainty who provided an electronic signature.

• Integrity: It does not always guarantee that the document has not been altered after signing.

• Non-Repudiation: Can often be disputed, depending on how the electronic signature is implemented.

• Standardisation: Less strictly regulated and standardised than the digital signature.

In summary, a digital signature is a specific form of electronic signature that uses cryptographic security features. While all digital signatures are electronic signatures, not all electronic signatures are digital signatures. It is important to consider the context and requirements of a specific use case to choose the appropriate type of signature.

Legal validity of the digital signature

The legal validity of a digital signature varies from country to country, based on the respective statutory regulations. Many countries have enacted laws and regulations to govern the use of digital signatures and clarify their legal status. Below, I introduce the legal frameworks for the digital signature in the European Union (EU) and the USA:

European Union:

eIDAS Regulation (Regulation (EU) No 910/2014):

• This regulation establishes an EU-wide legal framework for electronic identification and trust services for electronic transactions.

• It classifies electronic signatures into three categories: simple electronic signature, advanced electronic signature (AES), and qualified electronic signature (QES). Only the qualified electronic signature has the same legal effect as a handwritten signature.

• Creating a qualified electronic signature requires a qualified certificate from a recognised trust service provider.

USA:

Electronic Signatures in Global and National Commerce Act (ESIGN Act) of 2000:

• This law ensures that electronic signatures, contracts, and records have the same legal validity as their paper equivalents.

Uniform Electronic Transactions Act (UETA):

• This draft legislation was adopted by the National Conference of Commissioners on Uniform State Laws (NCCUSL) in 1999 and implemented in most US states.

• Like the ESIGN Act, UETA gives electronic signatures and records the same legal validity as their traditional counterparts.

It is important to note that many other countries have their own legal frameworks for electronic and digital signatures. In any case, individuals or businesses wishing to use digital signatures in a specific jurisdiction should familiarise themselves with the relevant local laws and regulations or seek legal advice.

What is a Trusted Service Provider – TSP? 

A TSP stands for "Trust Service Provider". These are organisations or companies that offer trust services, particularly in connection with electronic signatures, seals, time stamps, and similar services.

In the context of the eIDAS Regulation (Regulation (EU) No 910/2014), a TSP refers specifically to an entity that offers one or more of the following services:

1. Creation, verification, and validation of electronic signatures: This involves the entire process, from issuing the digital signature to confirming its validity.

2. Creation, verification, and validation of electronic seals: An electronic seal is a type of digital signature used by a legal entity (e.g., a company) rather than an individual. It guarantees the origin and integrity of documents or data.

3. Creation, verification, and validation of electronic time stamps: An electronic time stamp confirms that a specific document or piece of information existed at a specific point in time and has not been altered since.

4. Delivery of certificates for website authentication: These are SSL/TLS certificates that ensure communication between a user and a website is secure.

5. Management of authentication means: This includes services enabling individuals or companies to electronically confirm their identity.

TSPs play a crucial role in creating a secure digital environment by providing the necessary infrastructure and services that allow individuals, businesses, and governments to secure their electronic transactions and communications. To be recognised as a TSP, these service providers must typically meet strict standards regarding security, reliability, and data protection.

What regulations govern a TSP in Germany?

In Germany, Trust Service Providers (TSPs) are primarily regulated by the eIDAS Regulation (Regulation (EU) No 910/2014), which applies to all member states of the European Union. The eIDAS Regulation establishes a common legal framework for electronic identification and trust services for electronic transactions in the internal market.

In addition to the eIDAS Regulation, Germany has enacted national regulations to implement and specify certain aspects of the regulation:

1. Vertrauensdienstegesetz (VDG - Trust Services Act): The VDG is the primary law in Germany governing the implementation of the eIDAS Regulation. In particular, it clarifies the tasks and powers of the national supervisory authority, which in Germany is the Federal Office for Information Security (BSI). The VDG also regulates specific requirements for trust service providers and the services they offer.

2. Vertrauensdiensteverordnung (VDV - Trust Services Ordinance): The VDV flesh out many of the regulations set out in the VDG and places detailed technical and organisational requirements on TSPs.

3. Federal Office for Information Security (BSI): In Germany, the BSI is responsible for supervising trust service providers. It monitors compliance with legal requirements, conducts security assessments, and can impose sanctions in the event of violations.

Trust service providers operating in Germany must register with the BSI before they can offer their services. If they wish to offer qualified trust services (e.g., qualified electronic signatures), they must undergo a rigorous assessment by a conformity assessment body and obtain certification from the BSI.

In summary, TSPs in Germany are subject to both European regulations (mainly the eIDAS Regulation) and national regulations (specifically the VDG and VDV), and they are supervised by the BSI.

How does the TSP provide certificates for QES, for example?

A Trust Service Provider (TSP) provides certificates for qualified electronic signatures (QES) via a multi-stage process involving both technical and organisational measures to verify the applicant's identity and ensure the integrity and confidentiality of the certificate. Here is a simplified overview of the process:

1. Application: An individual or organisation applies for a certificate for a qualified electronic signature from the TSP.

2. Identity Verification:

   • The TSP verifies the applicant's identity. This can be done in person, online, or through other reliable identification procedures.

   • For individuals, this may involve checking a valid ID card or passport.

   • For organisations, this may involve checking company documents, registers of commerce extracts, or similar documents.

3. Certificate Creation: Upon successful verification, the TSP generates a pair of public and private keys. The private key remains secret and is securely handed over to the applicant or stored on a secure signature creation device (e.g., a smart card or a secure signature token). The public key is embedded in the certificate.

4. Certificate Issuance: The TSP issues the qualified certificate to the applicant. This contains information such as the name of the certificate holder, the public key, the validity period of the certificate, and the digital signature of the TSP.

5. Storage and Publication: The TSP may store the certificate in a certificate repository or publish it in a public directory so that third parties can retrieve it and verify the authenticity of documents signed with the certificate.

6. Using the Certificate: The holder of the certificate can now use the private key to digitally sign documents. Third parties can use the public certificate to verify the signature.

7. Revocation: If the private key is compromised, or if the certificate should no longer be used for other reasons, it can be revoked. In this case, the certificate is added to a Certificate Revocation List (CRL), and third parties can check whether a certificate has been revoked.

It should be noted that the exact process may vary depending on the TSP and the respective national and regional regulations. However, the procedure described above aligns with general practices followed in many jurisdictions, including the EU under the eIDAS Regulation.

How long is a certificate valid and what happens if the provider goes insolvent?

A certificate has a fixed validity period, determined by the issuing Trust Service Provider (TSP). The exact duration depends on the type of certificate and the TSP's policy. Common validity periods for certificates are 1 to 3 years, but other periods can be set.
Nevertheless, all documents issued with a certificate remain valid for 10 years. 

If the certificate provider (TSP) goes insolvent:

1. Notification: In most jurisdictions, trust service providers are legally obliged to notify customers and supervisory authorities in advance of significant operational disruptions or the cessation of their business operations.

2. Data Backup: In some jurisdictions, TSPs must make provisions for the event of business failure, for example, by backing up their data with a third party or making arrangements to transfer their services to another provider.

3. Continuation by another provider: It is possible that another TSP or organisation will take over the operations of the insolvent TSP, ensuring the continuity of services. Customers might then be asked to renew their certificates or obtain new certificates from this new provider.

Can certificates be forged?

Yes, certificates can be forged, but there are important distinctions and technical barriers to consider:

1. Forged Certificates: An attacker can attempt to generate a certificate that looks like a valid certificate from a trusted Certificate Authority (CA). The main problem for the attacker is signing the forged certificate with a valid private key from the real CA, which in practice is extremely difficult as these keys are meticulously protected.

2. Improperly Issued Certificates: In some rare cases, CAs have issued certificates that were fraudulently applied for, or they have been hacked and exploited to issue invalid certificates. These are not "forged" in the traditional sense, as they were signed by a genuine CA, but they were acquired or created in bad faith.

3. Self-Signed Certificates: Anyone can create a self-signed certificate that has not been signed by an official CA. While such certificates can be legitimate in certain use cases (e.g., for internal testing), they are considered untrusted in most public and commercial contexts.

To protect against forged or improperly issued certificates:

1. Certificate Verification: Modern software and operating systems verify certificates against a list of trusted CAs. If the certificate was not signed by one of these CAs, or if something else is wrong with the certificate (e.g., expired validity), a warning is usually displayed.

2. Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP): CAs publish lists of certificates that have been revoked or reported as compromised. Modern software can use these services to check the status of a certificate in real time.

3. Public Key Pinning: Some web services use public key pinning to ensure that only specific certificates or public keys are accepted for their services, even if other certificates have been signed by a trusted CA.

4. Certificate Transparency: This is a system for publishing and monitoring SSL certificates. It allows the public to see all certificates issued by a specific CA, making improperly issued certificates easier to detect.

Although certificates can be forged, the security measures and technologies mentioned above make it difficult to successfully exploit such forgeries in practice. However, it is always important to remain vigilant and update software and systems regularly to protect against the latest threats.

How is a PDF signed with such a certificate for QES?

Signing a PDF file with a qualified electronic signature (QES) using an appropriate certificate is a process typically performed with specialised software or a signing service. Here is a general guide on how to sign a PDF with a QES:

1. Preparation:

   • Ensure that you have a valid certificate for the QES. This certificate is often stored on a secure signature creation device (SSCD), such as a smart card or a USB token.

   • You will also need a card reader if your certificate is stored on a physical smart card, along with the required drivers and middleware to communicate with the device.

2. PDF Signing Software:

   • There are many software solutions, both commercial and open-source, that offer the ability to apply digital signatures to PDF documents. Some well-known PDF readers and editors, such as tegolySIGN, support signing documents.

   • Open your PDF file with the chosen software.

3. Add Signature Field:

   • Typically, you must add a signature field in the PDF software where your signature will be displayed. This field defines where on the page your signature (e.g., your name, the date, and potentially a seal) will appear.

4. Signing the Document:

   • Select the option to sign the document in the software and select the previously created signature field.

   • The software will prompt you to select the certificate for the QES that you wish to use. If you are using a smart card or a USB token, you may be prompted to insert it and enter the corresponding password or PIN code.

   • Once the certificate is selected and you confirm the signing process, the software will sign the PDF file with the private key associated with the QES certificate.

5. Verification:

   • After signing, you or others can verify the signature by opening the PDF document. The verifying software will use the public key from the QES certificate to confirm the validity of the signature.

6. Save and Share:

   • Save the now-signed PDF file and share it as needed. 

How is all this implemented in tegolySIGN and what do I need to do as a user? 

First of all, tegolySIGN is not a TSP. But we do not need to be, because in our application, tegolySIGN uses certificates from GlobalSign. GlobalSign is a leading global provider of identity and security solutions for businesses of all sizes. GlobalSign is registered as a TSP in the EU and listed on the EU Trusted List. Thus, every document signed with a GlobalSign certificate is legally valid across the EU under the eIDAS standard. As a software manufacturer, we can therefore focus entirely on our customers' needs and boast a TSP partner at our side who enjoys global trust.

As a user of tegolySIGN, you don't have to worry about anything, because even in our simple electronic signature (SES), all documents are signed and protected with the GlobalSign certificate. In the AES (advanced electronic signature) process, all documents are also signed with the GlobalSign certificate. Additionally, we use a second factor to authenticate the individual—in our case, an SMS PIN is sent to uniquely identify the person. From AES onwards, documents are also provided with a qualified time stamp from GlobalSign, which further increases the evidentiary value. 

tegolySIGN and DATEV = digital trust

With tegolySIGN, trust becomes digital and is easily available for all DATEV users. To use it, you only need our application and our tegoly DATEVconnector; then you can hand over documents directly from DATEV to tegolySIGN for signature and have them signed with legal security.