Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From Wikipedia:

An electronic signature, or e-signature, is any electronic means that indicates either that a person adopts the contents of an electronic message, or more broadly that the person who claims to have written a message is the one who wrote it (and that the message received is the one that was sent). By comparison, a signature is a stylized script associated with a person. In commerce and the law, a signature on a document is an indication that the person adopts the intentions recorded in the document. Both are comparable to a seal.

Increasingly, encrypted digital signatures are used in e-commerce and in regulatory filings as digital signatures are more secure than a simple generic electronic signature.1[2][3] The concept itself is not new, with common law jurisdictions having recognized telegraph signatures as far back as the mid-19th century and faxed signatures since the 1980s.

  1. I was wondering what relations and differences are between electronic signature and digital signature?
  2. If digital signature is just a special kind of electronic signature, what are other kinds of electronic signature?

Thanks!

share|improve this question
    
The basic difference is that it is impractical to separate a digital signature from the contents it signs whereas an electronic signature can be separated. –  David Schwartz Jul 24 '12 at 6:46
    
@DavidSchwartz: Why is that? –  Tim Jul 24 '12 at 11:34
    
It's a matter of definition, it doesn't have a reason. That's just the way they've chosen to use those two terms. –  David Schwartz Jul 24 '12 at 18:37
add comment

3 Answers

up vote 5 down vote accepted

An electronic signature is any author identification and verification mechanism used in an electronic system. This could be a scan of your real hand-written signature, or any kind of electronic authenticity stamp. It's a generic term that covers a lot of authenticity measures.

A digital signature is a type of electronic signature. It is a signature generated by a computer for a specific document, for the purposes of strong authenticity verification. For example, in asymmetric cryptography, a private key might be used to sign a hash of a document, which anyone in possession of the corresponding public key can verify but not forge. It also prevents modification of the document after the signature is generated. This allows one user to place a digital signature on a document, and many other users to verify that the signature is correct.

A digital signature scheme might work as follows:

  1. Alice generates an asymmetric key pair (e.g. RSA)
  2. Alice computes a cryptographic hash (e.g. SHA256) of the document.
  3. Alice encrypts the hash using her private key.
  4. Alice makes her public key available to anyone who wants it.
  5. Bob downloads the document and a copy of Alice's public key.
  6. Bob computes a cryptographic hash of the document.
  7. Bob decrypts the signature value stored in the document using Alice's public key.
  8. Bob compares the decrypted hash with the hash he computed. If they match, the document is authentic.

In the next scenario, Eve fails to subvert the process:

  1. Alice publishes her public key and the signed document.
  2. Eve downloads them, but wants to modify the document. Since Eve only has the public key, she cannot forge the signature.
  3. Eve modifies the document anyway, and gives it to Bob.
  4. Bob opens the document and checks that the hash matches the signature. It does not, so he knows that the document has been modified or the signature forged.

Disclaimer: IANAL - In terms of legal standing (at least in the UK, pretty sure the US too) an electronic signature, in the form of a scanned image of the signer's hand-written signature, is considered to be legally binding. However, it is often trivial to extract the signature and use it on other documents without the author's permission. In the case of a dispute, most courts require some sort of digital signature of authenticity to prove that the electronic copy of the physical signature is authentic.

share|improve this answer
    
Thanks What software is used to add a hand-written signature picture to some particular place in an existing pdf file? –  Tim Jul 24 '12 at 11:02
    
@Tim Most PDF creation software (e.g. Adobe Acrobat) has the ability to create both scanned hand-written signatures and cryptographic digital signatures. The OpenXML document (docx, xlsx, etc.) format also supports such signatures, so you should be able to produce similar results in Microsoft Office / OpenOffice. –  Polynomial Jul 24 '12 at 11:04
    
I meant adding an existing scanned signature picture to some particular place in another existing pdf file. Also my OS is Ubuntu 12.04. So I hope the software can be for Linux and free. –  Tim Jul 24 '12 at 11:07
    
@Tim I've never tried to author PDF files on Linux, but I'm sure there is some sort of PDF editing app out there. Try OpenOffice maybe? I'm sure you can find something on Google. If you've got a scanned signature, it's just a case of dropping the image into the page. There's nothing special about the picture, it could be removed or replaced by anyone as I said earlier. Anyway, product recommendation is outside the scope of Security SE. –  Polynomial Jul 24 '12 at 11:10
add comment

They are using the term digital signature to separate it from an electronic fax signature (as one example). Originally fax machines were analog though electronic. You would use a fax to take a picture of a real hand written signature creating an analog electronic representation of it. This would be converted through a modem to the distant end fax machine. Please understand I am grossly oversimplifying my explanation. Digital electronics were still used, but the overall function was analog.

share|improve this answer
add comment

So the key differences - very simply explained:

  • Electronic signatures: It's a legal concept that captures intent and consent. It can be anything, from a scripted text, click-to-sign, image or voice image that illustrates an action of consent.
  • Digital signatures: It's the mechanism that secures documents with cryptography.

Often times, to have a legally binding e-signature, you need both to be present as well as proof of intent and due process. Otherwise it can be easily repudiated by the signers.

Some interesting resources that can help:

Hope this helps!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.