Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Why are hand-written signatures still so commonly used? Can they actually prove anything?

Two assumptions:

  • If anyone wants to forge my signature I'm sure they will be able to do it. Even my own signature looks a little bit different every time I sign a document.
  • If I commit to an agreement by signing a contract not with my typical signature but using a new random signature (maybe even using my left hand), I could just claim I didn't sign it and the best forensics will probably have to agree, because my "real" signature is completely different.

On the other hand, why are digital signatures not more popular? Just because non-tech savvy people don't know how to use them?

share|improve this question
5  
Humorously related: Whenever I'm asked for a signature from a credit-card swiping machine, I usually just draw animals or faces. Once I even scribbled to fill every pixel on the screen. No matter what I do, after several seconds it always comes back with "Signature accepted." –  BlueRaja - Danny Pflughoeft Oct 15 '11 at 20:34
    
I will have to try this: consumerist.com/2009/02/… –  BlueRaja - Danny Pflughoeft Oct 16 '11 at 5:16
2  
Don't think that it's really easy to forge signatures. And yes, even if your signature seems to be different everytime you sign, you leave some traces on it that are very peculiar to your way of signing –  woliveirajr Oct 17 '11 at 17:10
2  
This is definitely on topic as far as I am concerned. –  Stuart Woodward Oct 18 '11 at 3:12
3  
In Japan signatures are rarely used. Instead, every adult has multiple seal/stamps (hanko) which are used to stamp documents in the same way as a signature is used. Someone possessing your seal can stamp your name as your proxy. Stamps that were used for important transactions like buying a house or getting married are usually locked away in a secure place. Local governments have a register of seals & issue certificates of authenticity. They keep an image of the registered seal electronically and can verify whether a seal is the same one that was registered at another location in the country. –  Stuart Woodward Oct 18 '11 at 3:23

2 Answers 2

up vote 32 down vote accepted

It pays to investigate what we really trust in hand-written signatures.

A signature is the physical manifestation of the will of the signer to acknowledge the contents of what is signed. Most legal systems define that a signature is yours and is binding if and only if "you really did it". This looks like a tautology, but it actually is quite profound: the hardness of forging, or even the involvement of a physical hand and pen, are not part of what defines a signature.

So what's the trick ? At the core of the trust system is the set of laws which severely punish forgery: forging an hand-written signature is an offense which can land you in jail for much more time than whatever you signed. The idea is that a hand-written signature happens "in the physical world" where it leaves many traces, in particular witnesses. The risk of being caught forging a signature makes it "not worth it". The signature medium is not really important; typing your name at the end of an email is as much binding as an ink-based handcrafted smudge at the bottom of a piece of paper (at least in England; there are variations depending on the country). In Japan they use personalized stamps.

The system works as long as forging signatures remains risky. When translating into the digital world, signatures become too easy to forge without any trace, which is why cryptography must be invoked. Cryptographic signatures also open the possibility of automation: being able to sign and verify at lightning speed (the verifying part is a novelty: with hand-written signatures, verification that the signature is legit is not a power given to just anybody).

The hard part of designing a signature scheme remains the set of laws which make the link between the action of signing, and the legal consequences thereof (namely, the "binding" part). Technicalities such as length of a RSA key are the easy part, which can be done by mere scientists -- but laws take decades and an awful lot of negotiation. Such laws exist for hand-written signatures; actually, they have existed for thousands of years. Digital signatures will begin to compete with hand-written signatures only when legal systems will be up to it. Europe is currently trying to do that, but it takes time.

share|improve this answer
    
"verification that the signature is legit is not a power given to anybody" - notaries public can of course verify the signature and the signed document. –  user185 Oct 17 '11 at 14:31
    
@Graham: well, even notaries tend to require witnessing the act of signing. Checking an handwritten signature after it was done requires comparing it with samples of the "correct" signature, and only an expert at graphonomics will provide any real robustness against most forgers. –  Thomas Pornin Oct 18 '11 at 14:17

Well, ever wonder where the web of trust model came from? Look no further than notaries.

In any case, not everyone wants to remember a huge chunk of non comprehensible strings, apply them as rounds in some kind of XOR blocks and be able to compute the ciphertext in the amount of time it takes to do a john hancock.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.