Timeline for Strategy for electronic document (PDF) signatures
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 13, 2017 at 12:48 | history | edited | CommunityBot |
replaced http://crypto.stackexchange.com/ with https://crypto.stackexchange.com/
|
|
| Dec 11, 2015 at 9:47 | vote | accept | creativename | ||
| Dec 11, 2015 at 9:47 | vote | accept | creativename | ||
| Dec 11, 2015 at 9:47 | |||||
| Dec 10, 2015 at 18:58 | comment | added | mti2935 | What might work well is a web-based digital signing service, where all the crypto (including key generation, the signing, etc.) is done client-side - a la the way Proton Mail does the crypto for its secure mail service. That way, the provider never has the users' private keys used for signing documents. At most, the provider would have an encrypted copy of the private key that they would store on behalf of their users, but this key is encrypted/decrypted (e.g. using AES) client-side using a password that is never sent to the provider's server. | |
| Dec 10, 2015 at 15:22 | comment | added | mti2935 | I think you're understanding this correctly. To do digital signing the 'right' way, nobody other than the signer should have a copy of the private key. If a 'signing service' (such as DocuSign) has a copy of a user's private key, then they could (if they wanted to) make it appear as if that user signed any document. So, everyone has to trust the signing service. On the other hand, if the user was capable of managing their own keys, they probably wouldn't need a service like Docusign, they would simply use PGP or something similar. | |
| Dec 10, 2015 at 1:25 | comment | added | creativename | This link is awesome! Thank you. Essentially it confirms what I thought and initially proposed - they generate key pairs for each user as a way to verify the authenticity of documents offline. Otherwise, according to that answer, it would be exactly as legitimate if DocuSign/we were to store confirmation of a signature. However, it seems in this case that no asymmetric encryption is necessary on our end since it would all come down to all parties trusting us anyway. I would still like to see if anyone has any input on whether I'm understanding this correctly, though. | |
| Dec 9, 2015 at 17:15 | history | answered | mti2935 | CC BY-SA 3.0 |