In the context of advanced electronic signatures, what does "sole control" mean?

Question

To satisfy the conditions for an advanced or qualified electronic signature, the power to sign must remain under the "sole control" of the signatory. Can anyone provide concrete examples of what this means?

In our scenario, the signatory is a moral person (company), and the signature will be generated "automatically" during a functional sequence (the upload of documents to a repository). Can such a signature ever be "advanced" or "qualified" in the terms of the European law? If we create processes to ensure that only employees of the company can access the uploading functionality, does this satisfy the condition of "sole control"?

A signature with a pen generally makes implicit guarantees, eg. "read and approved", "ordered", "good for payment". In our case, the law wants the signature to warrant that the uploaded document is a true copy of a paper original, but ensuring this is outside the scope of uploading software. Why do digital signatures have no concept of a "mention", a short phrase making explicit the assurance that the signature represents?

Answer 1

I'm a Public-Key Infrastructure (PKI) developer, we definitely develop software for that use-case, so I can speak to the software side of your question. Complying with European law is more about how you write your corporate policies (and how you enforce them).

In a use-case like that, we would recommend that users have 3 keypairs (pairs of public / private keys):

1. An Encryption keypair for keeping documents confidential,

2. A Signing keypair, usually for user-login operations (called authentication) like signing emails, establishing SSL/TLS or VPN connection, etc,

3. A Nonrepudiation keypair for signing legally-binding documents.

While it's technically possible to have a single RSA keypair do all three jobs, we recommend three different keys because there are usually different policies around how each is handled. As mentioned in this answer, nonrepudiation keys usually have the strictest policies for what you are and are not allowed to do with them. These policies define what it means for a key to be "under the sole control of the signatory". For example:

• Non-repudiation keys should never be backed up to a server.
• Non-repudiation keys should only be used when the human to whom it belongs is sitting at the keyboard (ie no auto-logins like a VPN key would do)
• Corporate policy should dictate that you should never share the password for your non-repudiation key with anyone else.
• If two people do get access to the same nonrepudiation key, corporate policy should dictate that the key be destroyed and a new one issued to the rightful person.
• etc...

As I understand it, each regional government has a list of key-management policies similar to the above that you have to follow in order for your digital signatures to be considered legally-binding. These policies are meant more for the administrators of your computer newtorks rather than for software vendors.

I'm no law expert, but my guess is that for your "document uploading" scenario, you'd need the uploads to be signed by individual humans rather than by a company-wide shared key. ie "This document was uploaded by John Smith, and in verifying his signing certificate, we can verify that he is an authorized document uploader for this company".