3

I have generated a private/public key pair using gpg.

Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead of creating a separate signature file?

To clear things up, instead of using paper and written signatures, I want to use legally binding electronic documents, but am wondering if this can be done without resorting to certification by a CA or digital certificates altogether.

I understand that there is a difference between an electronic signature and a digital signature, but it seems to me that the EU law doesn't really recognize this difference.

Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures defines "electronic signature" as "data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication." The EU differentiates between an electronic signature and advanced electronic signature. However, it seems that electronic signatures still have legal strength:

  1. Member States shall ensure that an electronic signature is not denied legal effectiveness and admissibility as evidence in legal proceedings solely on the grounds that it is:

    • in electronic form, or

    • not based upon a qualified certificate, or

    • not based upon a qualified certificate issued by an accredited certification-service-provider, or

    • not created by a secure signature-creation device.

The first problem is that I'm not sure whether this means that a scan of a signed piece of paper has legal strength or if it refers to what I'm trying to accomplish. That is -- to sign a PDF with a private key with my name on it and attach my public key to it, but all within the PDF file.

Is latter even possible? Can I sign a PDF using my key pair without resorting to certification from CA? Would I need to create my own digital certificate or can it be done without certificates altogether? If I had to create a certificate, how would I create it using my existing key pair? You can create certificates using Microsoft Office, but it seems that this just generate another set of keys. You're never prompted to input your existing keys.

Furthermore, it seems to me that creating your own certificate could categorize you as a certificate-provider and thus subject to some stricter legal requirements, which is why I want to avoid certificates altogether.

2

You can generate your own certificate. The certificate is then used to digitally sign data, including signing a PDF. This type of certificate is a "self-signed" certificate.

Documents signed with a self-signed certificate are usually regarded with mistrust since there is no inherent trust relationship between the signer's certificate and the relying party (recipient).

Whether documents signed with a self-signed certificate are "legal" or not depends on the transaction, country, applicable laws and regulations.

DocuSign (my company) has an overview of the legal issues for eSignatures in each country.

Also remember that 99.99% of signed documents are never challenged in court. So the other way of looking at it is: if the recipient accepts the document signed in the way that you propose, then that's good enough.

Don't worry about being "catgorized as a certificate-provider" unless you start providing certificates to others.

Re: is a scan of a piece of paper that was wet-signed an electronic signature? Yes it is. That's called a "Basic Electronic Signature." It is fully legal in many jurisdictions for many types of transactions. It is also NOT legal in many jurisdictions for many types of transactions.

  • Thanks! How can I generate a certificate with my existing key pair? From what I've read, I'd have to first generate a CSR. When I try this with gpgsm, I get stuck at the part where I'm supposed to enter the keygrip for my key. Both keygrips from my key give me No key with this keygrip. If I were to use openssl, I'd have to export my private key unencrypted into a file for openssl to use, but I have no idea how to do that or even if I should do it. – stanny Apr 19 '16 at 15:47
  • There are many ways to generate a self signed cert, depending on what tech platform you are on. For example, you can use OpenSSL: digitalocean.com/community/tutorials/… – Mike Goodwin May 19 '16 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.