Digitally signing a document with your public/private keypair without certificates?

Question

I have generated a private/public key pair using gpg.

Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead of creating a separate signature file?

To clear things up, instead of using paper and written signatures, I want to use legally binding electronic documents, but am wondering if this can be done without resorting to certification by a CA or digital certificates altogether.

I understand that there is a difference between an electronic signature and a digital signature, but it seems to me that the EU law doesn't really recognize this difference.

Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures defines "electronic signature" as "data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication." The EU differentiates between an electronic signature and advanced electronic signature. However, it seems that electronic signatures still have legal strength:

2. Member States shall ensure that an electronic signature is not denied legal effectiveness and admissibility as evidence in legal proceedings solely on the grounds that it is:

   • in electronic form, or

   • not based upon a qualified certificate, or

   • not based upon a qualified certificate issued by an accredited certification-service-provider, or

   • not created by a secure signature-creation device.

The first problem is that I'm not sure whether this means that a scan of a signed piece of paper has legal strength or if it refers to what I'm trying to accomplish. That is -- to sign a PDF with a private key with my name on it and attach my public key to it, but all within the PDF file.

Is latter even possible? Can I sign a PDF using my key pair without resorting to certification from CA? Would I need to create my own digital certificate or can it be done without certificates altogether? If I had to create a certificate, how would I create it using my existing key pair? You can create certificates using Microsoft Office, but it seems that this just generate another set of keys. You're never prompted to input your existing keys.

Furthermore, it seems to me that creating your own certificate could categorize you as a certificate-provider and thus subject to some stricter legal requirements, which is why I want to avoid certificates altogether.

Answer 1

You can generate your own certificate. The certificate is then used to digitally sign data, including signing a PDF. This type of certificate is a "self-signed" certificate.

Documents signed with a self-signed certificate are usually regarded with mistrust since there is no inherent trust relationship between the signer's certificate and the relying party (recipient).

Whether documents signed with a self-signed certificate are "legal" or not depends on the transaction, country, applicable laws and regulations.

DocuSign (my company) has an overview of the legal issues for eSignatures in each country.

Also remember that 99.99% of signed documents are never challenged in court. So the other way of looking at it is: if the recipient accepts the document signed in the way that you propose, then that's good enough.

Don't worry about being "catgorized as a certificate-provider" unless you start providing certificates to others.

Re: is a scan of a piece of paper that was wet-signed an electronic signature? Yes it is. That's called a "Basic Electronic Signature." It is fully legal in many jurisdictions for many types of transactions. It is also NOT legal in many jurisdictions for many types of transactions.