Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Many living politicians' signatures are found online or can handily be acquired (You can write them, and their letters will contain their signature). Thus do they use a different signature for personal private documents? If not, how can they guarantee that their signatures aren't replicated without their consent? I deliberately quote signatures of lesser-known politicians.
The Honourable Rona Ambrose PC
Some members of the Minnesota House & Senate
They don't. Outside the lowest security scenarios, signatures aren't intended to be security feature to prevent forgery.
In most cases, putting a signature on paper is just ceremonial. The actual details/decision may have been recorded through other means. For example, depending on what exactly is being signed and how sensitive the matters is, by witnesses (whether by sworn individuals or even just casually), through publications in mass media, or filed into a register on a trusted computer system/filing cabinet.
In the latter case, the paper you receive, even when physically signed with ink and even if it's the paper signed when you shake hands in agreement, might just be considered a copy of the true records in the registry you don't really see. This is similar to how a birth/death/university degree certificate is really just a copy of the registration detail in your civil/university records, the only really important detail in that piece of paper is the record number rather than the signature. A person who has reasonable suspicion that the letters might be a forgery should confirm with the office of the relevant signer to check for its authenticity. For important, formal letters, there may be a filing number for the file that you can cite to confirm the content of the letter.
If not, how can they guarantee that their signatures aren't replicated without their consent?
They can't - but this problem is not restricted to politicians. Many of us leave signatures in various places (bank, rental agreements ...) and we have no control of who has access to these signatures, might scan these and reuse these somewhere else.
In other words: the trust which can be placed in a document just because it seems to be signed is very limited, especially if this is not the original document but just a copy or electronic representation. Everybody who has to rely on such documents need to be aware of this and needs to have additional verification depending on the kind of trust actually needed.
Signatures have started out as an honor system: before widespread literacy, there was no realistic means of telling one X from another. They haven't come far since.
Currently, the only security measure is that ink signatures on paper can be analyzed by forensic document examiners to determine if a signature matches others produced by the person it's meant to identify. This requires physical access to the paper to examine the ink very closely.
Translating this to modern security concepts, there is no secret in the image of the signature. Rather, the image is public and simultaneously serves as a signature and a sample (certificate) for verifying other signatures by the same person. The secret or the private key is the exact sequence of strokes with the angle, velocity and pressure for each, required to produce the same imprint on paper.
These parameters and their distribution over each stroke are difficult to match manually and will usually differ enough for an expert to distinguish. Non-manual reproduction, be it by photocopy or facsimile, is much easier to detect.
Electronic tablets meant to capture handwritten signatures digitally also record and store these parameters, not just the image, in an attempt to provide similar protection. However, the current industry practice for this, at least in the largest vendor's implementation, relies on steganography rather than cryptography, rendering it insecure.
Hand written signature is a very old concept. It is just based on few assumptions:
That is a totally different concept from digital signature. Once a digital document is signed, it is admitted that it can be copied at will and any copy will have the same value. And the protection is technical while the protection of a handwritten signature is mainly legal.
Once I have said that, there are some caveats:
Because of that, images of handwritten signatures do not need special protection.
Anyone's signature on anything is subject to verification if challenged in court. Celebrities sometimes have assistants (or machines) sign photos for them. If someone presents them with a check or contract that they apparently signed, they can argue that their signature was duplicated without authorization and the other party has to prove otherwise.
There's even a system in place to avoid this entire problem. A notary public offers a service where they serve as an official, impartial witness for your signing of a document after verifying your identity. They keep a legal record of the event that can be used in court to confirm that a signature was genuine and proper. If a document is important enough that a forged signature is a real problem, then there will almost certainly be a requirement to have that signature notarized.
