Digital signatures and truly validating what was actually agreed to

Question

I am developing an application and part of signing up requires a user to sign a contract agreement of using the service.

I have been reading around the subject for a few days, and I am fairly happy with all the techniques around digitally signing a document. Some references below

Digitally Sign DATA, Not Documents [closed]

What is the difference between an electronic signature and a digital signature

The one open question I have is how can we truly validate that the data/contract that I present to the user for review is the same as the data/contract that has been signed?

For example, I could implement in my application all the hashing, and PKI required to securely sign the document/data, but what if I decided I wanted to become corrupt and alter the text that was displayed on the webpage (could do this through javascript, or supplying a different pdf to the one that needs to be signed).

I could show the user a completely different data/contract to what is required, then in the backend of my application, sign the correct data. I can then remove the malicious code. If anyone audited my software as a contract was in dispute, they would see I display the correct data/contract and therefore the questionable contract is binding.

I ultimately have control over all aspects of the signing, so really struggling to understand how anything can be more secure than taking my word as a provider that I will not alter the data/contract that is shown to the user.

So with all the security around actually signing the document, it still ultimately comes down to the trust in me as a developer to not maliciously alter the contractual agreement shown to the user.

Have I missed something in my research? Or does it truly come down to trust? In which case why bother digitally signing at all?

UPDATE Based on answer below:

I control the signing process and what i choose to display on the page. I could show a user Document A on the webpage. They click the 'sign now' button. Document B is used in backend and signed. I send user document B via email. They dispute it. They have no way of proving they saw document A as it was displayed on a webpage which I have now removed and replaced with document B. Unless a user is really savvy and hashes the webpage themselves or take a screen capture (most users wouldn't). How can they prove they agreed to document A?

UPDATE Based on accepted answer:

For anyone reading this and also struggling, the one thing I really overlooked here is that I assumed that I could be the keeper of my private key and my customers private key. In hindsight this is obviously just plane wrong. The only way to truly apply a digital signature is to allow both parties to sign with their own private key, and then provide their public key to allow validation of the signature. The problem with this is obviously that many non tech savvy users just wouldn't really know much about digital signatures and how to apply them, so I've had to admit to defeat and downgrade to plain old electronic signature with some SHA256 hashing to 'seal' it after signing.

Answer 1

Your system assumes that they are giving you access to their private key. If they are doing that, then things are already broken and the key could probably be declared as compromised and non-binding (depending on jurisdiction). A private key should always be controlled by the user who it belongs to and they should refuse to allow you to sign something on their behalf.

Instead, working properly, you would have to give them a copy of the document to sign, they would sign it themselves and provide a copy back to you. Otherwise, it is actually just you attesting that they "signed" the document and it almost certainly would not be a binding document since it is actually you signing it.

This is effectively the equivalent of you making up a document and then signing my name on it. It's a forgery and isn't binding. There may have to be a legal case about it, but it's highly likely to go in their favor.

It sounds like what you are talking about is an electronic signature rather than a digital one. You can't have cryptographic authentication of a digital signature for anyone other than the holder of the private key and only the holder of a private key can sign something. If a company is signing it on your behalf, it isn't a digital signature, but rather an electronic one. It doesn't verify it was actually you that signed it and generally has little more legal standing than clicking "I Accept" on a EULA. In many cases, in order for it to stand up in court, the company has to be able to prove that it was you who actually clicked the button and it is on them to prove the document hasn't changed. (Millage may vary by jurisdiction, and I'm not a lawyer.) This can be pretty hard to do.

Answer 2

If the other party to the document has any sense then they will quickly detect your nefarious behaviour. The whole point of digital signatures is that somebody can verify that the document and signature match.

Lets take an example. I am signing up to a contract on your website. You display the contract (document A) and I agree to it. You then change the terms of the document to your advantage (creating document B) and sign it. You then mail me the document for my record (I'm going to insist on this).

• If you mail me document A then the digital signature will not match when I verify it - so my suspicions are aroused.
• If you mail me document B then I see that the terms have changed and I challenge it.

The only way for you to send me document A and a signature that matches document B is to find a collision in the signing process, which if a proper process is followed, will be more or less impossible.

Answer 3

how can we truly validate that the data/contract that I present to the user for review is the same as the data/contract that has been signed?

As far as I understand, this is the basic integrity problem. It is usually solved as follow : decypher the signature with the public key to obtain the original hash, compare it with the actual hash. If they differ, then the document has been tampered (and hopefully, with a suitable hash function, the converse is true).

Integrity is not based on what I see or show but on what I can compute. This makes me awkward with proprietary software that does everything for me, although software can also be signed or certified.

struggling to understand how anything can be more secure than taking my word as a provider that I will not alter the data/contract that is shown to the user.

If it is a web application you will use https of course to avoid man in the middle and I guess you can seek a certification of your methods by a third party. This will cost you a lot because of the required work and the risk.