Electronic vs Digital Signature

What is the difference between an electronic and a digital signature?

An electronic signature is a legal idea: any electronic sign that a person meant to sign. A digital signature is a technical method: a code from the signer's private key and certificate, sealed into the file. A digital signature can serve as an electronic one and adds tamper evidence and signer identity that a picture of a signature cannot give.

What counts as an electronic signature?

In the United States, an electronic signature is an electronic sound, symbol or process attached to a record and adopted with the intent to sign it, under the ESIGN Act. A typed name, a drawn signature placed on a PDF, a ticked box and a recorded "yes" on a call can all qualify. The law looks at intent, not technology.

The EU's eIDAS Regulation defines an electronic signature as data in electronic form attached to other data and "used by the signatory to sign". It then adds two stronger levels. An advanced electronic signature must be uniquely linked to the signer, identify them, be made with data under their sole control, and make "any subsequent change in the data" detectable (Article 26). A qualified electronic signature is an advanced one made with a qualified device and based on a qualified certificate.

How does a digital signature work?

A digital signature works in three steps. The software computes a hash, a short fingerprint, of every byte of the PDF except the signature itself. It seals that hash with the signer's private key. It stores the sealed hash and the signer's certificate inside the file. Anyone can recompute the hash later; if one byte changed, it no longer matches.

The certificate carries the signer's public key, so a reader can check the seal without the private key, which stays with the signer. In our tool the signature and certificates added 15.6 KB to a 1.3 KB contract. The PDF standard calls the covered bytes the byte range; later changes go after them, so a reader can tell the signed version from additions.

What does a digital signature catch?

A digital signature catches any change to the bytes it covers. We signed one contract twice, once with a drawn signature picture and once with a certificate, then changed it three ways. Editing the price inside the file went unnoticed with the drawn signature; the digital signature flagged it. A note saved on top was shown as an addition.

The drawn signature is stored as an ordinary picture, so it can also be copied out of one PDF and pasted into another; nothing ties it to the document. Re-saving a digitally signed file in a basic editor rewrote it, and no valid signature was left. Make every edit first and sign last.

Why does my PDF reader say the signature validity is unknown?

A reader says signature validity is unknown when the document is unchanged but it cannot trace the signer's certificate to an issuer it trusts. Self-signed certificates always show this. It is a question about identity, not tampering. Certificates from issuers on the reader's trusted list, or ones the reader is told to trust, show as valid.

Checking trust also means checking that the certificate was not cancelled, which needs an online lookup. That is why our Digital Signature PDF page checks whether the signed bytes changed and whether each signature matches its certificate, and leaves trust and revocation to your PDF reader.

Is an electronic signature legally binding?

In the US, the ESIGN Act says a signature or contract cannot be denied legal effect solely because it is electronic. In the EU, eIDAS says the same, and gives a qualified electronic signature the equivalent legal effect of a handwritten one. Both have limits, and a contract still needs all its other parts. General information, not legal advice.

ESIGN does not cover some records at all, including wills and testamentary trusts, adoption and divorce matters, court documents, and notices of utility shutoff, foreclosure or eviction, and of health or life insurance cancellation (15 U.S.C. 7003). State laws, such as those based on the Uniform Electronic Transactions Act, also apply. If the stakes are high, ask a lawyer where you live.

Which signature should I use?

Use a drawn or typed electronic signature for everyday agreement where the other side trusts the channel, such as returning a signed form by email. Use a digital signature when you need proof that the file did not change after signing, or when a company, court or government asks for certificate signing. Some EU processes require a qualified electronic signature.