What is a digital signature? Are digital signatures and electronic signatures the same thing?

The connotations of electronic signatures and digital signatures are different. Digital signatures are one type of electronic signature technology, but the relationship between the two is also very close. The signatures mentioned in the current electronic signature law generally refer to is the "digital signature".

Electronic signature

To understand what an electronic signature is, we need to start with a traditional manual signature or seal. In traditional business activities, in order to ensure the safety and authenticity of transactions, a written contract or official document must be signed and sealed by the parties or their responsible persons, so that both parties to the transaction can identify who signed the contract and ensure the signature or seal. Only by recognizing the content of the contract can the contract be legally recognized as valid. In the virtual world of e-commerce, contracts or documents are expressed and delivered in the form of electronic documents. On electronic documents, traditional handwritten signatures and seals are not possible, which must be replaced by technical means. An electronic technical means of signature that can identify the true identities of both parties in electronic documents, ensure the security, authenticity and non-repudiation of the transaction, and play the same role as a handwritten signature or seal, is called an electronic signature.

Legally speaking, a signature has two functions: to identify the signer and to express the signer's recognition of the content of the document. The United Nations Conference on Trade and Development's "Model Law on Electronic Signatures" defines electronic signatures as follows: "Refers to data contained in electronic form in a data message, attached to it or logically linked to the data message. It can be used to authenticate the data." The signatory related to the message and the signatory indicating that the signatory acknowledges the information contained in the data message; in the European Union's "Electronic Signatures Framework Directive" it is stipulated that "attached in electronic form or logically related to other electronic data" The data, as a method of identification, is called "electronic signature."

There are many technical means to achieve electronic signature, but currently the more mature electronic signature technology commonly used in advanced countries in the world is still "digital signature" "Technology. Since maintaining technology neutrality is a basic principle in formulating laws, there is currently no reason why public key cryptography theory is the only technology for making signatures. Therefore, it is necessary to provide a more general concept to adapt to future technological developments. However, the signature mentioned in the current electronic signature law generally refers to a "digital signature".

Digital signature

The so-called "digital signature" is to generate a digital signature through some kind of cryptographic operation. A series of symbols and codes form an electronic password for signature instead of a written signature or seal. This electronic signature can also be technically verified, and the accuracy of its verification is unmatched by the verification of ordinary manual signatures and stamps. "Signature" is currently the most commonly used, technically mature and operable electronic signature method in e-commerce and e-government. It adopts standardized procedures and scientific methods to identify the identity of the signer. As well as the recognition of an electronic data content. It can also verify whether the original text of the file has been changed during the transmission process, ensuring the integrity, authenticity and non-repudiation of the transmitted electronic file.

Digital signature. It is defined in the ISO7498-2 standard as: "Some data appended to the data unit, or a cryptographic transformation made to the data unit. This data and transformation allow the recipient of the data unit to confirm the source and identity of the data unit. Integrity, and protect the data from being forged by others (such as the recipient)." The U.S. Electronic Signature Standard (DSS, FIPS186-2) explains digital signatures as follows: "Using a set of rules and a parameter to calculate the data The result can be used to confirm the identity of the signer and the integrity of the data." According to the above definition, PKI (Public Key Infrastructino) provides cryptographic transformation that can provide data units, and enables the recipient to determine the source and origin of the data. Verify the data.

The core execution agency of PKI is the electronic certification service provider, commonly known as the certification authority (CA). The core element of the PKI signature is the digital certificate issued by the CA. The PKI services provided are authentication, data integrity, data confidentiality and non-repudiation. Its method is to use the certificate public key and the corresponding private key to perform encryption/decryption, and generate signatures and verification signatures for digital messages. Digital signatures use public key cryptography and other cryptographic algorithms to generate a series of symbols and codes to form an electronic password for signature, instead of writing signatures and seals; this electronic signature can also be technically verified, and the accuracy of its verification is Verification of hand signatures and stamps is unmatched in the physical world. This signature method can be authenticated in a large trusted PKI domain population, or cross-certified in multiple trusted PKI domains. It is especially suitable for secure authentication and transmission on the Internet and wide area networks.

The biggest difference between "digital signature" and ordinary text signature is that it can use distinctive graphic files. You only need to use a scanner or drawing tool to create your personalized signature, seal or even photo. into a BMP file, it can be used as material for "digital signature".

At present, there are many softwares that can provide "digital signature" function, and the usage and principles are similar. Among them, "OnSign" is the more commonly used one. After installing "OnSign", the "OnSign" shortcut button will appear on the toolbar of Word, Outlook and other programs. Every time you use it, you need to enter your own password to ensure that others cannot steal it.

For documents sent using "OnSign", the recipient also needs to install "OnSign" or "OnSign Viewer" so that it can recognize the "digital signature". According to the design of "OnSign", any tampering or interception of file content will invalidate the signature. Therefore, when the other party recognizes your "digital signature", it can be sure that the document was sent by you and has not been tampered with or intercepted in the process. Of course, if the recipient is still unsure, you can also click the blue question mark on the "Digital Signature" and "OnSign" will automatically check again. If there is a problem with the file, a red warning sign will appear on the "Digital Signature".

In the Internet age where emails are frequently used, good use of "digital signatures", just like "registered letters" in traditional letters, undoubtedly adds another protective barrier to the security of files transmitted over the network.