What is the Electronic Signature?

Basic concepts:

Security:

Security is one of the key concepts to which the Administration, in the field of Information and Communication Technologies (ICT), must pay the utmost attention.

The Administration must extend the legal guarantees it offers to citizens and companies to the procedures carried out electronically.

The documents that are generated electronically are associated with three concepts that need to be safeguarded and that are: confidentiality, integrity and authenticity.

  • Confidentiality refers to the ability to keep an electronic document inaccessible to everyone, except a certain list of people.
  • Integrity guarantees that the document received matches the document issued without any possibility of change.
  • Authenticity refers to the ability to determine whether a given list of persons has established their recognition and/or commitment to the content of the electronic document. The problem of authenticity in a traditional document is solved by the autograph signature. Through their autographic signature, an individual, or several, express their willingness to recognize the content of a document, and if necessary, to comply with the commitments that the document establishes for the individual.

These problems, confidentiality, integrity and authenticity (the defined signature and encryption processes) are solved by the technology called cryptography. Cryptography is a branch of mathematics that, when applied to digital messages, provides the ideal tools to solve the aforementioned problems. The problem of confidentiality is commonly related to so-called encryption techniques and the problems of integrity and authenticity with so-called digital signature techniques, although both are actually reduced to cryptographic encryption and decryption procedures.

What is Asymmetric Cryptography? :

Asymmetric cryptography is the cryptographic method that uses a pair of complementary keys, public and private, to encrypt documents or messages. What is encoded with a private key needs its corresponding public key to be decoded. And vice versa, what is encoded with a public key can only be decoded with its private key. The private key must be known only by its owner, while the corresponding public key can be publicly disclosed.

The fact that the private key is only known to its owner allows us to achieve two important things:

  • Any document generated from this key must necessarily have been generated by the owner of the key (electronic signature).
  • A document to which the public key applies may only be opened by the owner of the corresponding private key (electronic encryption).

What is an electronic certificate? :

An electronic certificate is a document issued and signed by a certification authority that identifies a person (physical or legal) with a key pair. A certificate contains the following information:

  • Identification of the certificate holder (Name of the holder, NIF, e-mail,…).
  • Certificate badges: serial number, entity that issued it, date of issue, period of validity of the certificate, ....
  • A couple of keys: public and private.
  • The electronic signature of the certificate with the private key of the certification authority (CA) that issued it.

All this information can be divided into two parts:

  • Private part of the certificate: private key.
  • Public part of the certificate: other data of the certificate, including the electronic signature of the certification authority that issued it.

The private party is never ceded by its owner. This is the basis of security. With the key pair, encryption functions can be performed with the peculiarity that what is encrypted with the private key can only be decrypted with the public key and vice versa.

What is an electronic signature? :

An electronic signature is a fingerprint of a document encrypted with a key. The fingerprint is obtained by applying a mathematical algorithm to a message. This algorithm has two fundamental characteristics:

  • There is no possibility to get the message back from the generated fingerprint.
  • If you change the message, the digital footprint you get is different.

These two features guarantee the integrity of the message. If the content of the message is changed, the person verifying the signature will know.

The fingerprint is encrypted with the private key of the certificate of the person signing. Applying the verification mechanisms, the recipient will know who signed and that person cannot repudiate the authorship of the message.

How is an electronic signature generated? :

  1. You get a fingerprint of the digital document you want to sign. This fingerprint ensures that two different documents generate different fingerprints and two equal documents always generate the same fingerprint.
  2. Encryption (using mathematical algorithms) of the fingerprint with the private key of the certificate is performed. In this way, authenticity is guaranteed since it is the owner of the certificate who has only been able to perform this encryption.
  3. All documentation is encapsulated in a signed document that includes:
    1. Original document.
    2. Digital fingerprint encrypted with the private key.
    3. Public part of the certificate.

How is an electronic signature verified? :

  1. The digital fingerprint, encrypted with the private key, is decrypted using the public key of the certificate.
  2. You get the fingerprint of the original document.
  3. The two fingerprints are compared. If they match, the signature is correct (there is integrity, the document has not been modified).
  4. The issuing certification authority is consulted for the validity of the certificate and, if valid, the signature as well as correct is valid (the authenticity of the origin of the signature is guaranteed).