4/5/2024

Building Documenso — Part 2: Signature Validity

Timur Ercan

Co-Founder

TLDR; Signatures can be valid and compliant for different signature levels, even if some validators show higher-level errors. Not all helpful security measures are mandated by law.

A valid question

A few days ago, an early adopter brought up this question in our Discord:

For those unfamiliar with the tool, he used the validator tool of the EU's Digital Signature Service (DSS) Framework to check the signature of a document signed with Documenso. The EU provides this tool to help users and providers check the validity level of their signatures.

A short refresher from Building Documenso — Part 1: Certificates:

Documenso inserts all visual signatures into the document and then seals it using the "Documenso Inc." corporate certificate. This makes the resulting PDF document tamper-proof and guarantees it hasn't changed since signing.

Before we answer if the document was signed correctly, we need to understand what the goal was.

There are three signature levels in the European eIDAS regulation:

1. Simple Electronic Signatures (Level 1/ SES): This is just a visual signature or even a checkbox on a document.

2. Advanded Electronic Signatures (Level 2/ AES): An actual crypographic signature (not just a seal on the whole document, but a specific signature), using a certificate linked to the identification data of the signer.

3. Qualified Electronic Signatures (Level 3/ QES): Same as 2. but done by a government-certified entity on certified hardware and after identifying the signer with an official ID document (e.g., passport)

💡 Side Note: Number 2 (AES) is how most people imagine digital signatures. But most of the market uses 1. plus a seal on the whole document under the name of the signing provider (e.g., Documenso). The signer's data is only inserted visually, not in the actual signature. Why? One of the reasons is that it's much easier, and without a readily available open source framework to draw from, it is quite tricky to build. This is something we aim to build (which many have done) and open source (which no one has done).

From the perspective of eIDAS, Documenso offers Level 1/ SES signatures since it does not adhere to all of the requirements of Level 2/ AES. This means that, technically, there is no legal need to seal the document to achieve this level of validity (at least within eIDAS). We do it anyway since it improves the level of confidence users can have in the signed document. Sealing the document, even though not legally required, is a great example of Documenso's approach to signatures. First, we aim to provide all legal requirements for a given use case. Then, we add any protection that can be added without unwarranted friction to the creation of the signature.

Not if valid, but how valid

Q: So, is the signature in the image valid?

A: Yes, as an eidas Level 1 SES.

Q: Then why does it say "Unable to build a certificate chain up to a trusted list"

A: The certificate we use to seal the document after inserting the signatures is not on the EU Trust list.

Q: Does that mean it is less secure?

A: No, it means the provider (Wisekey) is not on a list maintained by the EU. The cryptographic signature is just as strong as any other

For someone who does not deal with this stuff daily, this can be hard to comprehend. Whether you use a certificate you generated yourself, one generated by a certificate authority (CA) like Wisekey, or one by another on the EU trust list (e.g., Bundesdruckerei), the cryptographic security guaranteeing that the document has not been tampered with is always the same. Many providers like Documenso, DocuSign, PandaDoc, and Digisigner all use this method for their regular plans. That means if you were to run a document signed by them through the validator above, the result would be the same[1]. The interesting question is why? Why do it like this?

Certificate Infrastructure is broken

While there are some actual expenses involved in providing AES and QES, the blunt reality is that it's just good business to charge for them per signature, making it unsuitable for the "standard offerings"; almost no one has the resources to set this up themselves. While this initial process of becoming a QES-certified entity is really expensive, selling the certificates afterward is very lucrative. This leads to less innovation in the space and only big players providing these high-compliance services. Even certificates only used to seal documents without being QES certified are sold for a large range of prices, and they cost almost nothing to produce.

Why Though?

Q: Why do people buy a certificate for money and not just generate one themselves? Isn't the cryptographic security the same?

A: Self-generated certificates are not recognized for higher-level compliance signatures like QES

Q: So if you don't need higher-level signatures, you could just generate one yourself?

A: Yes, you could. Since eIDAS Level 1 does not require a cert, you could use your own.

Q: Why don't more people?

A: One reason is that apart from the EU trust list, there are others, like the Adobe trust list. While not legally required, being on that one (like Wisekey) gives you a green checkmark in Adobe PDF, which is how most people check signature validity.

Q: Not a question, but all of this sounds weird

A: It is. This is one of the reasons why Documenso exists. We plan to make this easier.

Q: How?

A: By explaining and providing easy-to-use tools and eventually free, highly compliant signature certificates for everyone.

Eventually, we plan to start a free certificate authority called Let's Sign, named after another instituion that broke the paid certificate paradigm to the benefit of the internet: Let's Encrypt.

As always, feel free to connect on Twitter / X (DM open) or Discord if you have any questions or comments.

Best from Hamburg
Timur


[1] The signature format (e.g. PKCS7-B) will vary. It's the format what the signature inserted into the document looks like. eIDAS itself does not specifically require any given format, but the PAdES defined by the EU is mostly used by european providers.

• Document Signature
• Certificates
• Signing