diff --git a/apps/marketing/content/blog/building-documenso-pt2.mdx b/apps/marketing/content/blog/building-documenso-pt2.mdx index e7a2605f7..c5f2e5e37 100644 --- a/apps/marketing/content/blog/building-documenso-pt2.mdx +++ b/apps/marketing/content/blog/building-documenso-pt2.mdx @@ -1,6 +1,6 @@ --- title: 'Building Documenso — Part 2: Signature Validity' -description: It's a signature valid? And what does that mean? It's a suprisingly complex question, let's take a look. +description: Is a signature valid? And what does that mean? It's a surprisingly complex question; let's take a look. authorName: 'Timur Ercan' authorImage: '/blog/blog-author-timur.jpeg' authorRole: 'Co-Founder' @@ -14,17 +14,17 @@ tags:
- If a tree does not comply with the EU trust list, does it make a sound when validating? + If a tree does not comply with the EU trust list, does it make a sound when validating?r
-> TLDR; Signatures can be valid and compliant for different signature levels, even if some validators show errors for higher levels. Not all useful security measures are mandated by law. +> TLDR; Signatures can be valid and compliant for different signature levels, even if some validators show higher-level errors. Not all helpful security measures are mandated by law. # A valid question @@ -33,9 +33,9 @@ A few days ago, an early adopter brought up this question in our [Discord](https
@@ -47,59 +47,59 @@ For those unfamiliar with the tool, he used the validator tool of the EU's Digit A short refresher from [Building Documenso — Part 1: Certificates](https://documen.so/certs): -> Documenso inserts all visual signatures into the document and then seals it using the "Documenso Inc." corporate certificate. This makes the resulting PDF document tamper-proof and guarantees it hasn’t changed since signing. +> Documenso inserts all visual signatures into the document and then seals it using the "Documenso Inc." corporate certificate. This makes the resulting PDF document tamper-proof and guarantees it hasn't changed since signing. Before we answer if the document was signed correctly, we need to understand what the goal was. -There are 3 signatures level in the europeas eIDAS regulation: +There are three signature levels in the European eIDAS regulation: -1. **Simple Electronic Signatures (Level 1/ SES):** Just a visual signature or even a checkbox on a document. +1. **Simple Electronic Signatures (Level 1/ SES):** This is just a visual signature or even a checkbox on a document. -2. **Advanded Electronic Signatures (Level 1/ SES)**: An actual crypographic signature (not just a seal on the whole document, but a specific signature), using a certificate linked to the identification data of the signer. +2. **Advanded Electronic Signatures (Level 2/ AES)**: An actual crypographic signature (not just a seal on the whole document, but a specific signature), using a certificate linked to the identification data of the signer. -3. **Qualified Electronic Signatures (Level 1/ SES):** Same as 2. but done by a government certified entity on certified hardware and after identifying the signer with an official ID document (e.g. passport) +3. **Qualified Electronic Signatures (Level 3/ QES):** Same as 2. but done by a government-certified entity on certified hardware and after identifying the signer with an official ID document (e.g., passport) -> 💡 Side Note: Number 2 is how most people imagine digital signatures. But most of the market uses 1. plus a seal on the whole document under the name of the signing provider (e.g. Documenso). The signers data is only inserted visually, not in the actual signature. Why? One of the reasons is, that it's much easier and without a readily availible open source framework to draw from it is quite tricky to build. This is something we aim to build (which many have done) and open source (which no one has done). +> 💡 Side Note: Number 2 (AES) is how most people imagine digital signatures. But most of the market uses 1. plus a seal on the whole document under the name of the signing provider (e.g., Documenso). The signer's data is only inserted visually, not in the actual signature. Why? One of the reasons is that it's much easier, and without a readily available open source framework to draw from, it is quite tricky to build. This is something we aim to build (which many have done) and open source (which no one has done). -From the perspective of eIDAS, Documenso offers Level 1/ SES signatures, since it does not adhere to all of the requirements of AES. This means that, technically, there is no legal need to seal the document to achieve this level of validity. We do it anyway since it improves the level of confidence users can have in the signed document. Sealing the document, even though not legally required, is a great example of Documenso’s approach to signatures. First we aim to provide all legal requirements for a given use case. Then we add any protection that can be added without unwarranted friction to the creation of the signature. +From the perspective of eIDAS, Documenso offers Level 1/ SES signatures since it does not adhere to all of the requirements of Level 2/ AES. This means that, technically, there is no legal need to seal the document to achieve this level of validity (at least within eIDAS). We do it anyway since it improves the level of confidence users can have in the signed document. Sealing the document, even though not legally required, is a great example of Documenso's approach to signatures. First, we aim to provide all legal requirements for a given use case. Then, we add any protection that can be added without unwarranted friction to the creation of the signature. ## Not if valid, but how valid -**Q: So, is the signature in the image invalid?** +**Q: So, is the signature in the image valid?** -A: No, it isn’t +A: Yes, as an eidas Level 1 SES. **Q: Then why does it say "Unable to build a certificate chain up to a trusted list"** -A: The certificate we use to seal the document after inserting the signatures is not on the EU Trust list +A: The certificate we use to seal the document after inserting the signatures is not on the EU Trust list. **Q: Does that mean it is less secure?** A: No, it means the provider (Wisekey) is not on a list maintained by the EU. The cryptographic signature is just as strong as any other -For someone who does not deal with this stuff daily, this can be hard to comprehend. Whether you use a certificate you generated yourself, one generated by a Certificate Authority (CA) like Wisekey, or one by another on the EU trust list (e.g., Bundesdruckerei), the cryptographic security guaranteeing that the document has not been tampered with is always the same. Many providers like Documenso, DocuSign, PandaDoc, and Digisigner all use this method for their regular plans. The mean, if you were to run a document signed by them through the validator above, the result would be the same (The sigaure format may vary though). The interesting question is why? +For someone who does not deal with this stuff daily, this can be hard to comprehend. Whether you use a certificate you generated yourself, one generated by a certificate authority (CA) like Wisekey, or one by another on the EU trust list (e.g., Bundesdruckerei), the cryptographic security guaranteeing that the document has not been tampered with is always the same. Many providers like Documenso, DocuSign, PandaDoc, and Digisigner all use this method for their regular plans. That means if you were to run a document signed by them through the validator above, the result would be the same[1]. The interesting question is why? Why do it like this? ## Certificate Infrastructure is broken -While there are some actual expenses involved in providing AES and QES, that blunt reality is, it's just good business to charge for them per signature, almost no one has the ressources to set this up themselves. While this initial process of becoming an QES certified is really expensive, selling the certificates afterward is very lucrative. This leads less innovation in the space and only big player providing these high-compliances services. Even certificates only used to seal documents without being QES certified are sold for a big range of prices, while they cost almost nothing to produce. +While there are some actual expenses involved in providing AES and QES, the blunt reality is that it's just good business to charge for them per signature, making it unsuitable for the "standard offerings"; almost no one has the resources to set this up themselves. While this initial process of becoming a QES-certified entity is really expensive, selling the certificates afterward is very lucrative. This leads to less innovation in the space and only big players providing these high-compliance services. Even certificates only used to seal documents without being QES certified are sold for a large range of prices, and they cost almost nothing to produce. ## Why Though? -**Q: Is the cryptographic security the same, why do people buy a certificate for money and not just generate one themselves** +**Q: Is the cryptographic security the same? Why do people buy a certificate for money and not just generate one themselves** A: Self-generated certificates are not recognized for higher-level compliance signatures like QES -**Q: So if you don’t need higher-level signatures, you could just generate one yourself?** +**Q: So if you don't need higher-level signatures, you could just generate one yourself?** A: Yes, you could. Since eIDAS Level 1 does not require a cert, you could use your own -**Q: Why don’t more people?** +**Q: Why don't more people?** A: One reason is that apart from the EU trust list, there are others, like the Adobe trust list. While not legally required, being on that one (like Wisekey) gives you a green checkmark in Adobe PDF, which is how most people check signature validity. **Q: Not a question, but all of this sounds weird** -A: It’s is. This is one of the reasons why Documenso exists. We plan to make this easier. +A: It is. This is one of the reasons why Documenso exists. We plan to make this easier. **Q: How?** @@ -111,3 +111,7 @@ As always, feel free to connect on [Twitter / X](https://twitter.com/eltimuro) ( Best from Hamburg\ Timur +\ +\ +\ +[1] The signature format (e.g. PKCS7-B) will vary. It's the format what the signature inserted into the document looks like. eIDAS itself does not specifically require any given format, but the PAdES defined by the EU is mostly used by european providers.