Electronic Signature

Introduction

An electronic signature is essentially the equivalent of a hand-written signature, with data in electronic form being attached to other electronic subject data (Invoice, Payment slip, Contract, etc) as a means of authentication.
Electronic signature is not just a 'picture' of the hand written signature. It is a digital signature that uses a cryptographic transformation of the data to allow the recipient of the data to prove the origin and integrity of the subject data.
In addition to this digital signature the electronic signature also has user authentication via digital certificate, smart card or a biometric method.

Increasingly, electronic signatures are being accorded the same legality as hand-written ones. The European Commission e-sign Directive (1999/93/EC) was a step in this direction, as was the June 2000, U.S. government E-sign bill.

On 28 November 2008 the European Commission adopted an 'Action Plan on e-signatures and e-identification to facilitate the provision of cross-border public services in the Single Market' (COM(2008) 798).

On 22nd December 2009, the European Commission issued a standardization mandate on electronic signatures (M/460) for the definition of a rationalized standardization framework.



Our Role & Activities

ETSI activity on electronic signatures is coordinated by technical committee Electronic Signatures and Infrastructures (ESI).
 
ETSI ESI is the committee dealing with electronic signatures (signature format, certificates, CSPs, trusted list) and ancillary services (Registered email, Time-Stamping, Long-term document preservation).

Their activity covers signature creation and verification based on advanced electronic signatures such as CAdES (CMS Advanced Electronic Signatures), XAdES (XML Advanced Electronic Signatures), PAdES (PDF Advanced Electronic Signatures), and ASiC (Associated Signature Container).  ESI also deals with cryptographic suites, trust service providers supporting e-signatures (e.g. certification authorities, time-stamping authorities), trust application providers (e.g. Registered Emails (REM) providers, Information preservation providers), and Trust-service Status List (TSL). TSL is defined to enhance the confidence of parties relying on certificates or other services related to electronic signatures since they have access to information that will allow them to know whether a given Trust Service Provider was operating under the approval of any recognized scheme at the time of providing their services and of any dependent transaction that took place.

In order to prove interoperability of implementations and enhance standards robustness, ETSI is running regular CAdES/XAdES PlugtestsTM events. Other PlugtestsTM events on PAdES, ASiC, and Registered Emails will enhance testing activities.

Latest ESI activities on:
http://portal.etsi.org/esi/esi_activities.asp



Standards

The following is a list of published and frequently downloaded standards. Please use the ETSI Work Programme to find further related standards.

Standard No.Standard Title
TS 101 733 CMS Advanced Electronic Signatures (CAdES)
TS 102 734 Profiles of CMS Advanced Electronic Signatures based on TS 101 733 (CAdES)
TS 101 903 XML Advanced Electronic Signatures (XAdES)
TS 102 904 Profiles of XML Advanced Electronic Signatures based on TS 101 903 (XAdES)
TS 102 778-1 PDF Advanced Electronic Signature Profiles;
Part 1: PAdES Overview - a framework document for PAdES
TS 102 778-2 PDF Advanced Electronic Signature Profiles;
Part 2: PAdES Basic - Profile based on ISO 32000-1
TS 102 778-3 PDF Advanced Electronic Signature Profiles;
Part 3: PAdES Enhanced - PAdES-BES and PAdES-EPES Profiles
TS 102 778-4 PDF Advanced Electronic Signature Profiles;
Part 4: PAdES Long Term - PAdES LTV Profile
TS 102 778-5 PDF Advanced Electronic Signature Profiles;
Part 5: PAdES for XML Content - Profiles for XAdES signatures
TR 102 047 International Harmonization of Electronic Signature Formats
TR 102 438 Application of Electronic Signature Standards in Europe
TR 102 605 Registered E-Mail
TS 102 640-1 Registered Electronic Mail (REM); Architecture, Formats and Policies;
Part 1: Architecture
TS 102 640-2 Registered Electronic Mail (REM); Architecture, Formats and Policies;
Part 2: Data Requirements and Formats for Signed Evidences for REM
TS 102 640-3 Registered Electronic Mail (REM); Architecture, Formats and Policies;
Part 3: Information Security Policy Requirements for REM Management Domains
TS 102 231 Provision of harmonized Trust-service status information
TS 101 861 Time stamping profile
TS 101 862 Qualified Certificate profile
TR 102 272 ASN.1 format for signature policies
TS 102 280 X.509 V.3 Certificate Profile for Certificates Issued to Natural Persons
TS 101 456 Policy requirements for certification authorities issuing qualified certificates
TR 102 437 Guidance on TS 101 456 (Policy Requirements for certification authorities issuing qualified certificates)
TR 102 458 Mapping Comparison Matrix between the US Federal Bridge CA Certificate Policy and the European Qualified Certificate Policy (TS 101 456)
TS 102 023 Policy requirements for time-stamping authorities
TR 102 040 International Harmonization of Policy Requirements for CAs issuing Certificates
TS 102 042 Policy requirements for certification authorities issuing public key certificates
TS 102 158 Policy requirements for Certification Service Providers issuing attribute certificates usable with Qualified certificates
TR 102 572 Best Practices for handling electronic signatures and signed data for digital accounting
TS 102 573 Policy requirements for trust service providers signing and/or storing data for digital accounting
TS 102 176-1 Algorithms and Parameters for Secure Electronic Signatures;
Part 1: Hash functions and asymmetric algorithms
TS 102 176-2 Algorithms and Parameters for Secure Electronic Signatures;
Part 2: Secure channel protocols and algorithms for signature creation devices