In everyday language "electronic signature" and "digital signature" are used as synonyms, but in Europe there is a precise framework that distinguishes several levels of signature, with different technical requirements and effects. The reference is Regulation (EU) No 910/2014, known as eIDAS, updated in 2024 by a new regulation that introduced, among other things, the European digital identity wallet. This article explains its concepts from a cryptographic point of view, without going into legal detail.
Why a European regulation
Before eIDAS each country had its own rules, and a signature valid in one country might not be recognised in another. The regulation applies directly in all member states and sets two basic principles:
- an electronic signature cannot be denied legal effect solely because it is in electronic form;
- a qualified electronic signature issued in one member state is recognised as such in all the others.
Alongside signatures, eIDAS governs other trust services: electronic seals for organisations, timestamps, registered delivery services and certificates for website authentication.
The three levels of signature
Simple electronic signature
This is the broadest category: any data in electronic form, attached to other data, that the signatory uses to sign. Examples include a name typed at the bottom of an email, an "I agree" box ticked on a website or the image of a signature inserted into a PDF.
Technically, there is no cryptographic guarantee. Its evidential value depends on the circumstances and is assessed case by case.
Advanced electronic signature
To be advanced, a signature must meet four requirements:
- it is linked uniquely to the signatory;
- it is capable of identifying the signatory;
- it is created using data that the signatory can use, with a high level of confidence, under their sole control;
- it is linked to the signed data in such a way that any subsequent change is detectable.
These requirements describe exactly what a cryptographic signature provides: a private key controlled by the signatory, tied to their identity, and a signature computed over the document's hash, which becomes invalid if the document changes. Well-designed solutions such as graphometric signatures on tablets, which record the biometric data of the pen stroke and bind it cryptographically to the document, can also qualify as advanced signatures.
Qualified electronic signature
This is an advanced signature with two further requirements:
- it is created with a qualified signature creation device, certified against specific security standards: a smart card, a USB token or a remote hardware module;
- it is based on a qualified certificate, issued by a qualified trust service provider after rigorous verification of the holder's identity.
Under the express terms of the regulation, a qualified signature has legal effect equivalent to that of a handwritten signature. In Italy, the "firma digitale" is a type of qualified signature.
A summary table
| Level | Technical guarantee | Example | Value |
|---|---|---|---|
| Simple | None specified | Name at the bottom of an email | Assessed case by case |
| Advanced | Key under the signatory's control, change detection | Cryptographic signature with a non-qualified certificate | Higher, but to be assessed |
| Qualified | Advanced + qualified device + qualified certificate | Smart card or remote signature from a qualified provider | Equivalent to a handwritten signature |
Remote signing
For a long time a qualified signature required a smart card and a reader. Today remote signing is widespread: the holder's private key is kept in a hardware security module at the provider, and the holder activates it by authenticating with credentials and a second factor, such as a one-time code on their phone.
From a cryptographic standpoint the principle does not change: the key never leaves the protected device and can only be used by its holder. What changes is convenience, because you can sign from any computer or smartphone.
How to check who is a qualified provider
Each member state publishes a trusted list of qualified trust service providers and the services they offer. The European Union provides a tool for browsing the lists of all countries together. Signature verification software uses these lists to determine whether a certificate is qualified.
The electronic seal
The electronic seal is the equivalent of a signature for legal persons: a company or public body applies it to guarantee the origin and integrity of a document, such as an invoice or an automatically issued certificate. Technically it works like a signature, but the certificate is issued to the organisation rather than to an individual.
Practical advice
- For important contracts and documents, prefer a qualified signature, whose value is established uniformly.
- Protect your signing PIN and credentials like your house keys: whatever you sign with them is attributed to you.
- Verify the signatures you receive with reliable verification software; do not just look at the document.
- Keep the certificate's expiry in mind and consider using timestamps for documents that must be kept for a long time.
In short
- The eIDAS regulation distinguishes simple, advanced and qualified electronic signatures.
- An advanced signature requires sole control of the key and detection of changes, just like a cryptographic signature.
- A qualified signature adds a qualified device and certificate and has effects equivalent to a handwritten signature.
- Trusted lists show which providers and services are qualified.
- The electronic seal plays for organisations the role that the signature plays for individuals.
