The term "digital signature" is often misused to mean even a simple image of a signature pasted into a document. In the technical sense, however, a digital signature is a precise cryptographic operation that links a document to a private key in a verifiable way. Let us look at what really happens, step by step.
What a signature must guarantee
A well-made digital signature offers three guarantees:
- authenticity: the document comes from the holder of the private key;
- integrity: the document has not been modified after signing, not even by a comma;
- non-repudiation: the signer cannot credibly claim not to have signed, provided their private key was under their exclusive control.
An image of a handwritten signature inserted into a PDF guarantees none of these: anyone can copy and paste it elsewhere, and the document can be changed afterwards without leaving a trace.
The signing process
Digital signatures rely on asymmetric cryptography. The signer owns a key pair: a private key, held only by them, and a public key known to everyone.
- Computing the fingerprint: the software computes the hash of the document, for example with SHA-256. The result is a short value that uniquely represents that content.
- Signing the fingerprint: the hash is processed with the signer's private key, using a signature algorithm such as RSA-PSS, ECDSA or EdDSA. The result is the signature.
- Packaging: the signature is combined with the document, together with the signer's certificate, in a standard format.
In the most serious signing devices, the private key never leaves a smart card, a USB token or a remote hardware module. The document, or rather its fingerprint, is sent to the device, which returns only the signature.
The verification process
Whoever receives the signed document performs the reverse operation:
- they recompute the hash of the received document;
- they use the signer's public key to check that the signature matches that hash;
- they check the certificate: that the public key really belongs to the person named, that the certificate was issued by a trusted authority and that it was not expired or revoked at the time of signing.
If even a single byte of the document has changed, the recomputed hash will be different and verification will fail. If the signature was produced with another key, verification will fail as well.
The role of the certificate
Mathematics alone proves that a signature was produced by a certain private key. It does not say whose key it is. That link is established by the digital certificate, an electronic document signed by a certificate authority stating: "this public key belongs to this person".
Without a trustworthy certificate, anyone could generate a key pair in someone else's name. That is why digital signatures with legal value require the holder's identity to be verified before the certificate is issued.
The most common formats
In Europe, advanced signature formats are standardised. The most widespread are:
| Format | What it looks like | Characteristic |
|---|---|---|
| CAdES | File with the .p7m extension | An envelope containing document and signature; software is needed to open it |
| PAdES | Signed PDF | The signature sits inside the PDF and can be seen with an ordinary reader |
| XAdES | Signed XML file | Used for structured data, such as electronic invoices |
The .p7m format often puzzles people receiving it for the first time: it is not a damaged document, but an envelope containing the original. A verification program opens it, checks the signature and extracts the file.
Signatures and time
A certificate has an expiry date and can be revoked, for example if the smart card is lost. This raises a question: how do you prove that a document was signed while the certificate was still valid?
The answer is the timestamp: a trusted authority signs the document's hash together with a date and time, attesting that the content existed at that moment. Signature standards also include long-term preservation profiles, which embed the revocation information and timestamps needed to verify the signature even many years later.
The most frequent mistakes
- Confusing a digital signature with a graphic one: a scanned signature proves nothing cryptographically.
- Lending the signing device or sharing the PIN with colleagues: whatever your key signs is attributed to you.
- Editing a PDF after signing and expecting the signature to remain valid: any change invalidates the signature, unless the standard allows it, such as adding further signatures.
- Trusting the green icon without reading who the signer named in the certificate actually is.
In short
- A digital signature links a document to a private key and guarantees authenticity, integrity and non-repudiation.
- The document's hash is signed with the private key; verification uses the public key.
- The certificate links the public key to the signer's identity.
- The main formats are CAdES (.p7m), PAdES (PDF) and XAdES (XML).
- Timestamps make it possible to verify a signature even after the certificate has expired.
